Indicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing

Indicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing

Speakers: Brian DeWyngaert, Senior Technical Advisor to Threat Hunting, CISA

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=ASZW-ursUP8

Overview

In the dynamic landscape of cybersecurity, the rapid and accurate sharing of Cyber Threat Intelligence (CTI) is paramount for effective defense. However, a persistent challenge has been bridging the gap between human-generated threat narratives—often found in unstructured formats like PDFs, emails, and chat messages—and the machine-actionable, structured data required by modern security automation pipelines. Brian DeWyngaert, Senior Technical Advisor to Threat Hunting at CISA (Cybersecurity and Infrastructure Security Agency), addressed this critical problem at FIRSTCON with his talk on the Indicator Message eXchange (IMX) platform.

IMX, developed by CISA, is presented as a transformative solution designed to streamline the creation and sharing of structured CTI. It empowers analysts to quickly produce intelligence in a human-friendly manner while simultaneously ensuring compliance with industry standards like STIX (Structured Threat Information eXpression) and facilitating integration with platforms such as TAXII (Trusted Automated eXchange of Indicator Information) and MISP (Malware Information Sharing Platform). DeWyngaert’s presentation underscored IMX's dual approach, offering both a user-friendly "guided path" for rapid CTI generation and an "expert mode" for power users requiring fine-grained control and advanced tagging.

The significance of IMX lies in its ability to dramatically reduce the time and effort traditionally required to convert raw intelligence into actionable indicators. By automating the complex process of structuring data, IMX enables organizations to accelerate their defensive posture, improve collaboration with partners, and make more informed, timely decisions. This CISA-developed platform, with its commitment to open-source availability, represents a pivotal step towards a more efficient and collaborative global cybersecurity ecosystem.

Background

▶ Watch: Introducing IMX: bridging human CTI to machines (0:00)

The pervasive challenge in Cyber Threat Intelligence (CTI) sharing stems from a fundamental disconnect: humans typically think and communicate in narratives, while machines require structured, standardized data for automation and analysis. As Brian DeWyngaert highlighted, the reality for most cybersecurity professionals is that CTI often arrives in "wonderful published PDFs," emails, slide decks, and informal chats. While these formats are excellent for conveying rich context and analyst thought, they are inherently incompatible with automated CTI pipelines, security information and event management (SIM) systems, and other analytical tools that drive defensive actions.

Existing standards like STIX are robust and comprehensive, offering a powerful framework for expressing threat intelligence. However, their verbosity and intricate schema can be daunting for the average analyst, requiring deep technical understanding and meticulous adherence to data models. Similarly, platforms like MISP provide excellent capabilities for CTI sharing but often demand users to be familiar with concepts like "MISP galaxies" and specific data structures. This complexity creates a significant "automation gap," where valuable indicators remain locked within unstructured documents, necessitating laborious manual extraction by CTI analysts. This manual process is slow, prone to errors, and fundamentally unscalable, hindering timely response and proactive defense.

Another critical issue is the dilemma of "over and under sharing." Organizations grappling with an incident often struggle to determine what information to share. Sharing too much could expose sensitive internal details, while sharing too little might render the intelligence unactionable for partners. DeWyngaert cited the common experience of receiving a document filled with IP addresses, devoid of context regarding their age, relevance, or appropriate actions. This lack of contextual richness diminishes the value of shared indicators and reduces their utility, underscoring the need for a solution that facilitates safe, contextualized, and actionable CTI exchange without requiring every analyst to be a STIX or MISP expert. IMX was conceived to directly address these systemic friction points, aiming to bridge the cognitive and technical divide in CTI sharing.

Key Findings

▶ Watch: IMX philosophy: people first, standards compliant (4:00)

The core contribution of IMX is its ability to serve as a crucial bridge between human analysts and machine-actionable CTI pipelines. Brian DeWyngaert emphasized that IMX was designed to convert "human input into STIX that can easily be piped at the push of a button to a TAXII service and shared." This central finding addresses the long-standing problem of unstructured CTI.

