Sharing threat intelligence: STIX, TAXII, ISACs and TLP
In short: Sharing intelligence lets organisations warn each other quickly. STIX gives a common structure for threat data, TAXII moves it between systems, ISACs build trusted communities, and the Traffic Light Protocol sets clear rules on who may see what.
Why share intelligence?
Attackers reuse tools and infrastructure across many victims. If one organisation spots a phishing campaign and tells others quickly, everyone else can block it before they are hit. Sharing works only when it is trusted (people know the rules), structured (machines can read it) and timely.
STIX and TAXII
STIX (Structured Threat Information Expression) is an open standard, maintained by the OASIS standards body, for describing threat intelligence as JSON objects. Version 2.1 is the current widely used release. Common object types include:
- Indicator: a pattern to detect, such as a malicious domain or file hash.
- Malware, Tool and Attack Pattern: the capability being used.
- Threat Actor, Intrusion Set and Campaign: who is behind activity and how it is grouped.
- Relationship and Sighting: links between objects and reports of where something was seen.
TAXII (Trusted Automated Exchange of Intelligence Information) is the companion protocol for sending STIX over HTTPS. A TAXII server publishes collections that clients can read from or add to. In practice you rarely write STIX by hand; threat intelligence platforms such as the open-source MISP and OpenCTI import, store and export it for you.
Communities and the Traffic Light Protocol
Information Sharing and Analysis Centres (ISACs) are trusted groups for a sector, such as finance, health or energy, where members share incidents and indicators. Governments also run sharing schemes; in the UK, the NCSC operates information-sharing communities for organisations.
The Traffic Light Protocol (TLP), maintained by FIRST (the Forum of Incident Response and Security Teams), labels how far information may travel. Version 2.0 uses CLEAR, GREEN, AMBER, AMBER+STRICT and RED. The sender sets the label, and recipients must respect it. If you need to share more widely, ask the source first. TLP is about sharing, not classification or encryption; protect sensitive data appropriately as well.
Judging feed quality
| Question | Why it matters |
|---|---|
| Is it relevant to our sector and technology? | Irrelevant indicators waste storage and analyst time |
| How fresh is it, and do items expire? | Stale IP addresses cause false positives |
| Is context included (actor, campaign, confidence)? | Context lets analysts judge an alert quickly |
| How many false positives does it create? | Measure it: track alerts and outcomes per feed |
| Does it overlap with feeds we already have? | Duplicate feeds add cost, not value |
A common mistake is loading many free feeds straight into blocking rules. One bad entry, such as a large cloud provider's IP range, can break business services. Start in alert-only mode, measure results, then block.
Tip: MISP is a good home-lab project: run it in a virtual machine, subscribe to a few public feeds and practise exporting STIX.
Real-world example: a regional retail sharing group
Five fictional independent retailers in the same region set up an informal sharing group with a shared chat channel and a small TAXII server run by one of their IT providers. When one shop is hit by a gift-card fraud email that impersonates its managing director, its IT lead posts the sender addresses, subject lines and the lookalike domain as a STIX bundle marked TLP:AMBER+STRICT, meaning members may share it within their own organisations only. Within an hour the other four shops have added the domain to their email filters, and one finds the same email already sitting unopened in a manager's inbox. Clear sharing rules gave everyone confidence to post quickly.
Practice
What is the difference between STIX and TAXII?
You receive a report marked TLP:AMBER+STRICT. Who can you share it with?
Why should new feeds start in alert-only mode?
Key takeaways
- Sharing works when it is trusted, structured and timely.
- STIX 2.1 describes threat data as JSON objects; TAXII transports it.
- ISACs and government schemes provide trusted sharing communities.
- TLP 2.0 labels (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) set sharing limits.
- Measure feed quality and avoid blocking on untested feeds.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.