Which description best captures a key property STIX aims to provide?

Which description best captures a key property STIX aims to provide?

• A. A rigid, binary encoding scheme.
• B. Fully expressive, flexible, extensible, automatable, and as human-readable as possible.
• C. A collection of malware hashes.
• D. A real-time network protocol analyzer.

Answer: (B)

STIX is built to encode threat intelligence in a way that is both richly expressive and ready for automation, while still being understandable to humans. This means it can capture a wide range of concepts—indicators, tactics, techniques, procedures, campaigns, threat actors, relationships between objects, and more—within a single, consistent framework. The emphasis on expressiveness and extensibility allows analysts to describe complex threat scenarios and to expand the standard as new threats and contexts emerge. At the same time, STIX is designed to be machine-actionable: its JSON-based structure and defined object types enable automated ingestion, correlation, and sharing, often in conjunction with TAXII for transport. The human-readability aspect comes from the use of standardized vocabulary and patterns that help analysts interpret the data without needing to reverse-engineer the format. A rigid binary encoding would hinder evolution and collaboration. Focusing only on malware hashes narrows the scope far too much to be useful for comprehensive threat intelligence. A real-time network protocol analyzer serves a different purpose—traffic analysis—rather than describing and sharing threat intelligence.

STIX is built to encode threat intelligence in a way that is both richly expressive and ready for automation, while still being understandable to humans. This means it can capture a wide range of concepts—indicators, tactics, techniques, procedures, campaigns, threat actors, relationships between objects, and more—within a single, consistent framework. The emphasis on expressiveness and extensibility allows analysts to describe complex threat scenarios and to expand the standard as new threats and contexts emerge. At the same time, STIX is designed to be machine-actionable: its JSON-based structure and defined object types enable automated ingestion, correlation, and sharing, often in conjunction with TAXII for transport. The human-readability aspect comes from the use of standardized vocabulary and patterns that help analysts interpret the data without needing to reverse-engineer the format.

A rigid binary encoding would hinder evolution and collaboration. Focusing only on malware hashes narrows the scope far too much to be useful for comprehensive threat intelligence. A real-time network protocol analyzer serves a different purpose—traffic analysis—rather than describing and sharing threat intelligence.