What is the difference between STIX and TAXII when you ingest a partner's phishing-kit indicators?

## The one-line version **STIX** (Structured Threat Information Expression) is a *data model plus serialisation*. **TAXII** (Trusted Automated Exchange of Intelligence Information) is an *application-layer transport protocol over HTTPS*. Both are OASIS standards, both are usually seen together, and neither requires the other. STIX is the noun; TAXII is the courier. ## What STIX actually gives you A STIX 2.1 document is JSON. Its content is a graph of typed objects, each with a globally unique id and common properties (`created`, `modified`, `revoked`, `object_marking_refs`, `confidence`): - **SDOs** — the domain objects: `indicator`, `malware`, `attack-pattern`, `infrastructure`, `threat-actor`, `intrusion-set`, `campaign`, `tool`, `identity`, `vulnerability`, `observed-data`, `report`, `grouping`. - **SCOs** — the observable values themselves: `domain-name`, `url`, `ipv4-addr`, `file`, `email-addr`. - **SROs** — the edges: `relationship` (with a `relationship_type` such as `indicates` or `uses`) and `sighting`. - **`marking-definition`** — handling restrictions, typically Traffic Light Protocol, referenced from an object's `object_marking_refs`. The value is the *graph*, not the values. A CSV of two hundred domains tells you nothing about why they matter. A STIX bundle can say: this domain is an indicator that *indicates* this phishing kit, which is *used by* this intrusion set, and it was submitted by this identity under this marking. That structure is what survives the transfer into your platform, and it is what lets an analyst answer "why is this on my blocklist" six months later. ## What TAXII actually gives you A TAXII 2.1 server exposes one or more **API roots**, each holding **collections**. A consumer authenticates over HTTPS and polls a collection's objects endpoint, filtering with parameters such as `added_after` so each run pulls only what arrived since last time; results are paged. That is the whole shape of it. There is no query language, no analytics, no correlation — just discovery, authentication, collections and paged retrieval. One genuinely useful property for a sharing community: collections are the unit of access control. The same server can offer a full collection to vetted members and a reduced collection to associates, without maintaining two feeds by hand. ## Why the separation matters operationally You can consume STIX with no TAXII anywhere: a MISP feed served as JSON over HTTPS, a git repository of bundles, a vendor connector into OpenCTI, even an attachment on a mail. And you can run a TAXII server that serves objects nobody modelled properly — bare `indicator` objects with no relationships, which is a CSV with extra ceremony. When someone says "we are STIX/TAXII compliant", the useful follow-up is which objects they actually populate and whether the relationships are there. ## Reading what arrives — and what does not Two direction errors are worth fixing early. First, an `indicator` is the **producer's claim** that a pattern signals malicious activity. Ingesting it proves that a partner believes something. It proves nothing at all about your estate. Only a match in your own telemetry does that, and even a match is a match, not a compromise. Second, and this is the one that quietly costs organisations months: a collection that returns no new objects for three weeks looks exactly the same whether the producer stopped publishing, your API credential expired, the collection was retired, a proxy is eating the poll, or the sector really is quiet. Absence of output is not evidence of absence of activity. Instrument the poll itself: alert on time-since-last-object per collection and on the object count per poll, not merely on HTTP status. A feed that silently died is worse than no feed, because the empty result reads as reassurance. ## The common wrong answers - "TAXII is the format, STIX is the server." Reversed. - "You need a TAXII server to share STIX." You do not. - "TAXII lets you query the producer's data." It offers filters on a collection endpoint, not a query language. - "We ingest 40,000 indicators a day, so we have good intel." Volume without relationships, markings and expiry is a blocklist, and an ageing one.