Home » STIX

STIX

Intelligence on cyber threats, or Cyber ​​Threat Intelligence, is the best insurance against computer attacks because it allows to neutralize them before impact. But faced with the quantity, versatility and creativity of attackers, producing high-quality operational intelligence requires intensive collaboration between multiple teams of experts around the world.

This vast virtual surveillance and warning network can only exist because it can exchange information, data and intelligence. STIX is the language spoken by these analysts to model and exchange their data transparently and enable their use in security systems.

The power of CTI during malware incident analysis replay with Glimps

What is STIX?

Acronym for Structured Threat Information eXpression, it is an open standard describing the objects of interest in the field of defensive computer warfare, and the links that they can maintain between them. It is published and maintained by a working group of the OASIS association.

OASIS (Organization for the Advancement of Structured Information Standards) is a non-profit professional association, whose mission is to develop, support and promote standardization projects. It is one of the few standardization structures recognized by the ISO (International Standards Organization) to develop standards of the Publicly Available Specification.

The current version of the standard is 2.1, published in 2021. In mid-2022, only four French people are active contributors and members of the technical committee, including David Bizeul, Chief Science Officer of SEKOIA.IO, and Georges Bossert, Chief Technical Officer of SEKOIA.IO.

Watch the replay of the Webinar on Sigma Correlation

STIX objects: SDO (Stix Domain Objects)

The standard describes 18 types of objects of cyber interest, including their properties and the relationships they can have. Among these SDOs, we can retain in particular: malicious actors, campaigns, malware, Tools, Tactics and Procedures (TTPs) or vulnerabilities.

Exemples de types d’objets SDO

This taxonomy removes ambiguities: thus a French analyst can publish data that will be used by a German analyst, sometimes from a competing company. This also allows intelligence data to be filtered according to areas of interest: a firewalls agent EDR has little interest in having to go through all the campaign data.

In particular, STIX very clearly distinguishes between intelligence objects (SDOs) and the technical data on which they may be based, called SCOs (STIX Cyber ​​Observable objects) or observables.

example of types of “observable” objects (SCO)

Relations: essential contextualization

However, objects (SDO or SCO) alone do not allow contextualization, which is vital to avoid false positives or the overconsumption of resources, human or machine. To do this, they must be linked together, this is the role of STIX Relationship Objects (SRO). A quality CTI modeled in accordance with STIX should always include these relationships, which alone allow the operational analyst to carry out investigations and put into perspective information from the field.

Example of possible relationships with a Malware type object

How STIX helps organizations to better respond to cyber threats?

By providing a unified threat description language, STIX makes it easy and quick to leverage proprietary intelligence such as open source (OSINT). It allows organizations to require this compatibility to ensure the effective flow of intelligence within their security system.

Widely adopted by industry, STIX has become increasingly the standard, allowing policy makers to specify cyber intelligence compatibility and interoperability requirements.

Open standard, all its specification and documentation are freely available on the dedicated Github page. It is a guarantee of transparency allowing all decision-makers to resist the potential influence of a software publisher, as may be the case with proprietary standards.

Finally, STIX allows collaboration between the various contributors to the ecosystem, from commercial teams such as the Threat & Detection Research team which produces the SEKOIA.IO CTI, to public or sectoral structures such as CERT or ISAC. Thus, any Threat Intelligence Platform worthy of the name must natively handle STIX 2.1 in input as well as in output; this is of course the case of SEKOIA.IO TIP.

We are a cybersecurity software publisher. We provide SOC and MSSP teams with a turnkey operational security platform (SOC platform). Through our XDR platformCTI tool and threat intelligence platform, we enable our users to neutralize cyber threats, regardless of the attack surface.

The power of CTI during malware incident analysis replay with Glimps

Others Terms

CTI(Cyber Threat Intelligence)

Cyber ​​Threat Intelligence (CTI) defines cyber threat research, analysis and modeling. It'is used to prevent and detect computer attacks.

IoC(Indicator of compromise)

IoC (Indicator of compromise) is qualified technical data that makes it possible to detect malicious activities on an information system. These indicators can be based on data of various types, for example: a file hash, a signature, an IP address, a URL, a domain name… but in all cases, the technical data alone (observable, see this word) is not enough to talk about IoC.

Échangez avec l’équipe

Vous souhaitez en savoir plus sur nos solutions de protection ?
Vous voulez découvrir nos produits de XDR et de CTI ?
Vous avez un projet de cybersécurité dans votre organisation ?
Prenez rendez-vous et rencontrons-nous !

Chat with our team !

Would you like to know more about our solutions ?
Do you want to discover our XDR and CTI products ?
Do you have a cyber security project in your organization ?
Make an appointment and meet us !