Structuring Threat Intel: CTI and STIX Basics

At Incognito 2024, a 7-member team built and presented a STIX-based CTI visualizer. This is a write-up of the CTI and STIX concepts I dug into along the way — less about code, more about how you represent threat information as structure.

What is CTI

CTI (Cyber Threat Intelligence) is structured knowledge about how attacks happen: who (threat actors), with what (malware, tools), how (techniques), against whom (targets), and what traces they leave (indicators). It's not raw logs or alerts — it carries context and relationships, like "this IP is a C2 for that malware, which is used by this group, which targets the finance sector."

The value of CTI is in sharing and automation. For one organization's observations to become another's defense, the data has to go beyond human-readable reports into a form machines can read and process. That's where a standard becomes necessary.

Why a standard (STIX) is needed

If every threat report were free-form prose, each organization would phrase things differently and automated exchange would break down. One writes malware, another malicious_code, another buries it in a sentence. Then a human has to re-interpret the data on every handoff.

STIX (Structured Threat Information eXpression) is an OASIS standard that solves this. It expresses threat information with defined object types and properties, so different systems exchange it with the same meaning. The widely used version is STIX 2.1, and it's JSON-based, which makes it easy to handle with tooling.

STIX's object model — nouns and relationships

The heart of STIX is breaking a threat into "nouns (objects)" and "relationships." There are three main families.

SDO (STIX Domain Objects) — the nouns of a threat The conceptual entities that make up a threat, such as:

• threat-actor, intrusion-set / campaign
• malware, tool
• attack-pattern (techniques, e.g. MITRE ATT&CK), vulnerability
• indicator, observed-data, identity, report

SCO (STIX Cyber-observable Objects) — observable artifacts The low-level values actually observed on networks/systems: ipv4-addr, domain-name, url, file (with hashes), email-addr, and so on. The atomic units of "what was seen."

SRO (STIX Relationship Objects) — relationships The edges that connect objects. Two kinds:

• relationship: links source_ref → target_ref with a relationship_type. For example, indicator —indicates→ malware, malware —uses→ attack-pattern, threat-actor —targets→ identity.
• sighting: records when and where a given object was actually observed.

Every object carries common properties like type, id, created, modified, and spec_version, and the whole set is usually delivered wrapped in a single bundle.

STIX is a graph

A natural observation follows: SDOs/SCOs are nodes, SROs are edges. STIX data is essentially a directed graph. "This indicator indicates this malware, which uses this technique, which belongs to this campaign" — that chain maps directly onto nodes and edges. So STIX pairs extremely well with visualization.

What we built — making large STIX legible

The problem was scale. A real CTI dataset expressed in STIX produces 10,000+ objects and relationships, and drawing them all at once yields a graph so dense you can't see anything. Starting from an open-source STIX visualizer, the team added two practical features.

1. Created-date range filtering — show only objects created within a time window. Threats have a strong time axis, so narrowing to "what newly appeared in this period" proved useful.
2. Type-based (SDO) node toggling — turn individual types on/off, e.g. only malware, only threat-actor. This lets you slice the graph down to the viewpoint you care about.

Those two filters alone turned a 10K+ line dataset into an "analyzable" graph. The point was to keep STIX's graph nature while taming the scale with filters.

Wrap-up

• CTI is structured knowledge about threats; its value lies in sharing and automation.
• STIX is the standard that lets machines exchange that information with a shared meaning (OASIS, 2.1, JSON).
• STIX represents threats as a graph via SDO/SCO (nodes) + SRO (edges).
• Large STIX only becomes readable once you tame it with time and type filters — which was our project's takeaway.

STIX 2.1 (OASIS) · Presented at Incognito 2024