APT Intelligence -- STIX / TAXII

STIX / TAXII Concept Explorer

Collection: A group of STIX objects (like an intel feed for "Sidewinder campaign IOCs")
Root: The top-level endpoint of a TAXII server
API Root: A sub-endpoint containing collections
Polling: Requesting new objects since a given timestamp

An interactive guide to STIX 2.1 (Structured Threat Information eXpression) objects and the TAXII protocol. Learn to read a STIX bundle, understand object relationships, and interpret commercial and open-source CTI feeds without prior structured threat intelligence experience.

STIX 2.1 has two main categories of objects: SDOs (STIX Domain Objects -- the "things") and SROs (STIX Relationship Objects -- how things relate to each other). Click any object to see an example.