Home
Glossary
STIX
Table of contents
5 min
H2 title on one or more lines.
Share
Updated on
June 22, 2026

What is STIX (Structured Threat Information Expression)?

STIX (Structured Threat Information Expression) is an open, standardized language for describing cyber threat intelligence (CTI) in a consistent, structured, and machine-readable format. It gives security teams and systems a common vocabulary for representing threats: indicators, malware, threat actors, attack patterns, and the relationships between them, so that intelligence can be shared, stored, and analyzed the same way across different organizations and tools. STIX defines the "what" of threat intelligence. Its companion protocol, TAXII (Trusted Automated Exchange of Intelligence Information), defines the "how" of transporting it. Because STIX is machine-readable, threat data expressed in it can flow automatically between SIEMs, SOAR platforms, EDR solutions, threat intelligence platforms, and sharing communities, without manual reformatting.

Key takeaways

  • STIX is a common language for threat intelligence: It standardizes how cyber threats are described so different systems can understand the same data.
  • STIX is the "what"; TAXII is the "how": STIX structures the intelligence; TAXII is the transport protocol that moves it between producers and consumers.
  • It's machine-readable and automation-friendly: STIX 2.1 uses JSON, letting intelligence flow directly into SIEM, SOAR, EDR, and threat intelligence platform (TIP) tools.
  • It's an open OASIS standard: Originally created by MITRE with the US DHS, STIX is now maintained by the OASIS Cyber Threat Intelligence Technical Committee.
  • It powers collective defense: STIX is widely used by governments, CERTs, and ISACs to share intelligence at scale.

STIX and TAXII: What is the difference?

STIX and TAXII are almost always mentioned together, but they do different jobs. STIX is the language: it provides the data structure and vocabulary to describe a threat in a standardized way. TAXII is the transport: an application-layer protocol that lets organizations send, receive, request, and manage STIX-formatted intelligence over HTTPS, typically through a TAXII server exposing collections that consumers can poll or subscribe to.

The community often describes it as language versus conversation: STIX gives everyone the same words and grammar, and TAXII is the channel through which the conversation happens. STIX is designed to be shared via TAXII, but it can also be shared by other means.

A brief history of STIX

STIX and TAXII were initially developed by the MITRE Corporation, starting around 2012, in collaboration with the US Department of Homeland Security (DHS), with the goal of improving CTI sharing between the public and private sectors. In 2015, stewardship moved to the OASIS Cyber Threat Intelligence (CTI) Technical Committee, a nonprofit body that now develops and maintains both standards.

A major evolution came with the 2.x generation, which rebuilt STIX around JSON (replacing the earlier XML-based 1.x) and paired it with a RESTful TAXII 2.x transport. STIX 2.1 and TAXII 2.1 were approved as OASIS standards in 2021 and represent the current version. STIX remains open, free, and extensible, which is central to its wide adoption.

How STIX works: Objects and relationships

STIX represents threat intelligence as a connected graph of objects rather than free text. It maps the key components of a threat report to defined object types, so a report becomes a set of structured, linked entities. The main building blocks are:

  • STIX Domain Objects (SDOs): the core concepts of threat intelligence, such as indicator, malware, threat actor, attack pattern, campaign, intrusion set, course of action, identity, and vulnerability.
  • STIX Cyber-observable Objects (SCOs): the technical artifacts observed, such as IP addresses, file hashes, domain names, and registry keys.
  • STIX Relationship Objects (SROs): the links that connect objects, expressing that an indicator "indicates" a piece of malware, for example, or that a threat actor "uses" an attack pattern.

Because everything is expressed as objects and relationships, a STIX bundle can capture not just isolated indicators of compromise but the full context around them: who is behind a threat, how it operates, and what to do about it, in a form that both humans and machines can process.

