MODULE_DEPLOYED // SHARING-THREAT-INTEL

SHARING INTEL: STIX, TAXII AND MISP WITHOUT TEARS

Tell STIX, TAXII, and MISP apart, mark the report with TLP 2.0, and put the bottom line in the first sentence so a human can use it.

INTERMEDIATE

EST_TIME: 25 MIN

PHASES: 4

THIS_VISIT0 / 4 MARKED (0%)

Ticks last until you refresh. This page does not keep a score.

MISSION_PHASES
1
INTEL NOBODY CAN READDURATION: 4 min
2
STIX 2.1 IN PLAIN ENGLISHDURATION: 7 min
3
TAXII, MISP, AND WHO MAY SEE ITDURATION: 7 min
4
THE HUMAN REPORT, PITFALLS, AND A QUIZDURATION: 7 min
OPERATIONAL_DATA
ASK_A_QUESTIONREAD_A_GUIDE
PHASE_001 // CURRENT_OBJECTIVE
INTEL NOBODY CAN READ
NODE: 1 / 4

The neglected stage

You have found a phishing domain, an IP, and a malware hash. You could email them to five partners as a screenshot of a spreadsheet. Each of them would retype it, two would make typos, and nobody's tools could import it. Structured formats fix that split: machines share the indicators, and people share the judgement.

This is the dissemination stage of the intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback). It is often the most neglected stage, and it is where everything earlier pays off or does not.

The formats in this lesson are OASIS STIX 2.1, TAXII 2.1, and FIRST Traffic Light Protocol 2.0. None of them are a reason to publish someone else's incident.

A screenshot of a spreadsheet is how indicators learn to spell themselves three different ways.
ASK_A_QUESTION