Chapter 4: STIX/TAXII Threat Intelligence

OASIS STIX 2.1 (Indicator/Malware/Threat-Actor/Campaign/Tool/Vulnerability/Course-of-Action/Identity/Intrusion-Set), TAXII 2.1 RESTful API, collection/api-root/discovery endpoints.

This chapter elaborates on the STIX/TAXII Threat Intelligence portion of Security Incident Response (WIA-SEC-IR-001). The security incident response canonical envelope shape, API surface, and protocol exchanges are designed to interoperate across implementations published under the WIA Standards family. Each Phase file in `spec/` documents one architectural layer (envelopes, REST surface, federation, ecosystem) and the present chapter focuses on the stix/taxii threat intelligence subset of that layering.

Implementations of stix/taxii threat intelligence need to reconcile the per-standard expectations of NIST SP 800-61 Rev 3 (Computer Security Incident Handling Guide), ISO/IEC 27035 series (Information security incident management), ENISA Good Practice Guide for Incident Management, MITRE ATT and CK Enterprise + ICS + Mobile, OASIS STIX 2.1 / TAXII 2.1. The Phase 1 envelope class for Security Incident Response carries the per-host identifier and per-tenant identifier so that audit records can be reconstructed across hosts that federate through the Phase 3 protocol layer.

Operators stepping into stix/taxii threat intelligence typically follow this trajectory: stand up the reference simulator at `simulator/index.html`, walk the canonical envelope per the CLI helper at `cli/security-incident-response.sh envelope`, then exercise the Phase 2 endpoints with curl/Postman against a host running the reference container at `wia/security-incident-response-host:1.0.0`. Once those steps complete, integrators wire the real backend one endpoint at a time per the Phase 1 §A.* envelope catalogue and the Phase 2 §B.* endpoint catalogue.

A common operational concern in the stix/taxii threat intelligence space is observability. Every Phase 1 envelope SHOULD emit a structured log line at the host's audit transport with: timestamp per RFC 3339, host identifier, tenant identifier, envelope class, envelope identifier, operation outcome, and a W3C Trace Context `traceparent` propagated end-to-end. Phase 2 surfaces this trace identifier as the `X-WIA-Trace-Id` response header. Phase 3 protocol exchanges propagate the trace identifier inside the exchange envelope so that a federation crossing remains correlatable end-to-end.

The stix/taxii threat intelligence portion of the standard composes with: WIA-OMNI-API for credential storage, WIA-AIR-SHIELD for runtime trust list, WIA-INTENT for workload intent declaration, and WIA Secure Enclave for sealed-data envelopes where personal data is processed. The composition lets one host running multiple WIA family standards reuse one identity, one signing-key chain, and one audit transport rather than maintaining N parallel per-standard implementations.