Threat Intelligence Dissemination and Sharing
This domain tests whether you can get the right product to the right audience with the right handling restrictions, in a format the consumer can act on - and whether you know the sharing standards well enough to choose between them.
Tailor to the consumer
A SOC needs machine-readable indicators and detection logic; a CISO needs a one-page judgement with business impact; a peer CERT needs attributed observables. Same intelligence, three products. Flash reporting for imminent, actionable threats; daily or weekly summaries for situational awareness; formal threat assessments for planning cycles.
TLP 2.0
Traffic Light Protocol is a community convention, not a contract or a law.
- TLP:RED - named recipients only, no further distribution.
- TLP:AMBER - limited disclosure: the organisation plus clients or customers on a need-to-know basis; AMBER+STRICT restricts to the organisation only.
- TLP:GREEN - community-wide, including peers and sector partners.
- TLP:CLEAR - public, unlimited; replaced WHITE in TLP 2.0.
Machine-readable sharing
STIX 2.1 objects (indicator, malware, threat-actor, relationship) transported over TAXII 2.1 is the common vendor-neutral pattern. MISP events and feeds dominate operational sharing; OpenIOC and YARA cover host and file logic. Whatever the format, carry provenance, first/last seen, and the TLP marking as data fields, not just prose in a PDF.
Sharing safely
Sanitise before sharing: strip victim names, internal IPs, credentials, and anything identifying a source without consent. Third-party indicators arrive with the originator's handling caveats and cannot be relicensed by you. Sharing is reciprocal; communities that only consume lose access.
Feedback loop
Dissemination closes the lifecycle only if you capture the consumer response: did the indicator fire, did it help, was the assessment wrong? Feedback re-tunes direction and collection.
Worked example
You identify a campaign against three sector peers. Indicators include one peer's internal hostname and a source shared under TLP:AMBER+STRICT. Output one: a TLP:RED flash for the named peers' SOCs, source removed. Output two: a TLP:AMBER+STRICT technical annex for your own IR team. Output three: a TLP:CLEAR blog on TTPs only, with no infrastructure that could identify victims. The hostname is stripped from all three. Sharing the raw set at GREEN would breach the originator's caveat and expose a victim.
Traps
Treating TLP as legally enforceable, or defaulting to RED out of habit. Sharing at GREEN "because it's just indicators". Stripping so much context the indicator becomes useless. Sending a twenty-page technical report to an executive. Publishing victim-identifying detail mid-incident.