STIX TAXII Named
STIX/TAXII literacy — objects, bundles, collections, TAXII discovery — concept rows on `$TI_LAB` yaml stubs only.
Visual · t33_stix_taxii_named
STIX/TAXII = named exchange vocabulary. $TI_LAB yaml stubs. Original Cyberlium.
Feeds speak STIX — TAXII moves them — name object and collection rows on YOUR lab stubs before touching prod exchange servers without RoE.
STIX/TAXII literacy names: STIX object types (indicator, malware, relationship literacy stubs), STIX bundle/category, TAXII collection category, TAXII discovery/API literacy stub, and mapping STIX fields to SIEM ingest category. Analyst documents STIX/TAXII concept card on `$TI_LAB` — three object type examples in YOUR yaml stub, one collection name stub, discovery URL placeholder on lab host only — without pointing lab scripts at employer prod TAXII, without publishing STIX with live victim PII, without STIX as excuse for marketplace data ingest. Cyberlium teaches exchange vocabulary — defender reading of vendor docs and MISP/OpenCTI exports. Refused: unauthorized prod TAXII polling, victim PII in STIX bundles, marketplace STIX cookbooks. Lab row: STIX/TAXII concept card (three objects, one collection, discovery stub).
1. Named STIX objects
Indicator, malware, relationship — three starter object literacy rows.
Bundle wraps objects — document one bundle stub in YOUR yaml notes.
Command guide
Try these commands — Named STIX objects
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: OASIS STIX (https://oasis-open.github.io/cti-documentation/stix/intro.html); OASIS CTI (https://oasis-open.org/committees/cti/); MISP STIX (https://www.misp-project.org/openapi/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TAXII collections
Collection = published set category; discovery = how clients find collections literacy.
Lab discovery URL points to instructor stub or localhost placeholder only.
3. Refused
No unauthorized prod TAXII polling; no victim PII in practice bundles.
STIX literacy supports feed reading — not marketplace operationalization.
4. What you ship: STIX/TAXII concept card
Three STIX object stubs + one collection + discovery placeholder + NEVER prod TAXII line.
5. What you record before the next lesson
STIX/TAXII concept card path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Poll employer prod TAXII server without ticket to 'learn STIX.'
- Right: STIX/TAXII concept card from `$TI_LAB` yaml stub. Next: Feed Quality.
Mission: STIX/TAXII concept card
1) Name three STIX object types. 2) One bundle and collection stub. 3) Discovery placeholder on lab only. 4) Write NEVER unauthorized prod TAXII line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Indicator vs observable — literacy split?”
APPLY: STIX/TAXII literacy uses:
APPLY: True or False: STIX bundles may include live victim PII in lab.
APPLY: TAXII literacy includes: