The Publish Feature

Last Updated: Sep 10, 2019 10:23AM EDT
Sharing Administrator and Community Director
A Group that has exists in or has been contributed to a Community or Source


The Publish feature in ThreatConnect® packages intelligence in the form of Group data objects and writes it to a JSON file. It is a necessary step in the process of sharing the data with users on other instances of the platform. See The Cross-Intel Sharing App: Sharing Data Across ThreatConnect Instances for information about how to share published data with other ThreatConnect instances. The following Group types can be published: Adversary, Campaign, Document, E-mail, Event, Incident, Intrusion Set, Report, Signature, and Threat. In order to publish a Group, it must first exist in, or be contributed to, a Community or Source. See Contributing to a Community or Source for more details.

Publishing a Group

  1. Navigate to the Sharing tab of the Details Screen for the Group (E-mail in this example) within the Community or Source to which it exists or was contributed (Figure 1).
  2. Click the PUBLISH… button. The Publish Intel window will be displayed, with the Initial screen selected (Figure 2).
  3. The Initial screen provides a brief summary of the information that is to be published for cross-instance sharing. Click the Next button, and the Security Labels screen will be displayed (Figure 3).
  4. Use the dropdown menu to choose Security Labels to exclude. Click the Next button, and the Save screen will be displayed (Figure 4).
  5. The Save screen lists the associated Groups that will be published along with the original Group.
  6. Click the PUBLISH button. The Sharing tab of the Details screen for the Group will be displayed again, showing a table providing details about the JSON file to which the Group was published (Figure 5).
  7. NOTE: A Group can also be published at the same time that it is being contributed to a Community or Source by checking the Publish after Copy box on the Save Screen of the Contribute to Community/Source dialog box.

  8. Once a Group has been published, it can be shared across instances via the TC Cross-Intel Sharing app. See The Cross-Intel Sharing App: Sharing Data Across ThreatConnect Instances for more information.

NOTE: Changes that are made to a Group after it has been published will not be reflected in the JSON file. The Group will need to be published again in order to capture any changes that occur after its publication.

20060-01 EN Rev. F

Contact Us

  • ThreatConnect, Inc.
    3865 Wilson Blvd.
    Suite 550
    Arlington, VA 22203

    Toll Free:   1.800.965.2708
    Local: +1.703.229.4240
    Fax +1.703.229.4489

    Email Us
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
Invalid characters found