The early users of STIX recognized that some of the STIX 1.x design choices restricted the usefulness of the standard. The community overhauled STIX to make it more effective and flexible, restarting the design from a blank slate based on what had been learnt using STIX 1.x.
The designers of STIX 2.1 intended to develop a set of flexible building blocks that content creators could use to model what was happening in the actual practice of threat intelligence.
Special thanks to our partner Cosive, for joint-authoring this White Paper.
