<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-threat-intelligence-sharing
description: >-
  Implement structured threat intelligence sharing using STIX/TAXII, MISP sharing
  groups, ISACs, and TLP protocols. Covers trust group management, automated
  sharing workflows, and compliance with sharing agreements.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - intelligence-sharing
  - stix-taxii
  - misp
  - isac
  - tlp
  - trust-groups
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---
# Implementing Threat Intelligence Sharing

## Overview

Threat intelligence sharing enables organizations to collectively improve their
defensive posture through structured exchange of IOCs, TTPs, and contextual
intelligence. This skill covers TAXII 2.1 server deployment, MISP sharing group
configuration, TLP enforcement, ISAC participation, and automated sharing
workflows with policy-based distribution controls.

## Prerequisites

- Python 3.10+ with `taxii2-client`, `taxii2-server`, `pymisp`, `stix2` libraries
- MISP instance with sharing group configuration access
- Understanding of TLP 2.0 markings and distribution rules
- TAXII 2.1 server (Medallion or OpenTAXII) for publishing
- Network connectivity to sharing partners or ISAC infrastructure

```bash
pip install taxii2-client taxii2-server pymisp stix2 medallion
```

## Key Concepts

### TLP 2.0 Marking Protocol

| TLP Level | Distribution | Use Case |
|-----------|-------------|----------|
| TLP:RED | Named recipients only | Active incident, named individuals |
| TLP:AMBER+STRICT | Organization only | Internal-only threat data |
| TLP:AMBER | Organization + need-to-know clients | Sector sharing |
| TLP:GREEN | Community sharing | ISAC distribution |
| TLP:CLEAR | Public | Published advisories |

### MISP Sharing Models

- **Sharing Group**: named set of organizations with explicit membership
- **Community**: all organizations on connected MISP instances
- **Connected Communities**: federated MISP instances
- **All Communities**: maximum distribution across all connected servers

### TAXII 2.1 Architecture

```
Producer → TAXII Server (Collections) → Consumer
             ↓
          API Root → Collection → Objects (STIX 2.1 bundles)
```

## Workflow

### Step 1: Configure MISP Sharing Groups

```python
from pymisp import PyMISP

def create_sharing_group(
    misp_url: str, misp_key: str, name: str, orgs: list[str]
) -> dict:
    """Create a MISP sharing group with specified organizations."""
    misp = PyMISP(misp_url, misp_key, ssl=False)
    sg = misp.add_sharing_group({
        "name": name,
        "releasability": "Members only",
        "description": f"Sharing group: {name}",
        "active": True,
        "local": False,
    })
    sg_id = sg.get("SharingGroup", {}).get("id")
    for org in orgs:
        misp.add_org_to_sharing_group(sg_id, org)
    return {"sharing_group_id": sg_id, "name": name, "organizations": orgs}
```

### Step 2: Publish via TAXII 2.1

```python
import stix2
import requests

def publish_to_taxii(
    taxii_url: str, collection_id: str, bundle: dict,
    username: str, password: str,
) -> dict:
    """Publish STIX bundle to TAXII 2.1 collection."""
    resp = requests.post(
        f"{taxii_url}/collections/{collection_id}/objects/",
        json=bundle,
        auth=(username, password),
        headers={"Content-Type": "application/taxii+json;version=2.1"},
        timeout=30,
    )
    return {"status": resp.status_code, "response": resp.json()}
```

### Step 3: Automated Sharing Workflow

```python
def auto_share_high_confidence(
    misp_url: str, misp_key: str, min_confidence: int = 70
) -> dict:
    """Auto-share high-confidence IOCs to sharing group."""
    misp = PyMISP(misp_url, misp_key, ssl=False)
    events = misp.search(
        tags=["confidence:high"],
        published=True,
        pythonify=True,
    )
    shared = 0
    for event in events:
        for attr in event.get("Attribute", []):
            if attr.get("to_ids") and int(attr.get("comment", "0") or "0") >= min_confidence:
                shared += 1
    return {"events_reviewed": len(events), "iocs_shared": shared}
```

## Verification

- [ ] MISP sharing groups created with correct organization membership
- [ ] TLP markings enforced on shared events and attributes
- [ ] TAXII 2.1 server publishes STIX bundles to authorized consumers
- [ ] Automated sharing workflow filters by confidence and TLP
- [ ] Sharing agreements documented and partner access validated
- [ ] Audit trail captures all sharing transactions with timestamps

## References

- [TAXII 2.1 Specification](https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1.html)
- [MISP Sharing Groups](https://www.misp-project.org/sharing/)
- [TLP 2.0 Standard](https://www.first.org/tlp/)
- [FIRST ISAC Directory](https://www.first.org/members/teams/)
- [Medallion TAXII Server](https://github.com/oasis-open/cti-taxii-server)
