# STIX

STIX (Structured Threat Information Expression) is the OASIS JSON standard for sharing threat intelligence such as indicators, malware and campaigns between tools.

## How it works

A STIX 2.1 bundle contains objects (indicator, domain-name, url, malware, relationship) with identifiers and timestamps. TAXII is the companion protocol for exchanging bundles.

PhishDestroy publishes its phishing-domain feed as a STIX 2.1 bundle next to JSON and MISP formats.

## How to protect yourself

- Import STIX feeds into a TIP or SIEM instead of copying indicators by hand.
- Keep valid_from and valid_until so stale indicators expire.

## Related tools

- [IOC Converter](https://phishdestroy.io/developer-tools/ioc-converter)

## Related terms

- [Indicator of compromise (IOC)](https://phishdestroy.io/glossary/ioc/)
- [Defanging](https://phishdestroy.io/glossary/defanging/)

## Further reading

- [Open Phishing Dataset: JSON, STIX, MISP, API](https://phishdestroy.io/dataset)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/stix/