Introduction To STIX/TAXII 2 Standards

on YouTube ↗01h 01m

" summary

Overview of STIX/TAXII 2 specifics: STIX 2 moves from XML to JSON graph model with a pattern grammar for machine-readable TTPs, TAXII 2 uses REST API roots, collections, filtering and paging. Live demos convert a LimeRAT PDF into STIX objects via the STIX visualizer, and a Jupyter Notebook connects to ubertaxii demo retrieving ~60 MITRE ATT&CK items; demos mostly run despite flaky internet. STIX Preferred certification portal is live but shows zero certified products so far.

AI-written summary · about

" chapters (28)

1. 0:00Intro
2. 0:40CTI, STIX, TAXI & STIX Preferred
3. 3:45Historical Timeline
4. 7:56STIX Data Model Key Concepts
5. 8:42Adversary Domain object: Campaign
6. 9:59Adversary Domain object: Intrusion Set
7. 11:14Adversary Domain Object: Threat Actor
8. 12:07Attack Based Properties - 2 Tips
9. 15:28TTP Domain object: Attack Pattern
10. 17:03TTP Domain object: Malware
11. 18:01TTP Based Properties - 2 Tips
12. 20:33Incident Response Properties - 2 Tips
13. 21:11Detection Domain object: Indicator
14. 21:59Detection Domain object: Observed Data
15. 23:31STIX 2.1 Enhancements
16. 24:33STIX 2.1 Confidence
17. 26:18Lime RAT Report Example...
18. 32:06Analysis & Mapping Lime Remote Access Tool 5
19. 37:34Threat Modelling Example #2...
20. 44:22TAXI 2 Key Definitions
21. 46:57TAXII 2 Key Definitions Continued
22. 49:00API Root Discovery
23. 49:44Collection Discovery
24. 50:25Collection Object Retrieval
25. 55:27STIX v1 Interoperability Challenges
26. 56:01STIX TAXII 2 Preferred Introduction
27. 56:30STIX TAXII 2 Preferred - Persona
28. 57:55Learn More On Specifications & Tools...

" related talks

• 31mBridging Together Independent Islands - STIX Custom Objects and Matching Mechanisms to Correlate...Ryusuke Masuoka, Toshitaka Satomi · 34th Annual FIRST Conference 2022
• 27mIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence SharingBrian DeWyngaert · FIRST Conference 2026 (FIRSTCON26)
• 30mHow to Create Effective Structured Intelligence Extensions for TIPsPeter Ferguson · FIRST Cyber Threat Intelligence Symposium 2022
• 30mCTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard EcosystemAlexandre Dulaunoy, Christian Studer · FIRST Cyber Threat Intelligence Conference 2026
• 22mSolving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTWPhilippe Lin · 2024 FIRST Cyber Threat Intelligence Conference
• 28mThreatIntelGPT: STIX from ChaosDavid Greenwood · 2023 FIRST Cyber Threat Intelligence Conference
• 48mThe Big Picture of APT Attacks Targeting Japan — APT Incident STIX DatabaseKubo Keiji, Soeda Yoji · CODE BLUE 2017
• 37mWho Do You Think You Are?Stuart Murdoch · 34th Annual FIRST Conference 2022