STIX 2.1 - Reyhford Threat Intelligence

STIX 2.1 (Structured Threat Information Expression) is the OASIS standard for representing cyber threat intelligence as JSON objects — indicators, malware, intrusion sets, relationships, and more.

Why STIX for ICS/OT

SOC platforms (Splunk, Sentinel, QRadar, OpenCTI) already speak STIX. Reyhford delivers industrial reconnaissance and attack signals as STIX 2.1 indicators so your existing TAXII consumers do not need a proprietary format. Typical Reyhford indicator fields (conceptually):

Pattern (e.g. IPv4 observation)
Labels / kill-chain context
Confidence
Protocol and sensor metadata (via enrichment / custom properties in our pipeline)
MITRE ATT&CK for ICS technique linkage where mapped

Spec pointers

Bundle type bundle with spec_version 2.1
Indicator objects with STIX patterning ([ipv4-addr:value = '…'])
valid_from, confidence, labels

In Reyhford

Pull STIX via TAXII objects or inspect structured results from the Indicators API. For transport, see TAXII 2.1.