TAXII

TAXII (Trusted Automated eXchange of Indicator Information) is a protocol that lets organizations automatically exchange threat information (Cyber Threat Intelligence, or CTI) over a secure HTTPS connection. Put simply: TAXII is a shared language that security tools at different organizations use to pull threat data from one another and pass it along — without sending it by hand over email or as files. TAXII exposes a REST-style API (the interface programs use to talk to each other) and sets out how clients and servers should behave. It is an open standard developed by the OASIS Cyber Threat Intelligence Technical Committee (CTI TC); the current version is TAXII 2.1.

How does TAXII differ from STIX?

TAXII and STIX (Structured Threat Information Expression) are two standards that go together but do different jobs. STIX answers the question of what you are sharing — it is the data format. It describes the content itself: objects such as indicator, malware, and threat-actor, plus the relationships between them, written in JSON. TAXII answers the question of how that data gets delivered — it is the protocol that carries it. In TAXII 2.1, support for STIX 2.1 content is mandatory, but the two standards are independent: STIX can travel another way, and TAXII can carry non-STIX data too.

How does TAXII work?

The exchange happens between a TAXII client and a TAXII server over HTTPS. The core parts of the model are:

• API Root — a logical grouping of collections and channels, available at its own URL. A single server can host several API Roots as separate, independent interfaces.
• Collections — a “fetch on demand” (pull) model. A producer hosts a set of CTI data, and consumers reach for it themselves through REST requests.
• Channels — a “push to subscribers” model in which a producer sends data to many consumers at once. In TAXII 2.1 the keywords for channels are reserved, but the channels themselves are not yet defined — they are expected in a later version.
• Discovery — finding servers: via DNS SRV records and a dedicated address (in TAXII 2.1, the /taxii2/ path).

Which distribution models does TAXII support?

The protocol does not force one topology and supports the common ways of sharing threat data:

• Hub-and-spoke — a central hub collects data and redistributes it to many participants, e.g., within an industry sharing center (ISAC) or a CERT team.
• Source-subscriber — a single source publishes data that subscribers receive.
• Peer-to-peer — direct exchange between equal partners.

Why does TAXII matter for security?

For a SOC (Security Operations Center), for NDR systems, and for network monitoring, TAXII is simply the way indicators of compromise (IOCs) and threat context get delivered into defensive tools. TAXII feeds typically populate SIEM, SOAR, and threat intelligence platforms, which use them to tie events together, enrich alerts, and automatically update detection rules and block lists. Because the standard is shared, tools can pull fresh indicators (IP addresses, domains, file hashes, signatures) on their own, without manual import. That shortens the time between someone publishing an indicator and it taking effect on your network.

One caveat, though: trust in the data is only as strong as trust in its source. A TAXII feed is only as reliable as its producer. So the consumer is still responsible for authentication (in TAXII 2.1, HTTP Basic is among the recommended options), access control over individual API Roots and collections, and checking the quality of indicators — because some turn out to be wrong (false positives) or stale.

Learn more

• Software Bill of Materials (SBOM) — TAXII can distribute SBOM-related threat data and advisories to help assess software risk.
• MITTRE ATT&CK — TAXII often carries ATT&CK-aligned threat intelligence for mapping adversary techniques.
• IoC (Indicator of Compromise) — TAXII is used to transport IoCs between threat intelligence systems.
• TTPs — TAXII can share TTP intelligence, not only simple indicators like hashes or IPs.
• North-South vs East-West Traffic — TAXII feeds can support monitoring of threats across north-south and east-west traffic.
• Honeypot — Honeypots generate threat data that can be shared through TAXII feeds.