{"id":18088,"date":"2021-12-07T12:05:36","date_gmt":"2021-12-07T06:35:36","guid":{"rendered":"https:\/\/www.varutra.com\/?p=18088"},"modified":"2022-12-02T11:23:30","modified_gmt":"2022-12-02T05:53:30","slug":"security-threat-intelligence-standards-stix-and-taxii","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/security-threat-intelligence-standards-stix-and-taxii\/","title":{"rendered":"Security Threat Intelligence Standards \u2013 STIX and TAXII"},"content":{"rendered":"

<\/p>\n

Introduction:<\/strong><\/h3>\n

Security Threat Intelligence Standards (STIX and TAXII) make day-to-day SOC<\/a> operations go uninterrupted with a shared strategy that provides a collaborative response to cybersecurity threats.<\/p>\n

MITRE is one such organization that collaborates with industry and government institutions to develop a common approach towards cybersecurity by providing registries of baseline security data, establishing standardized languages for accurately communicating cybersecurity information, and defining proper utilization. One of MITRE’s first efforts to label security vulnerability was the\u00a0Common Vulnerabilities and Exposures (CVE\u00ae)<\/a>. It is the standard for naming vulnerabilities that allows security devices, programs, and entities to be linked. CVE compatibility has been reached in over 100 products and services from over 75 vendors.<\/p>\n

As we speak, MITRE is currently working on two new projects for exchanging cyber threat information: the\u00a0Trusted Automated eXchange of Indicator Information (TAXIITM) and the Structured Threat Information eXpression (STIXTM)<\/a>, that are being funded by the United States Department of Homeland Security.<\/p>\n

 <\/p>\n

Security Threat <\/strong>Intelligence<\/strong> Standards:<\/strong><\/h3>\n

TAXII is a chain of protocols that are used for safe and secure sharing of cyber-threat data for real-time observation, protection, and reducing cyber-attacks. While, STIX is a standard format for cyber-threat data, including cyber observables, indicators of compromise, incidents, and TTP (techniques, tactics, and procedures). In the areas of vulnerability management, software testing, application compliance, asset management, enterprise reporting, ransomware protection, configuration management, incident management, remediation, and threat knowledge sharing, TAXII and STIX together help communities in sharing the coordinated threat intelligence<\/a> and facilitate collective defense.<\/p>\n

 <\/p>\n

STIX<\/h4>\n

MITRE and the OASIS Cyber Threat Intelligence (CTI) Technical Committee developed Structured Threat Information Expression (STIXTM), an international standard language and serialization format that has been adopted by many bits of intelligence exchange groups and organizations for exchanging cyber threat intelligence (CTI) in an order to describe the threat.<\/p>\n

STIX 2.1 standard introduces STIX Domain Objects (SDO), which is an object-based method for organizing threat information that makes it easy to use the details required to make network security assessments. These objects are described as STIX Relationship Objects (SROs), which show how they relate to other objects, giving a clear picture of the danger. There are currently 18 STIX objects available to identify threat data, which can be grouped or linked to each other to indicate certain types of relationships to aid in the classification of threats.<\/p>\n