Threat Intelligence Dissemination and Integration
This domain tests whether intelligence reaches the right consumer in the right form and whether you can handle it lawfully. Items often hinge on Traffic Light Protocol colours or on the difference between human-readable and machine-readable delivery.
TLP 2.0
- TLP:RED - named recipients only, no further disclosure.
- TLP:AMBER - limited disclosure to the organisation and its clients on a need-to-know basis; TLP:AMBER+STRICT restricts it to the organisation alone.
- TLP:GREEN - community-wide, peers and partner organisations, not public.
- TLP:CLEAR - public, no restriction; replaced TLP:WHITE. Mark every product and every shared artefact. TLP is a handling instruction, not a legal contract, and it does not survive being pasted into a public forum.
Formats
Human-readable: briefings, reports, advisories. Machine-readable: STIX/TAXII collections, MISP events, CSV, Sigma and YARA rules, SIEM lookups. Produce both - the SOC needs the machine form, the CISO needs the bottom line. Tailor by audience: strategic is one page of decision and risk, operational is campaign narrative plus detection opportunities, tactical is indicators with context and expiry.
Integration points
- Threat intelligence platform aggregates, scores, deduplicates and distributes to SIEM, EDR, next-generation firewall, proxy and DNS sinkhole, and triggers SOAR playbooks.
- Detection pipeline: report → ATT&CK mapping → Sigma rule → test → deploy → track.
- Ticket and incident response integration so intelligence is attached to cases.
- Feedback from the SIEM (which indicators fired, false positive rate) back to the platform.
Sharing communities and constraints
ISACs and ISAOs, CERTs, FIRST, sector groups, vendor portals. Check licence and redistribution terms, privacy obligations, contractual duties and need-to-know; anonymise victim data where required.
Worked example
An ISAC peer shares a TLP:AMBER report with a new infostealer hash and command-and-control domain. Reasoning: AMBER permits internal sharing with those who need it - the SOC and IR lead, not marketing. Convert to STIX, ingest with the AMBER marking, push the hash to EDR as an alert-only rule and the domain to DNS logging rather than blocking, since there is no prevalence data. Tag a 30-day expiry and report back to the ISAC after two weeks on what fired. That feedback is what sustains the sharing relationship.
Traps that cost marks
- Re-publishing AMBER or GREEN content publicly.
- Dropping indicators into blocking controls with no context or expiry.
- Sending the SOC a twelve-page strategic report and the board a hash list.
- No feedback loop, so the programme never learns what worked.