Threat › Module 6 › Lesson 2
STIX TAXII Named
STIX/TAXII literacy — objects, bundles, collections, TAXII discovery — concept rows on `$TI_LAB` yaml stubs only.
Visual · t33_stix_taxii_named
STIX/TAXII = named exchange vocabulary. $TI_LAB yaml stubs. Original Cyberlium.
Opening
Feeds speak STIX — TAXII moves them — name object and collection rows on YOUR lab stubs before touching prod exchange servers without RoE.
STIX/TAXII literacy names: STIX object types (indicator, malware, relationship literacy stubs), STIX bundle/category, TAXII collection category, TAXII discovery/API literacy stub, and mapping STIX fields to SIEM ingest category. Analyst documents STIX/TAXII concept card on `$TI_LAB` — three object type examples in YOUR yaml stub, one collection name stub, discovery URL placeholder on lab host only — without pointing lab scripts at employer prod TAXII, without publishing STIX with live victim PII, without STIX as excuse for marketplace data ingest. Cyberlium teaches exchange vocabulary — defender reading of vendor docs and MISP/OpenCTI exports. Refused: unauthorized prod TAXII polling, victim PII in STIX bundles, marketplace STIX cookbooks. Lab row: STIX/TAXII concept card (three objects, one collection, discovery stub).
1. Named STIX objects
Indicator, malware, relationship — three starter object literacy rows.
Bundle wraps objects — document one bundle stub in YOUR yaml notes.
Command guide
Try these commands — Named STIX objects
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OASIS STIX — https://oasis-open.github.io/cti-documentation/stix/intro.html OASIS CTI — https://oasis-open.org/committees/cti/ MISP STIX — https://www.misp-project.org/openapi/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
curl -sS https://oasis-open.github.io/cti-documentation/stix/intro.html | head -10
cat > "$TI_LAB/feeds/stix-taxii-named.txt" <<'EOF'
STIX/TAXII — NAMED LITERACY:
STIX: structured threat info (indicators, malware, relationships, campaigns)
STIX 2.1 objects: indicator, malware, threat-actor, relationship, sighting
TAXII: transport/API for exchanging STIX bundles over HTTPS
MISP/OpenCTI: platforms that import/export STIX for sharing
Lab: write STIX-like JSON stub in stix/ for YOUR fake indicator — see 6-4
EOFCommand — copy this
grep -E 'STIX|TAXII|indicator|relationship' "$TI_LAB/feeds/stix-taxii-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: OASIS STIX (https://oasis-open.github.io/cti-documentation/stix/intro.html); OASIS CTI (https://oasis-open.org/committees/cti/); MISP STIX (https://www.misp-project.org/openapi/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TAXII collections
Collection = published set category; discovery = how clients find collections literacy.
Lab discovery URL points to instructor stub or localhost placeholder only.
3. Refused
No unauthorized prod TAXII polling; no victim PII in practice bundles.
STIX literacy supports feed reading — not marketplace operationalization.
4. What you ship: STIX/TAXII concept card
Three STIX object stubs + one collection + discovery placeholder + NEVER prod TAXII line.
5. What you record before the next lesson
STIX/TAXII concept card path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Poll employer prod TAXII server without ticket to 'learn STIX.'
Right
STIX/TAXII concept card from `$TI_LAB` yaml stub. Next: Feed Quality.
Mission: STIX/TAXII concept card
1) Name three STIX object types. 2) One bundle and collection stub. 3) Discovery placeholder on lab only. 4) Write NEVER unauthorized prod TAXII line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Indicator vs observable — literacy split?”
Knowledge Check
APPLY: STIX/TAXII literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: STIX bundles may include live victim PII in lab.
True or False
Knowledge Check
APPLY: TAXII literacy includes:
Multiple choice