A security operations team is standardizing its threat intelligence collection and distribution architecture. Match each threat intelligence technology or source type on the left with its correct technical definition or exchange role on the right.
- TAXII (Trusted Automated eXchange of Intelligence Information)An application-layer protocol designed to securely exchange structured threat intelligence over HTTPS APIs.
- STIX (Structured Threat Information Expression)A standardized language and serialization format used to represent cyber threat indicators, observables, and TTPs.
- ISAC (Information Sharing and Analysis Center)A sector-specific organization that facilitates mutual threat data sharing among industry peers.
- Commercial / Proprietary Threat FeedA paid subscription service providing curated, vetted threat data tailored to specialized organizational risks.
Answer
TAXII matches the HTTPS application-layer transport protocol. STIX matches the standardized language format for threat indicators. ISAC matches the sector-specific sharing organization. Commercial/Proprietary Feed matches the paid subscription service for curated threat data.
Each threat intelligence source or protocol performs a distinct operational role: TAXII is the transport protocol over HTTPS; STIX is the structured JSON/XML data representation language; ISAC is the sector-specific collaborative trust network; and Commercial/Proprietary feeds are subscription-based, vendor-curated intelligence services.
Step-by-Step Solution
Key Concept
Threat Intelligence Standards, Protocols, and Source Classifications