STIX, TAXII, MISP: A Field Guide to Threat Intel Sharing Formats

Three names, three different jobs

STIX, TAXII, and MISP get name-dropped together so often that they blur into one vague "threat intel sharing" concept. They are not interchangeable. One is a data format, one is a transport protocol, and one is a piece of software you install. The fastest way to keep them apart:

• STIX is the language: a JSON format describing threats
• TAXII is the mail service: an HTTPS API for moving STIX around
• MISP is the post office: a full platform that stores, correlates, and shares intel (in its own format, with STIX import/export bolted on)

You can use any of them without the others. Here is what each one actually does, and where the glossy interoperability story meets reality.

STIX: the language

STIX 2.1 (Structured Threat Information Expression, an OASIS standard) represents threat intelligence as JSON objects connected into a graph. Forget the old STIX 1.x, which was XML and painful enough that adoption stalled; everything modern means 2.1.

The objects come in three flavors:

• SDOs (Domain Objects): the analytic concepts. indicator, malware, threat-actor, intrusion-set, campaign, attack-pattern, vulnerability, report.
• SCOs (Cyber-observable Objects): the raw technical facts. ipv4-addr, domain-name, file, url, email-message.
• SROs (Relationship Objects): the edges. indicator indicates malware; intrusion-set uses attack-pattern.

A minimal indicator looks like this:

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
  "created": "2026-06-30T09:12:00.000Z",
  "modified": "2026-06-30T09:12:00.000Z",
  "name": "Loader C2 domain",
  "pattern": "[domain-name:value = 'update-svc-check.com']",
  "pattern_type": "stix",
  "valid_from": "2026-06-30T00:00:00Z",
  "labels": ["malicious-activity"]
}

The graph model is the real value: the same bundle can say this indicator detects this malware, used by this intrusion set, exploiting this vulnerability. Context travels with the data instead of living in a PDF. The cost is verbosity (one domain name became twelve lines) and a pattern language that most consumers never fully parse. In practice, many "STIX feeds" are flat lists of indicator objects: CSV semantics in JSON clothing.

TAXII: the transport

TAXII 2.1 (Trusted Automated Exchange of Intelligence Information) answers a narrower question: how does a client fetch STIX from a server? It is a REST API over HTTPS. A server exposes API roots, each containing collections; clients poll a collection with time filters and get STIX bundles back:

# Discover what the server offers
curl -H "Accept: application/taxii+json;version=2.1" \
     -u apiuser \
     https://taxii.example.org/taxii2/

# Pull recent objects from a collection
curl -H "Accept: application/taxii+json;version=2.1" \
     -u apiuser \
     "https://taxii.example.org/api1/collections/<id>/objects/?added_after=2026-07-01T00:00:00Z"

That is nearly the whole protocol: discovery, collections, pagination, time filtering. Which is fine. The awkward truth is that plenty of real-world intel distribution skips TAXII entirely and serves the same content over plain HTTPS endpoints or vendor REST APIs, because every SOC already knows how to poll an API. TAXII matters most when a source you need (CISA's AIS, an ISAC, a government CERT) only speaks TAXII, or when a compliance requirement names it.

MISP: the platform

MISP is different in kind: open-source software you deploy. It stores intel, correlates it, and syncs it between instances, and it existed before STIX 2 with its own data model:

• Events: containers for related intel (a campaign, an incident, a report)
• Attributes: the individual data points inside an event (an IP, a hash, a URL) with an IDS flag controlling whether they should feed detection
• Objects: structured attribute groups (a file object bundles filename, size, and hashes)
• Galaxies and taxonomies: shared vocabularies for actors, tools, ATT&CK techniques, and classification tags like TLP

Where STIX defines what intel looks like and TAXII defines how it moves, MISP does the jobs in between that a standard cannot: deduplication, correlation across events, sighting counts, per-organization sharing groups, feed ingestion, and export to whatever your SIEM eats (CSV, Suricata, Snort, STIX, plain text). Sharing communities (national CERTs, sector groups, the large public MISP communities) run on instance-to-instance synchronization, which remains the most active intel sharing happening in the real world.

The comparison table

Interoperability: the fine print

On paper everything connects: MISP exports STIX, TAXII carries it, your tools import it. In practice, budget for friction:

• Model mismatch. MISP events and STIX bundles do not map one-to-one. Round-tripping MISP to STIX and back loses tags, object relationships, or sighting data depending on versions. Test with your actual data before promising anyone "full STIX support".
• Dialect drift. Two vendors' STIX exports of the same intel can differ enough that a third tool parses one and chokes on the other. Custom properties are everywhere.
• Pattern gap. Many consumers ingest STIX indicator objects but only ever evaluate simple equality patterns, silently dropping anything complex.

None of this makes the standards worthless. It makes them plumbing: necessary at organizational boundaries, invisible when they work, and never the point of the exercise.

When a CSV is completely fine

Here is the field guide's most useful entry. If you are one team pushing your own indicators into your own SIEM, a versioned CSV with five columns (indicator, type, confidence, source, expiry) beats a STIX pipeline you have to babysit. The standards earn their complexity at boundaries: between organizations, between products, inside sharing communities. Inside your own walls, use whatever your tools parse natively and spend the saved hours on analysis.

A sane maturity path: start with enriched flat files, adopt MISP when you join a sharing community or need correlation across your own events, and speak STIX/TAXII when a partner, feed, or regulator requires it. Enrichment platforms sit comfortably alongside all of this; on mlab.sh you can paste indicators from any of these formats (or extract them from a raw report with the free IOC extractor) and get normalized, contextualized answers regardless of which sharing religion the source practices.

Format follows need. Nobody ever got breached for sharing intel in the wrong serialization, but plenty of teams have burned quarters wiring up standards nobody consumed.

STIX is grammar, TAXII is postage, MISP is the post office. Learn all three, then use the cheapest one that gets the intel to someone who acts on it.