What is TAXII?
TAXII, short for Trusted Automated Exchange of Intelligence Information, is the protocol for sending and receiving threat intelligence between systems. It was designed to carry STIX content, and like STIX it is maintained by the OASIS standards body. Version 2.1 defines a RESTful API over HTTPS: a TAXII server publishes intelligence, and TAXII clients connect to read it and, where permitted, to add their own.
How a TAXII server is organized
- Discovery: a starting endpoint that tells a client which API roots the server offers.
- API roots: separate groupings on one server, for example one per sharing community or customer.
- Collections: repositories of STIX objects inside an API root. Each one states whether the client may read from it, write to it or both.
- Status: lets a client check whether objects it submitted were accepted.
Collections work on a request-response basis: clients ask the server for whatever is new. The specification sets aside the idea of channels for publish-subscribe sharing but does not define them, so in practice TAXII means clients polling collections.
A TAXII request
A SIEM connector that checks a sharing community's collection every hour might send:
GET /community/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/objects/?added_after=2026-10-21T00:00:00Z
with the header Accept: application/taxii+json;version=2.1. The server answers with an envelope of STIX objects added since that time and a flag that says whether more pages are waiting. The connector stores the newest timestamp it received and sends it on the next poll, so it only downloads changes. Writing works in the other direction: a member with write access POSTs new STIX objects to the collection, and the server returns a status resource the client can check later.
Security of the exchange
The word trusted in the name depends on how the server is run. TAXII uses HTTPS, so traffic is protected with TLS, and current guidance is TLS 1.2 at minimum with 1.3 preferred. Servers authenticate clients, commonly with credentials, API keys or client certificates, and grant read or write rights per collection. Shared intelligence can still be sensitive, so TLP markings on the STIX objects tell recipients how far they may pass it on. Write access needs care too: a careless or compromised member that submits bad indicators can pollute everyone's blocklists.
TAXII vs. STIX and other transports
STIX defines what the intelligence says; TAXII defines how it gets from one system to another. TAXII 2.1 is built around STIX content, but STIX can travel without TAXII, for example as a JSON file attached to an email or downloaded from a portal. Other ways to move indicators include plain CSV downloads, vendor-specific APIs and the synchronization built into MISP. Syslog, by contrast, carries log events from devices to a collector and has nothing to do with intelligence exchange. CISA's Automated Indicator Sharing program is a well-known TAXII user: participants connect to its server to receive and submit machine-readable indicators.
TAXII on the CompTIA Security+ exam
TAXII goes with threat intelligence sources and sharing under SY0-801 objective 2.1, which covers how information about threats reaches the people and tools that use it. It is not on the SY0-801 acronym list. A question about exchanging, transmitting or automatically sharing threat data between organizations or systems, especially over HTTPS, points to TAXII. A question about the format or language of the data points to STIX instead. Distractors include TLP, which labels sharing limits but moves nothing, SCAP, syslog and SFTP.