Intelligence on cyber threats, or Cyber Threat Intelligence, is the best insurance against computer attacks because it allows to neutralize them before impact. But faced with the quantity, versatility and creativity of attackers, producing high-quality operational intelligence requires intensive collaboration between multiple teams of experts around the world.
This vast virtual surveillance and warning network can only exist because it can exchange information, data and intelligence. STIX is the language spoken by these analysts to model and exchange their data transparently and enable their use in security systems.
What is STIX?
Acronym for Structured Threat Information eXpression, it is an open standard describing the objects of interest in the field of defensive computer warfare, and the links that they can maintain between them. It is published and maintained by a working group of the OASIS association.
OASIS (Organization for the Advancement of Structured Information Standards) is a non-profit professional association, whose mission is to develop, support and promote standardization projects. It is one of the few standardization structures recognized by the ISO (International Standards Organization) to develop standards of the Publicly Available Specification.
The current version of the standard is 2.1, published in 2021. In mid-2022, only four French people are active contributors and members of the technical committee, including David Bizeul, Chief Science Officer of SEKOIA.IO, and Georges Bossert, Chief Technical Officer of SEKOIA.IO.
STIX objects: SDO (Stix Domain Objects)
The standard describes 18 types of objects of cyber interest, including their properties and the relationships they can have. Among these SDOs, we can retain in particular: malicious actors, campaigns, malware, Tools, Tactics and Procedures (TTPs) or vulnerabilities.
This taxonomy removes ambiguities: thus a French analyst can publish data that will be used by a German analyst, sometimes from a competing company. This also allows intelligence data to be filtered according to areas of interest: a firewalls agent EDR has little interest in having to go through all the campaign data.
In particular, STIX very clearly distinguishes between intelligence objects (SDOs) and the technical data on which they may be based, called SCOs (STIX Cyber Observable objects) or observables.
Relations: essential contextualization
However, objects (SDO or SCO) alone do not allow contextualization, which is vital to avoid false positives or the overconsumption of resources, human or machine. To do this, they must be linked together, this is the role of STIX Relationship Objects (SRO). A quality CTI modeled in accordance with STIX should always include these relationships, which alone allow the operational analyst to carry out investigations and put into perspective information from the field.
How STIX helps organizations to better respond to cyber threats?
By providing a unified threat description language, STIX makes it easy and quick to leverage proprietary intelligence such as open source (OSINT). It allows organizations to require this compatibility to ensure the effective flow of intelligence within their security system.
Widely adopted by industry, STIX has become increasingly the standard, allowing policy makers to specify cyber intelligence compatibility and interoperability requirements.
Open standard, all its specification and documentation are freely available on the dedicated Github page. It is a guarantee of transparency allowing all decision-makers to resist the potential influence of a software publisher, as may be the case with proprietary standards.
Finally, STIX allows collaboration between the various contributors to the ecosystem, from commercial teams such as the Threat & Detection Research team which produces the SEKOIA.IO CTI, to public or sectoral structures such as CERT or ISAC. Thus, any Threat Intelligence Platform worthy of the name must natively handle STIX 2.1 in input as well as in output; this is of course the case of SEKOIA.IO TIP.
We are a cybersecurity software publisher. We provide SOC and MSSP teams with a turnkey operational security platform (SOC platform). Through our XDR platform, CTI tool and threat intelligence platform, we enable our users to neutralize cyber threats, regardless of the attack surface.
