What is STIX?

• A. A malware scanning tool
• B. A cryptographic hash standard
• C. STIX is a collaborative community-driven effort to define a standardized language to represent structured cyber threat information, designed to be expressive, flexible, extensible, automatable, and human-readable.
• D. A threat actor attribution framework

Answer: (C)

STIX is a standardized language for representing cyber threat information in a structured, machine-processable way. It’s designed to be expressive and extensible so analysts can capture a wide range of details—from indicators like hashes and IPs to tactics, techniques, campaigns, and threat actors—while staying readable to humans. It’s the result of a collaborative, community-driven effort to enable interoperability among threat intel feeds and security tools, making it easier to share and automate threat data. Often paired with TAXII, STIX data can be transported between organizations and integrated into analysis, detection, and response workflows. The other options describe a tool, a hash standard, or a threat-actor framework, none of which capture what STIX really is.