What is STIX?
STIX, short for Structured Threat Information Expression, is a standard way to write down threat intelligence so that any tool can read it. Instead of every vendor inventing its own spreadsheet columns, STIX defines named object types, the fields each one carries and how objects relate to each other. MITRE created STIX with sponsorship from the U.S. Department of Homeland Security, and the OASIS standards body has maintained it since 2015. Version 2.1, the version in current use, is written in JSON; the older 1.x versions used XML.
The building blocks
STIX 2.1 is built around three kinds of core objects:
- Domain objects (SDOs) describe the high-level ideas: indicator, malware, threat actor, intrusion set, campaign, attack pattern, tool, vulnerability, course of action, identity, report and several more.
- Cyber-observable objects (SCOs) describe concrete technical facts, such as an IPv4 address, a domain name, a file and its hashes, a URL or a network connection.
- Relationship objects (SROs) connect the others. A relationship says that an indicator indicates a malware family or that a threat actor uses an attack pattern, and a sighting records that someone actually observed an indicator.
Every object has a type and an ID made of that type plus a UUID. Domain and relationship objects also carry created and modified timestamps, and producers can add a confidence value and data markings, such as TLP labels, that say how widely the object may be shared. Objects are often packaged in a bundle for transfer.
What STIX looks like
An indicator holds a pattern written in the STIX patterning language. A rule that flags connections to a known C2 address reads [ipv4-addr:value = '203.0.113.80'], and one that matches a phishing link reads [url:value = 'https://login-portal.example/verify']. A separate relationship object then ties the indicator to the malware it detects, with "relationship_type": "indicates", a source_ref holding the indicator's ID and a target_ref holding the malware object's ID. Because the links are explicit, a receiving platform can build a graph: this address and this URL belong to this malware, which this group uses in this campaign.
Why the standard matters
A shared format removes the custom parser that every new source used to need. A SIEM, firewall, threat intelligence platform or EDR product that understands STIX can take in indicators from a government program, an ISAC and a commercial vendor without three separate integrations. The relationships also carry context that a flat list of values loses, which helps analysts decide whether a match matters. Not every producer uses STIX. Many sources still publish CSV files or proprietary APIs, and platforms such as MISP convert between formats.
STIX vs. TAXII vs. TLP
- STIX is the content: the language and data model for describing threat intelligence.
- TAXII is the transport: an HTTPS API that moves STIX content between servers and clients.
- TLP is a sharing label: it says who may receive a piece of information, and it can be attached to STIX objects as a marking.
SCAP is a separate family of standards that is easy to confuse with these. It describes configuration checks and vulnerability data so tools can assess your own systems automatically; it is not a way to describe attackers.
STIX on the CompTIA Security+ exam
STIX belongs with threat intelligence sharing under SY0-801 objective 2.1, which covers where threat information comes from and how it moves between organizations and tools. STIX does not appear on the SY0-801 acronym list, so know the expansion and the role it plays. If a question asks for a standardized format or language for describing indicators, actors and campaigns so that different tools can read them, the answer is STIX. If it asks how that data is exchanged or transmitted automatically between systems, the answer is TAXII. TLP, SCAP and syslog are the usual distractors.