How to Start Sharing Cyber Threat Intelligence: Tips for Small Teams

Picture this.

Your team investigates a phishing email. You identify a suspicious domain, uncover a few related indicators and figure out how the attack works.

You document your findings, update your detections and close the ticket.

Job done.

But here's the thing: somewhere else, a security team at another organisation in your industry could be investigating the exact same campaign.

What you've discovered might save them hours of work. It could even help them detect the threat before it causes any damage.

If only they knew about it.

And here's the other side of that equation, since you're probably already thinking:

"Warm fuzzies aside, what's in it for me?"

Next time, your team could be the one spinning their wheels on a threat that another organisation has already clocked.

A few shared indicators or a useful observation could save you hours or days of work, or help you spot something you otherwise might have missed.

That's the real value of sharing cyber threat intelligence (CTI). When security teams contribute what they know, everyone benefits - including the teams doing the sharing.

So, if sharing intelligence makes so much sense, what's stopping more of us from doing it?

Maybe your team is concerned about accidentally sharing sensitive information. Perhaps you're not sure whether your intelligence would be useful to anyone else. Or you might assume you need a dedicated CTI team, specialist tooling and a mature intelligence program before you can contribute.

These are all reasonable concerns.

The good news is that you can start sharing useful threat intelligence with the people, resources and tools you already have.

A few sensible ground rules, a trusted community and a willingness to contribute can get you a long way.

Here are five practical ways to get started.

1. Set some ground rules before you start sharing

One of the biggest things that might be holding your team back from sharing threat intelligence is a simple question:

"What if we share something we shouldn't?"

It's a reasonable concern. Your team handles sensitive information every day, from internal infrastructure details to customer data and incident reports.

And once information leaves your organisation, you may not have much control over where it goes next.

The best place to start is with some clear ground rules. Agree on what your team can share, who can receive it and what needs approval.

That way, your analysts can contribute with confidence, without having to second-guess every sharing decision.

At Cosive, we've seen firsthand how important clear sharing rules are through our work co-designing and developing Australia's national Cyber Threat Intelligence Sharing (CTIS) platform.

CTIS brings together government agencies, critical infrastructure organisations and the private sector to exchange threat intelligence.

One of the key lessons from this work?

You're much more likely to feel comfortable sharing intelligence when you know exactly how it will be handled.

Start with the Traffic Light Protocol

The Traffic Light Protocol (TLP) gives you a lingua franca for setting sharing restrictions.

Maintained by FIRST, TLP is a widely used standard that tells recipients how far they're allowed to share the information they receive.

There's one important thing to understand, though.

TLP labels communicate sharing restrictions. They don't actually enforce them.

You'll still need the right processes and technical controls to make sure information only reaches its intended recipients.

‍

Put those boundaries into practice with MISP

If you're using a threat intelligence platform like MISP, you have several ways to control who can access your intelligence.

For example, MISP lets you:

• Set distribution permissions to control which organisations or communities can access particular events and attributes.
• Create sharing groups to exchange intelligence with specific, trusted organisations.
• Apply synchronisation filters to control what gets shared between connected MISP instances.
• Use TLP tags to communicate how recipients are permitted to share the information.
• Use Event Templates to standardise how reports are structured between analysts and what kinds of data are required and optional.

Let's say you've investigated a phishing campaign.

You've collected some useful indicators, but your investigation also contains sensitive information about your internal systems.

You want to share the indicators so other security teams can improve their detections, while keeping details about your internal infra close to the chest.

MISP's distribution settings let you manage access to different parts of that intelligence, so you can share what's useful without exposing information that should be kept close to the chest.

Just make sure your technical controls match your sharing policies. You'll also need to account for any legal or contractual obligations, and restrictions imposed by the original source.

(If this all sounds a little complicated, don’t stress - you can reach out to us for help with configuring MISP to support what you want to achieve with sharing.)

‍

2. Start with what you've already got

Here's something we often remind teams getting started with CTI.

You're probably already producing information that other security teams would find useful.

Think about what your analysts do every day.

You're investigating phishing emails, analysing suspicious domains, responding to security alerts and researching vulnerabilities that might affect your environment.

Along the way, you're gathering evidence and developing an understanding of how threats operate.

That's intelligence worth considering for sharing.

You might have:

• Indicators associated with a phishing or malware campaign you've investigated.
• Observations about attacker behaviour or techniques.
• Detection logic that's helped your team identify malicious activity.
• Lessons learned from an incident investigation, with sensitive details removed.
• Additional context or corrections to intelligence someone else has shared.

You don't need to share all of it.

Pick one useful finding and give sharing a go.

Give people enough context to use your intelligence

Let's say your team discovers a suspicious domain associated with a phishing campaign.

You could share the domain name and leave it at that.

But what can another analyst actually do with it?

They might block it, investigate it, or ignore it because they don't know whether it's relevant to their env.

Now imagine you add a little more information.

You explain that the domain was hosting a phishing page impersonating a particular service. You include when you observed the activity, how you found it and how confident you are in your assessment.

You might also include related indicators or techniques that could help someone investigate further.

Suddenly, that domain becomes a whole lot more useful.

The receiving analyst has enough information to make a judgement about whether it's relevant and what to do next.

Remember to always be upfront about uncertainty, too. 

If you suspect a domain is malicious but haven't confirmed it, say so. If an indicator was associated with malicious activity a month ago, include the dates.

