A threat intelligence architect at a critical infrastructure provider is designing an automated threat intelligence sharing framework. The organization needs to ingest structured, machine-readable threat data—including adversary tactics, malware relationships, and indicators of compromise—from an Industry Information Sharing and Analysis Center (ISAC) and feed it directly into security orchestration tools via an automated, HTTPS-based service. Which of the following technical solutions correctly pairs the data representation format with the transport mechanism to meet these requirements?
- STIX to define the structured threat context and indicators, paired with TAXII as the application-layer transport protocol over HTTPS.Answer
- BTAXII to define the threat indicator schema and relational data model, paired with STIX to manage TLS-encrypted transport sessions between servers.
- COpenIOC to model adversary campaign motivations and TTPs, paired with STIX to serve as the real-time RESTful feed transport mechanism.
- DCVE to represent high-level threat actor attributes, paired with TAXII to stream raw network syslog telemetry to the ISAC.
Answer
STIX should be used to represent the structured threat data and context, while TAXII serves as the application-layer transport protocol over HTTPS.
STIX (Structured Threat Information Expression) is a standardized serialization format used to document and correlate threat indicators, threat actors, and tactics in a machine-readable syntax. TAXII (Trusted Automated Exchange of Indicator Information) is the dedicated application-layer protocol designed to transport STIX payloads over HTTPS web services, making their paired implementation the ideal solution for automated ISAC intelligence ingestion.
Step-by-Step Solution
Key Concept
STIX and TAXII Integration for Automated Threat Intelligence
Estimated Time:1m 30s