> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# STIX 2.1

> Structured Threat Information Expression — the language Reyhford uses for ICS/OT indicators.

**STIX 2.1** (Structured Threat Information Expression) is the OASIS standard for representing cyber threat intelligence as JSON objects — indicators, malware, intrusion sets, relationships, and more.

## Why STIX for ICS/OT

SOC platforms (Splunk, Sentinel, QRadar, OpenCTI) already speak STIX. Reyhford delivers industrial reconnaissance and attack signals as **STIX 2.1 indicators** so your existing TAXII consumers do not need a proprietary format.

Typical Reyhford indicator fields (conceptually):

* Pattern (e.g. IPv4 observation)
* Labels / kill-chain context
* Confidence
* Protocol and sensor metadata (via enrichment / custom properties in our pipeline)
* MITRE ATT\&CK for ICS technique linkage where mapped

## Spec pointers

* Bundle type `bundle` with `spec_version` `2.1`
* Indicator objects with STIX patterning (`[ipv4-addr:value = '…']`)
* `valid_from`, `confidence`, `labels`

## In Reyhford

Pull STIX via [TAXII objects](/api-reference/taxii/objects) or inspect structured results from the [Indicators API](/api-reference/indicators/search). For transport, see [TAXII 2.1](/fundamentals/taxii-21).