Key findings and contributions of IMX include:

• People-First Design with Standards Compliance: IMX prioritizes the user experience, allowing analysts to input information using a natural "who, what, when, where, how, and why" mental model, rather than requiring memorization of complex schemas like STIX or MISP galaxies. Simultaneously, it ensures that the output is standards-compliant by default, automatically generating validated STIX bundles.
• Dual-Path Approach (Guided and Expert Modes): The platform offers two distinct user interfaces. The guided path simplifies CTI creation for general users, asking intuitive questions to capture essential context and indicators. The expert mode provides power users with direct STIX bundle building capabilities, real-time schema validation, and flexibility for fine-grained data markings and complex campaigns. Both modes share the same robust validation engine.
• Automated Validation and Packaging: IMX eliminates the need for manual validation of STIX bundles. It takes raw user input, transforms it into a standards-compliant package, validates it, and prepares it for shipment. This significantly reduces errors and ensures the integrity of shared intelligence.
• Seamless Integration and Deployment: IMX is built on Docker, enabling quick deployment within minutes on local infrastructure, laptops, or cloud environments. It includes built-in integrations for TAXII services and MISP, ensuring broad compatibility and reach for sharing structured CTI with a diverse ecosystem of partners.
• Enhanced Contextual Sharing: By guiding users through critical questions, IMX ensures that shared indicators are accompanied by rich context, making them more actionable and reducing the problem of over or under sharing. Users can preview exactly what information and markings (e.g., TLP) will leave their environment, enhancing trust and reducing risk.
• Proven Internal Impact at CISA: Internally, CISA's deployment of IMX transformed a laborious, multi-day process of feeding CTI from hunt teams to threat intelligence platforms into a matter of minutes. This dramatically increased the use of structured CTI in their pipelines and reduced reliance on informal communication channels like email and chat for indicator sharing.

Technical Deep Dive

▶ Watch: CISA's IMX deployment: reducing sharing time (9:30)

IMX is architected to address the technical and operational complexities of CTI sharing through a "people-first" design philosophy, underpinned by robust technical components and adherence to industry standards.

Design Principles and User Experience

At its core, IMX aims to simplify the creation of structured CTI without requiring users to be experts in complex data schemas. The key design principles include:

• No Schema Memorization: Analysts are not expected to recall specific STIX object types or MISP attributes. Instead, the platform translates natural language input into the appropriate structured format. For instance, when dealing with a phishing example, IMX intuitively prompts for victims, domains, malware, and hashes – all of which map to observables and their relationships in the STIX world.
• Simple Mental Model: The "who, what, when, where, how, why" framework serves as an intuitive guide for users, ensuring that essential contextual information is captured without overwhelming them with technical jargon.
• Transparent Review: After inputting information, users are presented with a clear, card-based view of the intelligence they've structured. This visual representation allows for easy review and confirmation of what will be shared, including applied data markings like TLP (Traffic Light Protocol).
• Rapid Deployment: Built on Docker containers, IMX can be deployed quickly (within minutes) on various infrastructures—on-premise, cloud, or even a local laptop. This ease of deployment lowers the barrier to entry for organizations looking to adopt structured CTI sharing.

Dual Paths: Guided and Expert Modes

IMX provides two distinct interfaces to cater to different user needs and levels of expertise:

1. Guided Path:

• Purpose: Designed for general analysts who need to quickly create and share CTI without deep knowledge of STIX.
• Methodology: Utilizes the "who (actor, campaign), what (indicators), where/how (context, TTPs), why (motivation, labels, references)" questioning framework.
• Safety Features: In this simpler mode, sharing is restricted to basic TLP markings (e.g., TLP:Green), applied at the end of the process. This design choice minimizes the risk of accidental oversharing by providing a clear preview of the outgoing information.
• MITRE ATT&CK Integration: The guided path integrates with the CIDER tool (a joint product of MITRE and CISA), which helps users select appropriate MITRE ATT&CK techniques based on less technical descriptions, further simplifying TTP identification. DeWyngaert noted an ongoing effort to update CIDER to support MITRE ATT&CK version 19, up from version 17.

1. Expert Mode:

• Purpose: Intended for power users, CTI specialists, and those requiring granular control over STIX bundles.
• Capabilities: Allows direct STIX bundle creation and editing, offering fine-grained control over relationships between objects.
• Real-time Validation: Features real-time schema validation, providing immediate feedback on data integrity and STIX compliance.
• Advanced Tagging: Ideal for complex campaigns and scenarios requiring advanced tagging or specific data markings beyond TLP, such as those required for AIS (Automated Indicator Sharing) submissions (e.g., ACS markings).

Core Architecture and Integration

The underlying architecture of IMX is designed for efficiency and interoperability:

• UI Layers: Separate user interfaces for the guided and expert modes, ensuring a tailored experience for each user type.
• Validation and Transformation Engines: These engines are central to IMX's functionality. They automatically convert human-readable input into STIX objects and relationships, ensuring that the generated CTI is both syntactically correct and semantically valid according to STIX specifications. This process is transparent to the user.
• TAXII and MISP Integrations: IMX includes robust integrations for publishing structured CTI to TAXII servers and shipping it to MISP instances. This ensures that organizations are not locked into a single sharing platform but can disseminate intelligence across a wide array of partners and systems.
• Docker-based Deployment: The use of Docker containers encapsulates the application and its dependencies, making deployment consistent and portable across different environments. This "quick, easy button" approach significantly reduces setup time and operational overhead.

CISA's Internal Impact and Open Source Commitment

CISA's internal deployment of IMX demonstrated its transformative potential. A process that previously took "days long" for hunt teams to share findings with CTI teams and feed into their threat intelligence platform was reduced to "minutes." This efficiency gain enabled immediate sharing of structured STIX indicators to AIS and other partners, leading to:

• Increased use of structured CTI in CISA's intelligence pipelines.
• A decrease in reliance on less efficient methods like email and chat for indicator dissemination.
• Faster defensive actions and improved support for external partners.

Driven by the SHARE Act of 2024, which mandates CISA to publish developed code into the public domain (with some exceptions), CISA is committed to open-sourcing IMX. The open-source version will include the full guided path, expert mode, validation engines, and TAXII/MISP integrations, though initial releases may not feature all of CISA's internal bells and whistles. The recommendation for adopters is to "pilot this internally, figure out how you want to integrate into your CTI pipelines, and then gradually extend it to partners."

Demo / Proof of Concept

▶ Watch: Expert mode demo: power user capabilities (19:50)

Brian DeWyngaert provided a comprehensive demonstration of IMX, showcasing both the user-friendly guided path and a brief glimpse of the expert mode. The entire demo was run from a Docker instance on his laptop, underscoring the platform's ease of deployment and portability.

The guided path walkthrough began by illustrating the "who, what, when, where, how, why" methodology:

1. Who: The demo started with defining the target—entering details like name, phone number, and email. Next, the attacker was identified, including motivations for unauthorized activity. These objects were added to a "cart" for review.
2. Where: A location for the target was specified (e.g., North America). The speaker highlighted that users only need to input information they possess, allowing them to skip fields if data is unavailable.
3. How (Event Details): An incident name was provided, along with event details such as "still ongoing" and "investigation is open," and the detection method (e.g., "via automation tool"). This generated an event object in the cart.
4. What (Observables): This section focused on the concrete indicators. An IP address was entered, along with its "first seen" timestamp and other relevant details. Crucially, the system allowed linking this observable back to previously entered context. A detection string (e.g., a query to find the indicator) was also added, providing actionable information for defenders.
5. How (TTPs): The demonstration moved to Tactics, Techniques, and Procedures (TTPs), specifically integrating with MITRE ATT&CK. DeWyngaert explained the CIDER tool, a joint CISA/MITRE product, which assists users in selecting appropriate ATT&CK techniques based on less technical descriptions. The system made it easy to link these TTPs to the previously defined observables.
6. How (Weakness/Vulnerability): The demo showed how to identify and link specific weaknesses or vulnerabilities (e.g., CVEs) associated with the incident, further enriching the context.
7. Impacts: Users could specify the type of loss (e.g., data loss, financial) and any physical impact, adding critical information about the incident's consequences.
8. Report Assessment: The final step involved naming the overall report and adding any external references (e.g., links to other CTI documents), providing additional context for recipients.

After all information was entered, the system presented a review screen. This allowed the user to collapse and expand all created objects, visualize their relationships, and ensure accuracy before publishing. The user could save the bundle for later editing or reuse.

For publishing, the guided method enforced simple TLP (Traffic Light Protocol) markings (e.g., TLP:Green), which were applied to all selected objects. The system then displayed publishing options, such as pushing to AIS (Automated Indicator Sharing) or a local IMX instance. The final step confirmed publication and displayed the generated STIX bundle, demonstrating the successful conversion of narrative input into structured, machine-readable intelligence.

A brief look at the expert mode followed. This interface presented a more direct STIX editor. DeWyngaert demonstrated loading an existing STIX bundle (a CISA-produced document), merging it, and then adding a new observable (an IP address) and linking it to an autonomous system (AS) by selecting from existing or adding new AS details. This showcased the power user's ability to directly manipulate and extend STIX bundles with fine-grained control, confirming that this is the very software CISA uses to publish its own STIX files.

Defensive Implications

▶ Watch: Q&A: AI for automated indicator extraction (24:00)

The introduction of IMX carries significant implications for cybersecurity defenders, fundamentally altering how CTI is processed, shared, and acted upon. By bridging the critical gap between human narratives and machine-actionable data, IMX empowers organizations to enhance their defensive capabilities in several key ways:

1. Accelerated Defensive Actions: The most immediate implication is the dramatic reduction in time from intelligence discovery to defensive deployment. As demonstrated by CISA's internal experience, transforming a process that took "days long" into "minutes" means that indicators of compromise (IOCs) can be ingested into security tools and acted upon much faster. This speed is crucial in limiting the impact of ongoing attacks and improving overall response times.
2. Enhanced Automation and Pipeline Efficiency: Structured CTI, compliant with STIX, is the lifeblood of modern security automation. IMX ensures that intelligence feeds security orchestration, automation, and response (SOAR) platforms, SIEMs, and other analytical tools with high-quality, validated data. This reduces the manual labor traditionally associated with CTI processing, freeing up analysts to focus on higher-value tasks like threat hunting and strategic analysis.
3. Improved Context and Actionability: The "who, what, when, where, how, why" framework embedded in IMX's guided path ensures that shared indicators are rich in context. Defenders receiving IMX-generated CTI will no longer encounter isolated IP addresses but rather comprehensive bundles that explain the associated actor, campaign, TTPs, vulnerabilities, and impacts. This context is vital for determining the relevance and urgency of an indicator, enabling more informed decision-making.
4. Safer and More Effective Sharing: IMX addresses the dilemma of over- and under-sharing by providing clear mechanisms for applying TLP (Traffic Light Protocol) markings and allowing users to preview exactly what information will be shared. This transparency builds trust among sharing partners and ensures that intelligence is disseminated appropriately, reducing the risk of accidental exposure while maximizing the utility of the shared data.
5. Democratization of CTI Creation: By simplifying the process of creating structured CTI, IMX empowers a broader range of security professionals—not just STIX experts—to contribute to intelligence sharing. This "people-first" approach fosters a more inclusive CTI ecosystem where valuable insights from front-line analysts can be quickly formalized and distributed.
6. Facilitated Collaboration with Partners: With built-in integrations for TAXII and MISP, IMX ensures seamless interoperability with a wide array of existing CTI sharing platforms. This capability is essential for national and international collaboration, allowing organizations to easily exchange intelligence with government agencies (like CISA via AIS) and industry peers, strengthening collective defense.
7. Guidance for Adoption: CISA's recommendation to "pilot this internally, figure out how you want to integrate into your CTI pipelines, and then gradually extend it to partners" provides a clear roadmap for organizations considering IMX. This phased approach helps tailor the deployment to specific organizational needs and ensures a smooth transition to more structured CTI practices.

Key Takeaways

• Bridging the Human-Machine Gap: IMX effectively converts human-centric threat narratives into validated, automation-ready STIX-compliant Cyber Threat Intelligence (CTI), resolving a long-standing friction point in cybersecurity.
• Dual-Path Empowerment: The platform offers a user-friendly "guided path" for general analysts to quickly generate contextualized CTI and an "expert mode" for power users requiring fine-grained control and advanced STIX bundle manipulation.
• Context-Rich, Actionable Intelligence: By prompting for "who, what, when, where, how, why," IMX ensures that shared indicators are accompanied by essential context, making them more actionable and reducing ambiguity for defenders.
• Streamlined Integration and Deployment: Built on Docker and featuring native integrations with TAXII and MISP, IMX facilitates rapid deployment and seamless interoperability with existing CTI sharing ecosystems.
• Significant Operational Efficiency Gains: CISA's internal experience demonstrated that IMX reduced CTI processing time from days to minutes, significantly increasing the use of structured intelligence in automation pipelines and accelerating defensive actions.
• Commitment to Open Source: CISA is actively working to open-source IMX under the SHARE Act of 2024, promising to make this valuable capability available to the broader cybersecurity community for enhanced collaborative defense.

About the Speaker(s)

Brian DeWyngaert is a Senior Technical Advisor to Threat Hunting at the Cybersecurity and Infrastructure Security Agency (CISA). In this role, he contributes to CISA's efforts in identifying and mitigating cyber threats, often through the development and implementation of innovative tools and strategies. His work, as evidenced by the IMX project, focuses on practical solutions that address real-world challenges faced by CTI analysts and threat hunters, particularly in improving the efficiency and effectiveness of intelligence sharing. His presentation highlights CISA's commitment to advancing cybersecurity capabilities for both government and the broader community.