Interview question
In STIX, what is the difference between a cyber-observable object and an indicator? And what does TAXII do that STIX does not?
A standards question that doubles as a check on indicator thinking — the SCO/indicator distinction is the same distinction as data versus intelligence.
What a strong answer covers
- A STIX Cyber-observable Object (SCO) states a fact with no assertion of maliciousness — a file, an IPv4 address, a domain name.
- An indicator is an assertion: this pattern suggests malicious activity, with a pattern expression, validity window and optionally confidence.
- Mentions observed-data as the object recording that something was seen, when and how often.
- Notes that indicators carry a STIX patterning expression.
- Correctly separates STIX as the data model from TAXII as the transport protocol.
- Describes TAXII as an HTTPS application-layer protocol with API roots, collections and optionally channels.
- Notes TAXII makes no judgement about content quality — it moves objects and controls access.
- Connects the SCO/indicator distinction to the broader point that an artefact in a log is not automatically an IOC.
Expert answer
A cyber-observable object is a fact with no judgement attached. An <code>ipv4-addr</code> SCO says this address exists and was represented; it makes no claim that it is malicious. Same for a file object, a domain name, a network traffic record.
An indicator is an assertion. It says that seeing this pattern suggests malicious activity, and it carries a STIX patterning expression describing what to look for, a validity window, and optionally a confidence value. So an indicator is analysis wrapped around observables.
There is a third object worth naming: observed-data, which records that something was actually seen, when, and how many times. So the three separate cleanly — the observable is the thing, observed-data is the sighting, and the indicator is the claim that the thing matters.
That distinction is the same one that separates data from intelligence generally. An IP appearing in a proxy log is an observable. Calling it an indicator of compromise is an assertion that requires a basis, a confidence, and ideally an expiry. Collapsing the two is exactly the indicator thinking that produces feeds nobody can act on.
TAXII is a different layer entirely. STIX is the data model — how intelligence is represented. TAXII is the transport — an application-layer protocol over HTTPS for exchanging STIX objects. It defines API roots that group collections, collections that clients poll and filter by type, id or added-after timestamp, and a publish-subscribe channel model that is specified but far less widely implemented than collections.
The key point is that TAXII is deliberately dumb about content. It does not care what is inside the objects and makes no judgement about their quality. It moves data and enforces access control on collections. Nothing about receiving something over TAXII makes it good intelligence.
Mistakes that cost candidates points
- Treating an observable and an indicator as the same thing.
- Describing TAXII as a data format or STIX as a protocol.
- Missing observed-data entirely.
- Not mentioning that indicators carry a pattern expression and validity window.
- Implying TAXII validates or grades what it transports.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- You receive TLP:RED intelligence in a trust group indicating a specific vulnerability is being exploited against your sector. Your organisation is exposed. What do you do?
- How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?
- An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK.
- You have one piece of evidence: a single IP address that a compromised host was beaconing to. Walk me through how you would develop this.
- Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against.