STIX, TAXII and TLP
STIX is the data model, TAXII is the transport, TLP is the handling rule. Mixing these up is a common and very visible interview error.
Three separate things that get run together. Keep them distinct: STIX is how intelligence is represented, TAXII is how it moves, and TLP is what the recipient is allowed to do with it.
STIX 2.1
An OASIS standard for representing threat intelligence as a graph of JSON objects. The three object categories:
- STIX Domain Objects (SDOs) — the concepts. Among them:
indicator,malware,threat-actor,intrusion-set,campaign,attack-pattern,tool,infrastructure,vulnerability,identity,location,course-of-action,observed-data,report,note,opinion,groupingandmalware-analysis. - STIX Relationship Objects (SROs) —
relationshipconnects two SDOs with a verb such as indicates, uses, attributed-to or targets;sightingrecords that something was actually seen, and by whom. - STIX Cyber-observable Objects (SCOs) — the raw facts: a file, an IPv4 address, a domain name, a network traffic record. These are observations with no assertion of maliciousness attached.
The distinction that gets tested
An SCO is a fact: this IP address exists. An indicator is an assertion: seeing this pattern suggests malicious activity, and here is the confidence and validity window. An observed-data object says this was seen, at this time, this many times. Conflating "an IP appeared in a log" with "an IP is an indicator of compromise" is exactly the indicator-thinking problem the Pyramid of Pain describes.
Indicators carry a STIX patterning expression, which is its own small language:
[ipv4-addr:value = '198.51.100.10']
[file:hashes.'SHA-256' = 'aec070...'] START t'2026-01-01T00:00:00Z'Every STIX object also carries a deterministic identifier (type--uuid), created and modified timestamps, and optional confidence — which is where your confidence judgement should actually live rather than in a free-text note.
TAXII 2.1
An application-layer protocol over HTTPS for exchanging STIX. It is deliberately boring, and that is the point.
- API roots — logical groupings of collections under one server.
- Collections — request/response sets of objects that clients poll and filter.
- Channels — a publish/subscribe model, defined in the specification but far less widely implemented than collections.
- Standard endpoints for discovery, collection listing and object retrieval, with filtering by type, id and added-after timestamp.
TAXII does not care what is inside the objects, and it makes no judgements about quality. It moves data and enforces access control on collections. Nothing more.
TLP 2.0
The Traffic Light Protocol, maintained by FIRST. Version 2.0 replaced TLP:WHITE with TLP:CLEAR and added TLP:AMBER+STRICT. Using the retired label is a small but noticeable signal that someone's knowledge is out of date.
| Marking | Who you may share with |
|---|---|
| TLP:CLEAR | Anyone. Publicly releasable. |
| TLP:GREEN | The community — peers and partner organisations — but not publicly. |
| TLP:AMBER | Your organisation and its clients, on a need-to-know basis. |
| TLP:AMBER+STRICT | Your organisation only. Not clients. |
| TLP:RED | Only the individuals present in the specific exchange. No onward sharing at all. |
If you need to act on TLP:RED material in a way that would reveal it — deploying a detection that an adversary could observe, or briefing someone outside the exchange — the correct move is to go back to the originator and ask. Not to reason your way into an exception. Interviewers ask this scenario specifically to see whether you invent permission.
Platforms
MISP and OpenCTI are the two open-source implementations most teams meet first. MISP is event-centric with a strong sharing-community model; OpenCTI is graph-centric and closer to the STIX object model. Both speak STIX and TAXII to some degree. Being able to say what a threat intelligence platform is for — deduplication, relationship management, provenance and dissemination, rather than storage — is more useful in an interview than naming products.
Run a mock interview on this material. You get the question, a graded response against a vetted rubric, and the probing follow-up an interviewer would ask next.
Related reading
- MITRE ATT&CK for CTI analysts ATT&CK is a knowledge base of adversary behaviour organised by tactic and technique. Most candidates can recite that. Fewer can map an ambiguous artefact correctly, or explain what a heat map does not tell you.
- The Diamond Model of intrusion analysis The Diamond Model exists to make pivoting explicit. Its four vertices are not a taxonomy to recite — they are the four places you can be standing when you ask "what else touches this?"
- The Cyber Kill Chain A 2011 model that is still the clearest way to talk about intrusion sequence and defensive coverage — provided you can also say where its linear assumption fails.
- The intelligence cycle and F3EAD Every intelligence failure in a CTI team traces back to the first step. If nobody can state the requirement, everything downstream is expensive noise.