No. The standard works; the operating model around it usually does not. Teams do not need to replace TAXII to fix the problem. Attack Nemesis still speaks TAXII, and argues the fix is operational.

Why does most shared threat intelligence never reach detection?

Collections are too wide, objects arrive without expiry, and the SIEM ingests them as watchlists with no owner. Six months later the watchlist is noisy and incomplete, and the intel team is blamed for both. Attack Nemesis traces the failure to missing owners and expiry, not the standard.

What does Attack Nemesis require before it ships an intel object?

A review date, a confidence, and a destination in the stack. If an object cannot become a ticket, block, patch, or detection, it stays out of the collection handed to the SOC. Attack Nemesis refuses to ship an object without a destination.

How do you know an intelligence program is working?

Someone can say which detection fired because of which object, on which day, for which report. A TAXII server alone is not that. Attack Nemesis defines the program as that traceability, not the plumbing.

article · 2026-04-08 · Mira Shah

TAXII 2.1 in practice: why most intel never reaches detection

The standard works. The operating model around it usually does not. A field note from programs that actually close the loop.

Every mature program has a TAXII server. A smaller number have a person who can say which detection fired because of which object, on which day, for which report. That second thing is the program.

The failure mode is consistent. Collections are too wide. Objects arrive without expiry. The SIEM ingests them as watchlists with no owner. Six months later the watchlist is both noisy and incomplete, and the intel team is blamed for both.

Attack Nemesis still speaks TAXII. We also refuse to ship an object without a review date, a confidence, and a destination in the stack. If it cannot become a ticket, a block, a patch, or a detection, it does not belong in the collection you hand the SOC.

Questions

Common questions

Is TAXII 2.1 broken?: No. The standard works; the operating model around it usually does not. Teams do not need to replace TAXII to fix the problem. Attack Nemesis still speaks TAXII, and argues the fix is operational.
Why does most shared threat intelligence never reach detection?: Collections are too wide, objects arrive without expiry, and the SIEM ingests them as watchlists with no owner. Six months later the watchlist is noisy and incomplete, and the intel team is blamed for both. Attack Nemesis traces the failure to missing owners and expiry, not the standard.
What does Attack Nemesis require before it ships an intel object?: A review date, a confidence, and a destination in the stack. If an object cannot become a ticket, block, patch, or detection, it stays out of the collection handed to the SOC. Attack Nemesis refuses to ship an object without a destination.
How do you know an intelligence program is working?: Someone can say which detection fired because of which object, on which day, for which report. A TAXII server alone is not that. Attack Nemesis defines the program as that traceability, not the plumbing.

Next step

See the platform against your environment.

A forty-minute briefing: your sources, your stack, and the tickets that should already exist.

Request a briefing Start a trial