Indicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing
summary
CISA’s IMX is an open‑source, containerized platform that turns analyst narratives into validated STIX 2.x packages in minutes, deployable via Docker. A five‑question Guided Mode produces TLP‑marked bundles and a schema‑aware Expert Mode offers real‑time validation, enrichment hooks, and direct relationship editing. Integrations ship bundles to TAXII and MISP, cutting CTI processing from days to minutes in internal deployments; automated PDF extraction is on the backlog.
AI-written summary · about
chapters (12)
- 0:00IMX introduction and purpose
- 1:52Why CTI sharing is hard
- 3:44Automation gap in CTI sharing
- 5:11Bridging human narratives and standards
- 7:20Guided and expert paths in IMX
- 9:27IMX architecture and integrations
- 10:09SIZA impacts and lessons
- 11:15IMX open source plans
- 12:18Key takeaways
- 12:47Guided UI demo
- 19:58Expert mode demo
- 23:03Q&A
related talks
30mCTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard Ecosystem
30mHow to Create Effective Structured Intelligence Extensions for TIPs
37mWho Do You Think You Are?
38mCruising Ocean Threat With TheHive, Cortex & MISP Without Sinking
01h 01mIntroduction To STIX/TAXII 2 Standards
29mA Collective CTI Doctrine
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)