What's the difference between STIX and TAXII?

Clarifying some terminology here

I've heard this question come up a few times so I thought it would be a good topic: what's the difference between "STIX" and "TAXII"?

It's actually pretty straight-forward:

  • STIX stands for "Structured Threat Information Expressions" and is a structured data format for describing threat information. The idea here is to provide a way for information security sharing communities to have a common "language" to detail threats.
  • TAXII stands for "Trusted Automated Exchange of Intelligence Information (TAXII)" and is a protocol for exchanging STIX-formatted threat intelligence.