Structured Threat Information Expression (STIX) is a standardized, structured language for sharing cyber threat information. STIX has been developed by MITRE and the OASIS Cyber Threat Intelligence (CTI) Technical Committee for greater sharing, storage, and analysis of cyber threat intelligence in a consistent manner. Find more information on STIX.

Trusted Automated eXchange of Indication Information (TAXII) is the standard transport mechanism for cyber threat information in STIX format. TAXII has been specially designed to support cyber threat intelligence sharing in the STIX format using an API that aligns with the information-sharing model. Find more information on TAXII.

Intel Exchange leverages STIX TAXII server-based feeds to aggregate threat data, and automate real-time threat intelligence sharing. With STIX TAXII server-based feeds, Intel Exchange makes cyber threat intelligence sharing flexible, extensible, automatable, expressive, and easily readable. Intel Exchange (CTIX) ensures that no critical threat is overlooked and left unattended. To ensure that users are not bound by the limited capability of sharing data, Intel Exchange has now been made compliant with STIX 2.x, the latest standard, in addition to STIX 1.x.

Furthermore, Intel Exchange comes with a highly customizable dashboard that can be personalized to share feeds in multiple formats, including Malware Sharing Information Platform (MISP), OpenIOC, YARA, IODEF, and MAFC, among others.

Intel Exchange greatly enhances an organization’s interoperability to collect and disseminate threat data with leading institutions and organizations. Armed with MITRE’s ATT&CK Navigator, the platform provides post-exploitation hunting capabilities, which makes it much more than a regular IOC-sharing platform. The platform enables machine-to-machine transfer of structured cyber threat intelligence and enables mutual learning and information sharing amongst members, thereby producing a potent defensive mechanism against malicious entities.