topic Re: Simple Explination of Share Levels in General Topics

Simple Explination of Share Levels

KazpaJosh — Wed, 07 Dec 2016 06:20:31 GMT

I have read all the documentation, and have a test environment for MineMeld, but I still cant work out what share levels are being used for.

I was of the beleif that it was green=good (i.e. whitelist these) and red=bad (i.e. block these) however this doesnt seem to be the case in most the current prototypes.

@lmori Said the following, but I am not quite processing what this entails if it is different from my above belief: "This attribute is added to the indicator by the Miner to signal to other nodes in the graph the target audiance of the indicator, similar to the Traffic Light Protocol. Typically this is used by input filters in Output nodes." - https://live.paloaltonetworks.com/t5/MineMeld-Discussions/About-Share-Level/m-p/77537/highlight/true#M102

A simple explination of what share levels are indicating would be much appreciated.

Re: Simple Explination of Share Levels

lmori — Wed, 07 Dec 2016 12:19:58 GMT

Hi @KazpaJosh,

share_level is just a tag associated to an indicator to be used for filtering in the output feeds to avoid human errors in sharing with 3d parties. It is used to represent the confidentiality of an indicator. Typical rules:

- indicators from OSINT are marked with share_level green

- indicators from commercial Threat Intelligence vendor or TIP are marked with red

- indicators from syslog Miner are marked with red

Hope this gives a better idea on the meaning of share_level, if not let me know 🙂

Re: Simple Explination of Share Levels

KazpaJosh — Thu, 08 Dec 2016 22:33:56 GMT

Makes perfect sense! Thankyou!

Re: Simple Explination of Share Levels

jgramke — Fri, 07 Dec 2018 03:56:44 GMT

So, what is yellow for?