Structured Threat Information Expression (STIX) describes intelligence as typed objects — indicators, malware, threat actors, campaigns, relationships — so different producers and consumers can exchange unambiguous, machine-readable content. Trusted Automated eXchange of Intelligence Information (TAXII) supplies the transport service model, exposing collections and channels over HTTPS.
Together they underpin most modern threat-intelligence sharing: ISAC and community feeds, platform-to-platform synchronization, and enrichment pipelines commonly speak STIX 2.x over TAXII 2.x. The standards define format and transport, not content quality — a STIX feed is only as useful as the analysis and curation behind it.
Key points
STIX objectsDomain objects describe entities such as indicators, malware, threat actors, and tools; relationship objects connect them into graph structures; cyber-observable objects describe technical facts such as files, addresses, and registry values.
TAXII servicesCollections provide pull-based retrieval of content, while channels support publish-subscribe distribution; a TAXII server can host either or both.
Operational useMap incoming objects to local schemas, preserve provenance and confidence, and evaluate how feeds are filtered, deduplicated, expired, and measured rather than maximizing ingest volume.
Important limitationConformance to the format says nothing about accuracy, relevance, or timeliness. Many feeds contain stale or low-confidence indicators, and blind automated ingestion can import noise or false positives into detection controls.