Threat Sharing — MISP, STIX, TAXII

Threat intelligence sharing is the practice of exchanging information about cyber threats—such as indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and threat actor profiles—between organizations, often through trusted communities like Information Sharing and Analysis Centers (ISACs). The goal is to improve collective defense: if one organization detects a new malware variant, sharing its hash, IP addresses, and behavior patterns allows others to block it before they are attacked. SY0-701 tests your understanding of the three key components that make this sharing automated and standardized: MISP, STIX, and TAXII.

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform that enables organizations to store, share, and collaborate on threat data. It acts as a central repository where analysts can submit IOCs, tag them with context (e.g., confidence level, source, attack type), and correlate them with existing data. MISP supports automatic feed ingestion from external sources (like commercial threat feeds) and provides APIs for integration with SIEMs and other tools. Key features include:

On the SY0-701 exam, you might see a scenario where an analyst uses MISP to search for a hash and finds it linked to a known APT group. The correct answer would involve using MISP's correlation feature.

STIX (Structured Threat Information Expression) is an XML/JSON-based language for describing threat intelligence in a standardized, machine-readable format. Developed by OASIS (Organization for the Advancement of Structured Information Standards), STIX defines a set of domain objects and relationships. The core STIX 2.x objects include:

STIX uses a consistent structure: each object has an ID, type, and properties. For example, an indicator for a malicious IP might look like:

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--123e4567-e89b-12d3-a456-426614174000",
  "created": "2024-01-15T12:00:00Z",
  "name": "Malicious IP",
  "pattern": "[ipv4-addr:value = '203.0.113.5']",
  "valid_from": "2024-01-15T12:00:00Z"
}

The pattern language (STIX Patterning) uses brackets and object types: [file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e'].

TAXII (Trusted Automated eXchange of Indicator Information) is a set of protocols for exchanging STIX data over HTTPS. It defines two main services:

TAXII uses a RESTful API with endpoints like /collections/ and /collections/{id}/objects/. Authentication is typically via API keys or client certificates. The exam expects you to know that TAXII is the transport mechanism, not the data format—that's STIX.

In a typical sharing scenario:

While the exam doesn't test specific commands, understanding how MISP is used in practice helps. For example, using the MISP REST API with curl:

# Add an event (simplified)
curl -X POST -H "Authorization: <api_key>" -H "Content-Type: application/json" \
  -d '{"Event": {"info": "Phishing campaign", "Attribute": [{"type": "ip-dst", "value": "203.0.113.5"}]}}' \
  https://misp.local/events

To export STIX from MISP:

curl -X GET -H "Authorization: <api_key>" \
  https://misp.local/events/stix/123

For TAXII polling, a client might use a library like taxii2-client:

from taxii2client import Collection
collection = Collection("https://taxii.server/collections/123/")
bundle = collection.get_objects()

Attackers may try to poison threat intelligence feeds by submitting false IOCs (e.g., legitimate IPs as malicious). Defenders mitigate this by:

On the exam, a question might ask: "What is the primary benefit of using STIX and TAXII?" Answer: "Standardized, automated sharing of threat intelligence in a machine-readable format."

A bank detects a phishing email targeting its employees. The email contains a link to a credential harvesting page. The bank's SOC analyst creates a MISP event with the URL, the sender email domain, and the hash of the attachment. They set TLP to RED (limited to the ISAC). The event is pushed to the TAXII server of the Financial Services ISAC (FS-ISAC). Within minutes, another bank's MISP polls the collection and ingests the IOCs. Their email security gateway automatically blocks the URL. The analyst at the second bank sees a log: "Blocked URL (matched FS-ISAC threat feed)." A common mistake is that the second bank's analyst assumes the threat is irrelevant because they haven't seen it yet, but the automated block prevents a breach. The correct response is to monitor for any related alerts and optionally provide feedback.

A healthcare organization is hit by ransomware. They share the ransom note hash and C2 IP via their Health-ISAC. A government agency (CISA) also subscribes to that TAXII collection. CISA's MISP correlates the IP with a known APT group's infrastructure. They add a new relationship: "Indicator indicates Campaign 'Healthcare Ransomware 2024'." They also create a course of action: "Block IP and apply patch for VPN vulnerability." The healthcare organization sees this update and applies the patch, preventing a second wave. A common mistake is that organizations only share IOCs and not TTPs or courses of action. The exam emphasizes that sharing context (like ATT&CK IDs) improves collective defense.

A malicious actor submits a STIX indicator for a legitimate IP (e.g., a major cloud provider) as malicious to a public MISP instance. Several organizations automatically block that IP, causing service disruption. The correct response is to use confidence levels and source vetting. MISP allows marking sources as "trusted" only if they are part of a verified community. The analyst should check the source and confidence before deploying. A common mistake is to block all IOCs from any feed without validation. The exam tests that automation must be paired with verification mechanisms.