Threat Intelligence
STIX is the language, TAXII is the pipe
ServiceNow Threat Intelligence ingests and distributes structured threat data using STIX 2.x objects over TAXII 2.x collections. Candidates who blur these lose easy points: STIX defines the objects (Indicator, Observable, Malware, Threat Actor, Intrusion Set, Campaign, Attack Pattern, Course of Action, Tool, Infrastructure, Relationship, Sighting) and their fields; TAXII defines how a client requests a collection of those objects from a server.
Observable vs Indicator is the highest-yield distinction. An observable is raw observed fact - an IP, domain, URL, file hash, email address. An indicator is an assertion carrying meaning and a matching pattern ("this domain is command-and-control") plus confidence, valid_from/valid_until, and often a kill-chain phase. Observables are what you see on an incident; indicators are what you compare them against.
Sightings are the bridge: when an observable on a security incident matches an indicator, the platform can record a sighting, building a history of where a piece of intelligence has appeared.
Traps
- Assuming a TAXII feed automatically creates incidents - ingestion populates intelligence; matching and case creation are separate.
- Ignoring indicator lifecycle: an indicator that stops matching is usually expired (valid_until passed) or deactivated, not deleted.
- Treating all indicators as equally trustworthy; confidence and source reputation govern auto-enrichment.
Worked example
An analyst asks why a known-bad IP no longer flags on new incidents. Check in order: is the indicator active, has valid_until passed, was the observable recorded with the correct type (IP vs IP:port mismatches are common), and has the indicator aged out of its feed collection?
Rule of thumb: treat intelligence as perishable - every indicator-driven answer should mention validity or confidence.