We are pleased to announce that STIX™ Version 2.1 and TAXII™ Version 2.1 from the OASIS Cyber Threat Intelligence (CTI) TC are now available for public review and comment.
Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence. STIX enables organizations and tools to share threat intelligence with one another in a way that improves many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.
STIX V2.1 adds new objects and concepts and incorporates improvements based on experience implementing version 2.0. The objects and features added for inclusion represent an iterative approach to fulfilling basic consumer and producer requirements for CTI sharing. Objects and properties not included in this version of STIX, but deemed necessary by the community, will be included in future releases.
Trusted Automated Exchange of Intelligence Information (TAXII) is an application layer protocol used to exchange cyber threat intelligence (CTI) over HTTPS. It enables organizations to share CTI by defining an API that aligns with common sharing models.
TAXII is specifically designed to support the exchange of CTI represented in STIX. As such, the examples and some features in the specification are intended to align with STIX. This does not mean TAXII cannot be used to share data in other formats; it is designed for STIX, but is not limited to STIX.