3. Create a simple sharing playbook

You've identified some useful intelligence.

You've checked that it's safe to share.

Now what?

"Does my manager need to approve it?"

"Can I share it directly with another analyst?"

"What happens if we eventually discover that something we've shared was incorrect?"

If your team doesn't know the answers, even straightforward sharing decisions can become pretty complicated.

This is where a simple playbook helps.

And when we say simple, we mean it.

You can start with a one-page document that answers six questions.

What can we share?

Define the types of intelligence your team is comfortable sharing, along with anything that needs to remain private.

Who needs to approve it?

Decide who can sign-off on sharing and when additional review is necessary.

What should we check first?

Establish a few basic checks for accuracy, sensitive information, source permissions and confidentiality.

Who can receive it?

Identify your trusted recipients or communities and the appropriate sharing restrictions.

How will we share it?

Document your approved channels, whether that's MISP, another sharing platform or direct communication.

What happens when something changes?

Keep a record of what you've shared and with whom, so you can communicate updates or corrections when needed.

That's a reasonable starting point.

‍

‍

Make it easy for your analysts to do the right thing

Your playbook should reflect the size of your team and the types of intelligence you're sharing.

For example, you might decide that your analysts can share certain categories of non-sensitive indicators through an established process without seeking approval each time.

Meanwhile, intelligence relating to an active incident or containing potentially sensitive information might need extra review.

The aim is to make routine decisions straightforward while giving more sensitive contributions the attention they deserve.

And don't spend months gold-plating the process.

Start with a narrow scope, test it with a few contributions and see what works.

You'll soon discover where the sticking points are, which checks are genuinely useful and what could be simplified.

Update the playbook as you learn.

4. Get to know the people you're sharing with

It's easy to think about threat intelligence sharing in terms of feeds, platforms and APIs… especially for us technical folks.

Those things are useful, particularly when you're exchanging large volumes of information.

But some of the most valuable intelligence sharing happens through conversations between analysts.

Sometimes over coffee, or at the pub after a conference, or (more often these days) in a Slack or Signal channel.

And there's a good reason for that.

You're generally more willing to share what you know when you trust the people you're sharing with.

You don't need a huge professional network

If you're starting from scratch, look for opportunities to connect with analysts working on similar problems.

Local security meetups, industry conferences, community working groups and online analyst communities are all good places to start.

You can also get more involved in communities you're already part of.

Ask questions and contribute to discussions. Share useful observations when you can.

In our podcast episode on threat sharing communities, Cosive Head of Consulting Services Prescott Pym talked about the different forms these communities can take, from informal messaging groups through to national initiatives like CTIS.

He also talks about the role of professional relationships and trust in helping analysts find and participate in sharing communities.

Some communities are relatively open. Others depend on existing members introducing or vouching for new participants.

Building genuine connections with other analysts can help you find those opportunities.

And even when those connections don't lead to a formal sharing arrangement, having people you can learn from and collaborate with is valuable in its own right.

‍

5. Pay attention to feedback (when you get it)

So you've shared your first piece of threat intelligence.

What happens next?

Well, sometimes nothing.

You might hear back immediately. You might get a response weeks later. Or you might never find out whether anyone used your intelligence at all.

That's pretty normal.

The teams receiving your intelligence are busy too. Your contribution might not be relevant to whatever’s on fire for them at the moment. Or they may have used your intel without having anything to add.

Don't let that discourage you.

And when someone does provide feedback… pay attention.

It can help you understand what's useful, what needs improving and how other analysts are applying your intelligence.

Your first contribution: here's where to start

We've covered quite a bit, so let's bring it back to something you can actually do.

Your first goal is to share one useful piece of intelligence with a sharing partner.

That's it.

Here's a practical way to approach it.

1. Find something worth sharing. Look at an investigation your team has recently completed. Is there an indicator, observation or lesson that another security team could benefit from?
2. Check that you're allowed to share it. Consider your organisation's policies, source permissions and any sensitive details that need to be removed.
3. Add some context. Explain what you observed, when you observed it, why it matters and how confident you are.
4. Choose the right recipient and channel. This might be a trusted analyst working at another organisation in your industry or an established sharing community you’re already part of.
5. Keep track of what happens next. Record what you've shared and take note of any questions, corrections or feedback.

Once you've done this a few times, you'll have a much clearer idea of what works for your team.

You might discover that certain types of intelligence are particularly useful to your community. You might identify opportunities to streamline reviews or automate repetitive tasks.

Those are good problems to work on as your sharing activity grows.

Every useful contribution makes a difference

There's a lot to gain when you share what your team knows.

Find one useful thing your team has learned. Work out who could benefit from it. And, if it's appropriate to share, pass it on.

It could save another security team hours (or potentially days) of work.

And next time, that team might be yours.

Need a hand with MISP?

If you're ready to make threat intelligence sharing a more regular part of your team's work, MISP is a good place to start.

But we also know that setting up, managing and maintaining MISP takes time, particularly when your team already has plenty on its plate.

That's where we can help.

With CloudMISP, we take care of the hosting and maintenance for you. And if you need help configuring MISP, setting up sharing communities or improving how you're using it, our MISP consulting team can work with you on the practical details.

Whether you're just getting started or looking to get more out of your existing setup, we're happy to talk through what makes sense for your team.

‍