## STIX/TAXII & Sharing

We need a standard language to share Intel between machines.

### STIX (Structured Threat Information Expression)
A JSON format for describing threats.
*   **Objects**:
    *   `Threat Actor`: The bad guy.
    *   `Attack Pattern`: The TTP (CAPEC/ATT&CK).
    *   `Indicator`: The Regex/Rule to find it.
    *   `Observed Data`: The IP/Hash.
*   *Example*: "Actor A (STIX) uses Malware B (STIX) which connects to IP C (STIX)."

### TAXII (Trusted Automated Exchange of Intelligence Information)
The transport protocol (HTTPS API) to move STIX objects.
*   **Server**: Host the feed (e.g., Anomali Limo).
*   **Client**: Your SIEM polls the server.
*   "Hey Server, give me all new High-Confidence Ransomware IPs since yesterday."
*   Server responds with STIX JSON.

### MISP (Malware Information Sharing Platform)
The most popular Open Source Threat Intel Platform (TIP).
*   Org A puts malware data into MISP.
*   Org B's MISP syncs with Org A.
*   Your SIEM connects to MISP and downloads the blocklist automatically.