No article in the knowledge graph for STIX yet.
Who is STIX?
STIX is a structured language and serialization format for representing cyber threat intelligence so organizations can exchange, analyze, and operationalize indicators, adversary behaviors, malware, campaigns, and related security data across tools and teams.
- Structured cyber threat intelligence modeling and exchange
- Objects for indicators, threat actors, malware, campaigns, vulnerabilities, and relationships
- JSON based representation for machine readable security data
- Use in threat sharing, detection engineering, security operations, and intelligence analysis
- Alignment with TAXII for transport and distribution of threat intelligence
Show more
More About STIX
STIX, Structured Threat Information Expression, is used in enterprise security programs as a common way to describe cyber threat intelligence in a format that both people and systems can work with. In practice, it supports intelligence sharing between security platforms, analysts, incident response teams, and external partners. Enterprises use it to normalize threat data from multiple sources, preserve context around indicators and adversary activity, and move from isolated alerts to linked intelligence records.
The framework is associated with object based data modeling and JSON serialization. It defines domain objects such as indicators, malware, intrusion sets, threat actors, observed data, vulnerabilities, and courses of action, along with explicit relationships between them. That structure makes it suitable for graph oriented analysis, enrichment pipelines, and security orchestration workflows. STIX is commonly paired with TAXII, Trusted Automated eXchange of Intelligence Information, which provides an application layer protocol for publishing and retrieving threat intelligence collections.
Compared with unstructured reports, spreadsheets, or vendor specific formats, STIX provides a standardized method for representing security intelligence in a machine readable form. That makes it useful for SIEM, SOAR, threat intelligence platform, and detection content workflows where repeatable parsing and consistent field semantics matter. It is not a security control by itself. It is a representation layer that helps other systems ingest, correlate, search, and distribute intelligence data.
In directory terms, STIX fits within internet services and infrastructure focused IT services because it underpins the exchange and operational use of cyber threat data across connected security environments. Its active solution area is threat intelligence representation and sharing, with current use centered on standardized data models, object relationships, and interoperable exchange for enterprise security operations.
Our description of STIX. Updated September 2026.
