# What are STIX and TAXII?

> STIX and TAXII are OASIS open standards for cyber threat intelligence — STIX defines how intelligence is represented as structured objects, and TAXII defines how that intelligence is exchanged between systems.

- Canonical URL: https://yellowcube.eu/glossary/stix-and-taxii/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Structured Threat Information Expression (STIX) describes intelligence as typed objects — indicators, malware, threat actors, campaigns, relationships — so different producers and consumers can exchange unambiguous, machine-readable content. Trusted Automated eXchange of Intelligence Information (TAXII) supplies the transport service model, exposing collections and channels over HTTPS.

Together they underpin most modern threat-intelligence sharing: ISAC and community feeds, platform-to-platform synchronization, and enrichment pipelines commonly speak STIX 2.x over TAXII 2.x. The standards define format and transport, not content quality — a STIX feed is only as useful as the analysis and curation behind it.

### Key points

- **STIX objects:** Domain objects describe entities such as indicators, malware, threat actors, and tools; relationship objects connect them into graph structures; cyber-observable objects describe technical facts such as files, addresses, and registry values.
- **TAXII services:** Collections provide pull-based retrieval of content, while channels support publish-subscribe distribution; a TAXII server can host either or both.
- **Operational use:** Map incoming objects to local schemas, preserve provenance and confidence, and evaluate how feeds are filtered, deduplicated, expired, and measured rather than maximizing ingest volume.
- **Important limitation:** Conformance to the format says nothing about accuracy, relevance, or timeliness. Many feeds contain stale or low-confidence indicators, and blind automated ingestion can import noise or false positives into detection controls.

### Related terms

[Threat intelligence platform (TIP)](<https://yellowcube.eu/glossary/threat-intelligence-platform/>) · [Threat intelligence feed](<https://yellowcube.eu/glossary/threat-intelligence-feed/>) · [Cyber threat intelligence (CTI)](<https://yellowcube.eu/glossary/cyber-threat-intelligence/>) · [Indicator of compromise (IoC)](<https://yellowcube.eu/glossary/indicator-of-compromise/>)

### Sources

[OASIS, CTI Documentation — STIX/TAXII](https://oasis-open.github.io/cti-documentation/) · [OASIS, Cyber Threat Intelligence Technical Committee](https://www.oasis-open.org/committees/cti/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.