STIX is a language for describing cyber threat intelligence in a structured, machine readable form. TAXII is the companion specification for moving STIX data between systems. Think of STIX as the contents of the envelope and TAXII as the postal service that carries it.
What STIX 2.1 defines
STIX 2.1 is described by its standards body as a language for expressing cyber threat and observable information. The default serialization is JSON in UTF-8, so a STIX document is plain text that tools can parse.
The three kinds of object
STIX Domain Objects (SDOs) are the higher level concepts analysts work with. Examples in the spec include Attack Pattern, Campaign, Course of Action, Indicator, Intrusion Set, Malware, Report, Threat Actor, Tool and Vulnerability.
STIX Cyber observable Objects (SCOs) record observed facts about a network or host: a file that existed, a running process, traffic between two addresses. The spec points out that they do not say who, when or why. The domain objects add that context.
STIX Relationship Objects (SROs) link objects together. The spec defines the general Relationship object and the Sighting object, which records that someone has seen a thing and can include a count.
There are also meta objects for things like data markings, and a Bundle object that packages STIX content for transfer.
A tiny example in words
A Malware object names a family. An Indicator object holds a pattern that detects it. A Relationship object says the indicator detects the malware. A Sighting says your organization saw it three times. Each piece is separate, so tools can reuse them.
Where TAXII fits
STIX does not depend on any transport. TAXII is the specification designed to carry STIX objects, usually through a server that clients poll or push to. CISA's Automated Indicator Sharing service, for example, tells participants to use a TAXII 2.1 client.
Do you need it?
If you only read reports and copy a few addresses into a blocklist, you can skip it. It starts to pay off when you:
- ingest several feeds and need consistent fields
- share your own indicators with a community
- want a platform to link indicators to campaigns and actors
Pitfalls
Structure does not guarantee quality. A well formed Indicator can still be wrong, old or too broad. Check confidence, validity dates and source before you let a feed block traffic automatically.
Reading a STIX bundle
A bundle is a JSON file with a list of objects. Each has a type, an identifier and timestamps. Look first for Indicator objects, then follow Relationship objects to see what each indicator is tied to. If a bundle has no relationships, you have a flat list, and you lose the context that makes STIX worth using.
Check the validity fields on indicators. They say from when and until when an indicator should be considered meaningful. Ignoring them is how stale items end up in blocklists.
A practical first project
Take one feed that offers STIX, load it into a free platform, and compare what it gives you with what you already had. Count the items you can match against your own logs in a week. If the number is zero, the feed is not helping yet.
Quick check
Is STIX only for indicators?
No. Indicators are one object type among many, including actors, campaigns, malware, tools and vulnerabilities.
Can I use STIX without TAXII?
Yes. The format is transport agnostic. You can exchange bundles by file or any other channel.
Sources
Last reviewed: 19 October 2026.
