STIX and TAXII
OASIS standards for representing threat intelligence as JSON objects and relationships (STIX) and exchanging it over HTTPS APIs (TAXII).
STIX 2.1 models intelligence as a graph of JSON objects: domain objects such as indicator, malware, threat-actor, attack-pattern, campaign and intrusion-set, cyber observables such as ipv4-addr and file, and relationship objects (relationship, sighting). Indicators carry a pattern language, for example [ipv4-addr:value = '198.51.100.7'], plus validity times and confidence.
TAXII 2.1 is the transport: a RESTful HTTPS API exposing collections that clients poll or push to. Together they let platforms such as MISP and OpenCTI and commercial feeds exchange intel machine to machine with sharing markings such as TLP attached.
Pitfalls: inconsistent use of object types between producers, missing relationships that strip context, and feeds that are only lists of indicators dressed in STIX.
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created": "2026-11-02T09:00:00.000Z",
"modified": "2026-11-02T09:00:00.000Z",
"name": "C2 server for loader campaign",
"pattern": "[domain-name:value = 'update-check.example.net']",
"pattern_type": "stix",
"valid_from": "2026-11-02T09:00:00Z",
"valid_until": "2026-12-02T09:00:00Z",
"confidence": 70
}