Question

Difficulty: MediumThreat Intelligence Sources and Research

A security operations team is standardizing its threat intelligence collection and distribution architecture. Match each threat intelligence technology or source type on the left with its correct technical definition or exchange role on the right.

  • TAXII (Trusted Automated eXchange of Intelligence Information)An application-layer protocol designed to securely exchange structured threat intelligence over HTTPS APIs.
  • STIX (Structured Threat Information Expression)A standardized language and serialization format used to represent cyber threat indicators, observables, and TTPs.
  • ISAC (Information Sharing and Analysis Center)A sector-specific organization that facilitates mutual threat data sharing among industry peers.
  • Commercial / Proprietary Threat FeedA paid subscription service providing curated, vetted threat data tailored to specialized organizational risks.

Answer

TAXII matches the HTTPS application-layer transport protocol. STIX matches the standardized language format for threat indicators. ISAC matches the sector-specific sharing organization. Commercial/Proprietary Feed matches the paid subscription service for curated threat data.
Each threat intelligence source or protocol performs a distinct operational role: TAXII is the transport protocol over HTTPS; STIX is the structured JSON/XML data representation language; ISAC is the sector-specific collaborative trust network; and Commercial/Proprietary feeds are subscription-based, vendor-curated intelligence services.

Step-by-Step Solution

1
Differentiate transport protocols from data formatting languages in threat intelligence automation.
Identified TAXII as the protocol for transmitting data and STIX as the language format describing threat data.
TAXII specifies how threat intelligence is communicated, whereas STIX specifies what is contained inside the payload.
2
Differentiate peer-to-peer industry sharing entities from vendor-supplied intelligence services.
Mapped ISAC to sector-specific peer sharing and Commercial Feeds to paid vendor subscriptions.
ISACs rely on member-driven information exchange within specific critical infrastructure sectors, while commercial feeds sell specialized proprietary intelligence collected by vendors.

Key Concept

Threat Intelligence Standards, Protocols, and Source Classifications
Rate this question