Simple Explination of Share Levels

[KazpaJosh]

I have read all the documentation, and have a test environment for MineMeld, but I still cant work out what share levels are being used for.

I was of the beleif that it was green=good (i.e. whitelist these) and red=bad (i.e. block these) however this doesnt seem to be the case in most the current prototypes.

@lmori Said the following, but I am not quite processing what this entails if it is different from my above belief: "This attribute is added to the indicator by the Miner to signal to other nodes in the graph the target audiance of the indicator, similar to the Traffic Light Protocol. Typically this is used by input filters in Output nodes." - https://live.paloaltonetworks.com/t5/MineMeld-Discussions/About-Share-Level/m-p/77537/highlight/true...

A simple explination of what share levels are indicating would be much appreciated.

[lmori · Accepted solution]

Hi @KazpaJosh,

share_level is just a tag associated to an indicator to be used for filtering in the output feeds to avoid human errors in sharing with 3d parties. It is used to represent the confidentiality of an indicator. Typical rules:

- indicators from OSINT are marked with share_level green

- indicators from commercial Threat Intelligence vendor or TIP are marked with red

- indicators from syslog Miner are marked with red

Hope this gives a better idea on the meaning of share_level, if not let me know 🙂

[KazpaJosh]

Makes perfect sense! Thankyou!

[jgramke]

So, what is yellow for?