TAXII is a transport protocol for sharing cyber threat intelligence between systems. It defines how STIX-formatted intelligence objects are queried, pushed, and synchronised over HTTPS, so indicators, sightings, and related context can move between tools in a standardised way.
What TAXII Is and What It Standardises
TAXII is the transport layer for cyber threat intelligence exchange, not the intelligence content itself. Its value is that different tools can query, push, and synchronise STIX data in a consistent way over HTTPS.
That standardisation matters because threat intelligence is most useful when it moves cleanly between collectors, platforms, and downstream detections without manual reformatting. TAXII gives organisations a predictable interface for moving indicators, sightings, and related context between systems.
How TAXII Works with STIX and Intelligence Pipelines
TAXII is designed to carry STIX-formatted objects, so the protocol and the data model are tightly linked. A TAXII server exposes collections or channels, while clients use the API to retrieve or publish intelligence in controlled exchanges.
For operational teams, this means TAXII often sits inside a broader CTI pipeline: ingestion, normalisation, enrichment, distribution, and activation. NHIMG’s STIX and TAXII Guide explains the protocol alongside STIX 2.1 objects, TAXII 2.1 API concepts, and the credentials needed to secure access.
The protocol is especially useful where multiple tools need the same intelligence at different speeds or trust levels. One platform may publish, another may curate, and a third may consume only selected collections for blocking, hunting, or correlation.
Why TAXII Matters for Threat Intelligence Sharing
TAXII reduces friction in collaborative defence by making intelligence exchange machine-readable and repeatable. That lowers the chance of analysts relying on ad hoc exports, email attachments, or manually copied indicators that are hard to govern and easy to miss.
The protocol also supports interoperability across teams and organisations. When paired with consistent STIX usage, it helps preserve context such as indicator relationships, sightings, confidence, and markings, which are often lost in simpler formats.
NHIMG’s Threat Intelligence Guide places TAXII inside the wider CTI lifecycle, including intelligence requirements, sharing practice, and the move from analysis to action.
Common Implementation and Governance Considerations
TAXII is only as useful as the governance around what gets shared, who can access it, and how long the data remains valid. Organisations need clear collection ownership, source trust decisions, and rules for marking, scoping, and revoking intelligence feeds.
Credential protection also matters because a TAXII endpoint can become a distribution point for sensitive intelligence if authentication is weak or shared too broadly. Access should be treated as a controlled integration, not an open publishing channel.
NHIMG’s Indicators of Compromise vs Indicators of Attack Guide is useful here because it connects TAXII sharing to indicator lifecycles, expiry, and the difference between static indicators and behavioural signals.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | TAXII endpoints often broker machine-to-machine intelligence exchange over authenticated channels. |
| IA-5 — Authenticator Management | TAXII access depends on protecting API keys, client certs, and other authenticators used by the exchange. | |
| Recommendation — Apply IA-9 to authenticate systems that publish or consume TAXII collections. Manage TAXII authenticators with rotation, revocation, and secure storage controls. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | TAXII is an API-based exchange mechanism whose security depends on strong API authentication. |
| Recommendation — Verify TAXII API authentication and reject weak or shared access paths. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | TAXII sharing requires controlled access to sensitive intelligence collections and feeds. |
| Recommendation — Define and enforce access rules for TAXII collections and publishers. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Compromise of a TAXII account can let an attacker read or poison intelligence feeds. |
| Recommendation — Monitor TAXII access for abuse of valid accounts and unusual collection activity. | ||