What STIX is used for

STIX supports a range of cyber threat management use cases, but they share one goal: turning threat knowledge into something that can be shared and acted on automatically. Common applications include:

  • Sharing threat intelligence: distributing indicators, adversary TTPs, and analysis between organizations, sectors, and across borders in a consistent format.
  • Feeding security tools: piping intelligence directly into SIEMs, SOAR platforms, EDR solutions, and threat intelligence platforms to accelerate detection and response.
  • Collective defense: supporting the intelligence exchanged within ISACs, ISAOs, CERTs, and national SOCs, so a threat seen by one member can protect many.
  • Analysis and situational awareness: storing and structuring intelligence so analysts can correlate campaigns, actors, and indicators over time.

Who uses STIX?

STIX has been adopted internationally by governments, CERTs, ISACs, and private-sector organizations, and is supported across many commercial security products and open-source projects. The US DHS uses STIX and TAXII so its public and private partners can exchange intelligence through secure, automated mechanisms. Its status as an open, vendor-neutral OASIS standard is what makes it a lingua franca: it lets intelligence move between otherwise incompatible tools and organizations.

Expert insight: A standard is only useful if your platform speaks it natively

STIX solves the interoperability problem on paper, but the value only materializes if the tools in your stack actually produce and consume it natively, rather than treating it as an import/export afterthought. Intelligence that has to be flattened into a spreadsheet, stripped of its relationships, and manually re-entered loses exactly what STIX was designed to preserve: the context and the links between objects. The question to ask of any CTI or detection platform isn't whether it can open a STIX file, but whether STIX is its native way of modeling threats.

That's where Sekoia's design matters. Sekoia Intelligence models its cyber threat intelligence natively in STIX 2.1, with objects fully contextualized and linked to their related entities (threat actors, malware, campaigns, vulnerabilities, indicators), and it supports TAXII for automated exchange. Intelligence keeps its structure and relationships as it flows into detection on the Sekoia AI SOC platform, and it flows outward too: Sekoia can act as a STIX/TAXII producer for the ISACs, CERTs, and sharing communities that rely on these standards. Because native STIX support runs in both directions, an organization can enrich its own detection and contribute to collective defense without losing fidelity. As a European vendor, Sekoia pairs this with a data-sovereignty posture that matters to the public-sector and sector-level bodies most invested in standardized sharing.

STIX is the right standard. Insist on native support, not a checkbox.

‍

Frequently asked questions

What is STIX in cybersecurity?

STIX (Structured Threat Information Expression) is an open, standardized language for describing cyber threat intelligence in a consistent, machine-readable format. It provides a common vocabulary for representing threats, indicators, malware, threat actors, attack patterns, and their relationships, so intelligence can be shared and analyzed the same way across different organizations and tools.

What is the difference between STIX and TAXII?

STIX is the language that structures threat intelligence (the "what"); TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol that transports it (the "how"). STIX defines how a threat is described; TAXII defines how that description is sent, received, and managed between systems, usually over HTTPS via a TAXII server.

Who created and maintains STIX?

STIX was initially developed by the MITRE Corporation in collaboration with the US Department of Homeland Security, starting around 2012. Since 2015 it has been maintained by the OASIS Cyber Threat Intelligence (CTI) Technical Committee, which develops both STIX and TAXII as open standards. STIX remains free, open, and extensible.

What is STIX 2.1?

STIX 2.1 is the current version of the standard, approved by OASIS in 2021. The 2.x generation rebuilt STIX around JSON (replacing the earlier XML-based 1.x) and is paired with the TAXII 2.x transport protocol. Compared with earlier versions, it introduced new objects and refined existing ones to better represent modern threat intelligence.

What are STIX objects?

STIX represents intelligence as objects and relationships. STIX Domain Objects (SDOs) capture concepts like indicators, malware, threat actors, and attack patterns; STIX Cyber-observable Objects (SCOs) capture technical artifacts like IP addresses and file hashes; and STIX Relationship Objects (SROs) link them together, for example showing that an indicator indicates a piece of malware.