Lion Cipher Lab
Share threat intelligence with STIX and TAXII
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Threat intelligence is only useful if it moves. A PDF report with indicators buried in a table is a thing a human reads on Tuesday; a STIX bundle delivered over TAXII is a thing a firewall blocks at 3am on Sunday without anyone awake. STIX is the agreed grammar for describing threats — indicators, malware, actors, and the relationships between them — and TAXII is the agreed plumbing for shipping it. Between them they are what CISA's Automated Indicator Sharing runs on, what MISP and every commercial threat-intel platform import and export, and what MITRE serves ATT&CK over. Once you can open…
What you'll learn
- reading a STIX 2.1 object and saying what it asserts
- the STIX object model (SDOs, SROs, SCOs)
- STIX patterning — reading and writing indicator patterns
- hand-writing and validating a STIX bundle
- Python virtual environments and pip
- the stix2 Python library
- TAXII 2.1: discovery, API roots, collections, objects
- pulling live intel from a public TAXII server
Steps in this lab
- The whole idea, in two sentences
- A word on what this ISN'T, so you don't get lost
- Get Python (skip if you already have it)
- Make a project folder and a virtual environment
- Install the two official libraries
- Meet a real STIX object, field by field
- The object model: three families, and the four types you actually meet
- STIX patterns — the detection language inside the indicator
- Save a real bundle to disk
- Read it with code — and let the library do the validating
- Write your own bundle by hand
- Break it on purpose — meet the validator
- Generate a bundle with code instead of by hand
- Now the transport half: what TAXII actually is
- Walk a live public TAXII server
- Pull real objects — and hit the custom-property wall
- Where this shows up in a real job
- What you can now do that you couldn't this morning