Intelligence has value only when it reaches the people and systems that can act on it. Dissemination is the practice of packaging finished intelligence for its intended audience and delivering it in a form they can use, whether that is a written assessment for leadership or a machine readable feed for a detection platform. Sharing extends this beyond a single organization, letting defenders exchange indicators and context so that one victim's experience becomes another's early warning. Effective sharing depends on common formats, trusted relationships, and clear handling rules that tell recipients how widely a given report may be passed on.

The elements of dissemination and sharing described in this area include the following.

• Reporting formats and audiences: matching the structure, length, and language of a product to the strategic, operational, or technical reader who will consume it.
• Sharing standards: STIX for expressing threat information in a structured form and TAXII for transporting it between systems.
• ISACs and trust communities: sector based information sharing and analysis centers and other trusted groups that circulate threat data among members.
• The Traffic Light Protocol: a simple labeling scheme that signals how far a piece of shared information may be redistributed.

References#

• OASIS, STIX and TAXII specifications
• FIRST, Traffic Light Protocol standard