## STIX & TAXII\n\n### What is STIX?\n\n**Structured Threat Information eXpression (STIX)** is a standardized language for describing threat intelligence.\n\n### STIX 2.1 Objects\n\n| Object | Description |\n|--------|-------------|\n| **Attack Pattern** | TTPs (maps to ATT&CK) |\n| **Campaign** | Named threat activity |\n| **Indicator** | Observable pattern |\n| **Malware** | Malicious software |\n| **Threat Actor** | Individual/group |\n| **Tool** | Legitimate software used maliciously |\n| **Vulnerability** | CVE references |\n| **Infrastructure** | Attacker systems |\n\n### STIX Example\n\n```json\n{\n  "type": "indicator",\n  "id": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",\n  "created": "2024-01-15T13:00:00.000Z",\n  "name": "Malicious IP Address",\n  "pattern": "[ipv4-addr:value = '185.123.45.67']",\n  "pattern_type": "stix",\n  "valid_from": "2024-01-15T13:00:00Z",\n  "labels": ["malicious-activity", "c2"]\n}\n```\n\n### What is TAXII?\n\n**Trusted Automated eXchange of Intelligence Information (TAXII)** is the transport protocol for STIX.\n\n### TAXII Components\n\n- **Collections**: Sets of STIX objects\n- **Channels**: Pub/sub for real-time sharing\n- **API Root**: Entry point for TAXII server\n\n### Common TAXII Feeds\n\n- AlienVault OTX\n- MISP (via TAXII)\n- FS-ISAC\n- US-CERT