1stDevelop

Blog — Cyber

STIX, TAXII and OpenCTI: How Security Teams Share Threat Intelligence

A plain explanation of the language, the delivery system and the platform behind modern threat intelligence sharing.

  • threat-intelligence
  • stix
  • taxii
  • opencti
  • opensource

Published 2 Sep 2026 · R Dias

STIX, TAXII and OpenCTI: How Security Teams Share Threat Intelligence

Imagine two hospitals in different countries both seeing the same rare infection. If they can describe the symptoms the same way and have a reliable channel to exchange notes, they both react faster.

Cybersecurity has the same problem. One company gets attacked, learns something useful, and needs to tell everyone else quickly and precisely. That is what STIX, TAXII and OpenCTI are for.

STIX is the language

STIX (Structured Threat Information eXpression) is a standard format for describing threats. Instead of an email saying "we saw a bad IP, watch out", STIX gives you a structured object that any tool can read.

STIX describes things like:

  • Indicators - an IP address, a file hash, a domain
  • Threat actors - the group behind the attack
  • Malware and tools they use
  • Attack patterns - mapped to MITRE ATT&CK techniques
  • Relationships - "this malware is used by this actor", "this indicator points to this malware"

That last point is what makes STIX powerful. It is not a flat list of bad IPs, it is a graph of how things connect.

A trimmed STIX indicator looks like this:

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a1b2c3d4-0000-4000-8000-abcdef123456",
  "created": "2026-02-11T10:00:00.000Z",
  "name": "Malicious C2 domain",
  "pattern": "[domain-name:value = 'evil-c2.example']",
  "pattern_type": "stix",
  "valid_from": "2026-02-11T10:00:00Z"
}

Ugly to read by hand, perfect for a machine.

TAXII is the delivery system

STIX tells you how to write the intelligence. TAXII (Trusted Automated eXchange of Intelligence Information) tells you how to move it.

TAXII is a simple HTTPS API. A server publishes "collections" of STIX objects, and clients poll those collections or push new objects into them. Authentication controls who can read what, so you can run a public feed and a members-only feed from the same server.

The mental model: STIX is the document, TAXII is the postal service.

Practical benefit: your security tools subscribe once and keep receiving updates automatically, with no one copy-pasting IPs into a spreadsheet.

OpenCTI (community edition CE) is the platform

OpenCTI is an open source threat intelligence platform. It is where you actually store, connect and use everything.

What it does:

  • Ingests data from many sources through connectors (MISP, AlienVault OTX, VirusTotal, CVE feeds, MITRE ATT&CK, your own reports)
  • Normalises everything into STIX 2.1 internally
  • Builds a knowledge graph you can browse and search
  • Exposes its own TAXII server so your firewall, SIEM or EDR can pull indicators
  • Offers a GraphQL API for automation

In practice an analyst opens OpenCTI, searches a suspicious domain, and immediately sees which malware family it belongs to, which actor uses it, which campaigns it appeared in, and which of your past incidents referenced it.

How they fit together

External feeds  ──TAXII──▶  OpenCTI  ──TAXII/API──▶  SIEM, firewall, EDR
(STIX objects)              (storage,               (detection and
                             correlation,            blocking)
                             enrichment)

Data is written in STIX, transported by TAXII, understood and enriched by OpenCTI, then pushed to the tools that actually block things.

Trying it out

OpenCTI runs in Docker and the official repository ships a Compose file:

 sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 sudo systemctl status docker
 sudo systemctl start docker



git clone https://github.com/OpenCTI-Platform/docker.git opencti-docker
cd opencti-docker
cp .env.sample .env
uuidgen
# edit .env: set the admin email, admin password and the tokens
sudo docker compose up -d

It needs a few gigabytes of RAM because it runs Elasticsearch, Redis, MinIO and RabbitMQ alongside the platform. Start with a couple of free connectors such as MITRE ATT&CK and AlienVault OTX before adding more, otherwise the queue fills faster than you can review it.

Is it worth it for a smaller organisation?

If you have no one to read the intelligence, a platform will not help you. Start with a couple of curated feeds plugged directly into your firewall or SIEM.

Once someone in your team is regularly asking "have we seen this before?", OpenCTI starts paying for itself, because the answer stops being a guess.

Takeaway

  • STIX = the shared vocabulary for describing threats
  • TAXII = the standard way to distribute it
  • OpenCTI = the open source place to store it, connect it and act on it

Standards are boring, and that is exactly the point. Boring standards let tools from different vendors talk without a translation layer.

← Blog