The Publish feature in ThreatConnect® packages intelligence in the form of Group data objects and writes it to a JSON file. It is a necessary step in the process of sharing the data with users on other instances of the platform. See The Cross-Intel Sharing App: Sharing Data Across ThreatConnect Instances for information about how to share published data with other ThreatConnect instances. The following Group types can be published: Adversary, Campaign, Document, E-mail, Event, Incident, Intrusion Set, Report, Signature, and Threat. In order to publish a Group, it must first exist in, or be contributed to, a Community or Source. See Contributing to a Community or Source for more details.
Publishing a Group
- Navigate to the Sharing tab of the Details Screen for the Group (E-mail in this example) within the Community or Source to which it exists or was contributed (Figure 1).
- Click the PUBLISH… button. The Publish Intel window will be displayed, with the Initial screen selected (Figure 2).
- The Initial screen provides a brief summary of the information that is to be published for cross-instance sharing. Click the Next button, and the Security Labels screen will be displayed (Figure 3).
- Use the dropdown menu to choose Security Labels to exclude. Click the Next button, and the Save screen will be displayed (Figure 4).
- The Save screen lists the associated Groups that will be published along with the original Group.
- Click the PUBLISH button. The Sharing tab of the Details screen for the Group will be displayed again, showing a table providing details about the JSON file to which the Group was published (Figure 5).
- Once a Group has been published, it can be shared across instances via the TC Cross-Intel Sharing app. See The Cross-Intel Sharing App: Sharing Data Across ThreatConnect Instances for more information.
NOTE: A Group can also be published at the same time that it is being contributed to a Community or Source by checking the Publish after Copy box on the Save Screen of the Contribute to Community/Source dialog box.
NOTE: Changes that are made to a Group after it has been published will not be reflected in the JSON file. The Group will need to be published again in order to capture any changes that occur after its publication.