Examkin

Question

Difficulty: MediumThreat Intelligence Sources and Research

A cybersecurity analyst is establishing an automated intelligence pipeline to ingest threat indicators from external industry peers. The analyst needs a standardized language format to represent attack patterns, indicators of compromise, and threat actor tactics in a structured, machine-readable format, independent of how the data is transmitted across the network. Which of the following standards should the analyst implement for data representation?

  1. STIX (Structured Threat Information Expression)Answer
  2. B
    TAXII (Trusted Automated Exchange of Intelligence Information)
  3. C
    ISAC (Information Sharing and Analysis Center)
  4. D
    CVSS (Common Vulnerability Scoring System)

Answer

STIX (Structured Threat Information Expression) is the correct standard because it provides a structured, machine-readable language format for specifying cyber threat intelligence.
STIX (Structured Threat Information Expression) is an open-standardized language designed specifically for describing cyber threat information in a structured, machine-readable JSON format. It allows organizations to share threat context, including indicators of compromise, threat actors, campaigns, and attack patterns, independently of the underlying network protocol used for transport.

Step-by-Step Solution

1
Identify the core requirement of the scenario.
The requirement calls for a standardized data representation format for threat intelligence content, separate from transport protocols.
Threat intelligence frameworks separate the data serialization schema from the network delivery mechanisms.
2
Differentiate between data format standards and transport protocols.
STIX defines the data model schema (indicators, actors, TTPs), whereas TAXII defines the transport mechanism over HTTPS.
Understanding the separation of concerns between STIX and TAXII ensures proper architectural implementation.
3
Select the option corresponding to the data representation schema.
STIX (Structured Threat Information Expression) satisfies the requirement.
STIX is the industry standard format for representing structured cyber threat data.

Key Concept

STIX vs TAXII Standards in Cyber Threat Intelligence
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic