STIX and TAXII are two open standards for sharing cyber threat intelligence. STIX (Structured Threat Information Expression) is a language and format that describes threat data in a consistent, machine-readable way. TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol that carries that data between systems over HTTPS.
- Also Called2other namesSTIX · TAXII
- Related Terms3linked entriesThreat feed · Indicator of compromise (IoC)
- Read Next1guide on the same topic
What are STIX and TAXII?
OASIS, which publishes both specifications, describes STIX as a language and serialization format used to exchange cyber threat intelligence. It describes TAXII as an application layer protocol for communicating cyber threat information in a simple and scalable manner, designed to carry STIX over HTTPS. One defines what the data looks like. The other defines how it moves.
| Question | STIX | TAXII |
|---|---|---|
| What it is | A language and format | A transport protocol |
| What it does | Describes threat data in a consistent, machine-readable way | Moves threat data between systems over HTTPS |
| Example | An indicator linked to a malware object | A collection of objects shared with partners |
What does STIX describe?
STIX 2.1 uses a graph model. Objects are the nodes and relationships are the edges that connect them. The specification requires UTF-8 encoded JSON as its format and adds versioning, data markings that control sharing, and a patterning language for detection.
- Domain objectsAttack Pattern, Campaign, Malware, Threat Actor, Indicator, Infrastructure, Vulnerability
- Cyber-observable objectsFile, Process, Network Traffic, Email Message
- Relationship objectsA generic Relationship and a Sighting
- FormatUTF-8 encoded JSON
How does TAXII work?
TAXII organizes sharing around collections of threat information and carries STIX content over HTTPS, so a feed, a partner or a platform can exchange intelligence automatically instead of by email or spreadsheet. Sources that publish in these formats can feed a threat feed or a threat intelligence platform.
Why do STIX and TAXII matter?
OASIS says the aim is to share threat data in a consistent, machine-readable way, which improves collaborative analysis and automated detection. A shared format also means an indicator of compromise can travel with its context, such as the threat actor or malware it relates to, instead of arriving as a bare list.
CISA’s Automated Indicator Sharing service is a working example. CISA describes it as a service that enables real-time exchange of machine-readable cyber threat indicators and defensive measures between public and private-sector organizations, and participants need a STIX and TAXII capability to take part.
Also Called.
- NameSTIX
- NameTAXII
Questions.
-
What is the difference between STIX and TAXII?
STIX is the language and format that describes threat intelligence. TAXII is the protocol that transports it between systems over HTTPS.
-
What does STIX stand for?
Structured Threat Information Expression.
-
What does TAXII stand for?
Trusted Automated Exchange of Intelligence Information.
-
What format does STIX use?
STIX 2.1 requires UTF-8 encoded JSON as its mandatory-to-implement serialization.
Sources
In Our Research
- 1 Managed Detection and Response (MDR): Enhancing Threat Visibility June 2025
- 2 Threat Intelligence: Feeds, Platform or Managed Service 101 guide
- 3 Threat Intelligence Evaluation Checklist 101 guide
- 4 Threat Intelligence Platforms 101 101 guide
- 5 Indicator of compromise (IoC) Glossary term
- 6 Threat feed Glossary term