What's the difference between STIX and TAXII?
Clarifying some terminology here
I've heard this question come up a few times so I thought it would be a good topic: what's the difference between "STIX" and "TAXII"?
It's actually pretty straight-forward:
- STIX stands for "Structured Threat Information Expressions" and is a structured data format for describing threat information. The idea here is to provide a way for information security sharing communities to have a common "language" to detail threats.
- TAXII stands for "Trusted Automated Exchange of Intelligence Information (TAXII)" and is a protocol for exchanging STIX-formatted threat intelligence.