Examkin

Question

Difficulty: HardThreat Intelligence Sources and Research

An industrial control system (ICS) security engineering team requires an automated, standardized mechanism to continuously ingest machine-readable tactical indicators of compromise (IoCs) directly into their Security Orchestration, Automation, and Response (SOAR) platform from external sector peers. Which of the following intelligence standards and transport protocol combinations best satisfies this operational requirement?

  1. Structured Threat Information eXpression (STIX) serialized data delivered via the Trusted Automated eXchange of Intelligence Information (TAXII) protocolAnswer
  2. B
    Open-Source Intelligence (OSINT) blog feeds parsed automatically through Really Simple Syndication (RSS) web scrapers
  3. C
    National Vulnerability Database (NVD) API queries extracting Common Vulnerabilities and Exposures (CVE) severity metrics
  4. D
    Strategic threat actor attribution dossiers delivered via periodic encrypted email attachments

Answer

Structured Threat Information eXpression (STIX) serialized data delivered via the Trusted Automated eXchange of Intelligence Information (TAXII) protocol
The combination of STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) is the industry standard designed specifically for automated CTI sharing. STIX defines a consistent XML/JSON schema for describing cyber threat objects, while TAXII specifies the secure transport web services (HTTPS/RESTful API) required for machine-to-machine exchange without human intervention.

Step-by-Step Solution

1
Analyze operational requirements
Identified the need for machine-readable threat data representation paired with an automated machine-to-machine transport protocol for real-time SOAR ingestion.
Automation requires standardized data schemas and dedicated API-driven transfer protocols.
2
Evaluate candidate threat intelligence frameworks
STIX specifies the structured language (JSON/XML schema for IoCs, tactics, and observational data), and TAXII provides the HTTP RESTful services to exchange STIX content securely.
STIX and TAXII were specifically designed by OASIS to work in tandem for standardized cyber threat intelligence (CTI) automated sharing.
3
Differentiate from alternative sources
Ruled out OSINT RSS feeds (unstructured CTI), NVD/CVE (vulnerability repository, not CTI IoC feed), and strategic dossiers (human-focused attribution summaries).
Only STIX/TAXII fulfills both the structured data standard and automated ingestion transport requirement.

Key Concept

STIX and TAXII Standards for Automated CTI Sharing
Estimated Time:2m 0s
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic