Innomerc Choose your depth. Learn at your own pace.
Understand it
Sharing intelligence is a decision about recipients, sensitivity and purpose. MISP distribution settings and sharing groups help control recipients. Handling labels communicate expectations, but a label alone is not a technical permission boundary.
A sighting records an observation or feedback associated with an attribute. A correlation connects matching or related information. Both can improve context without proving that the information is malicious.
Under the hood
Event and attribute distribution can affect visibility and propagation. Sharing groups define a community of recipients. Synchronization connects instances under configured trust relationships, so test the resulting visibility rather than assuming a label prevents onward sharing.
Sightings can support confidence and aging decisions. Positive observations, false-positive feedback and expiration-related information require consistent interpretation. Repeated observations of shared infrastructure may increase volume without increasing certainty.
Practitioner perspective
Agree on permitted use, retention and redistribution with sharing partners. Review exports and synchronization accounts for least privilege. Information that leaves the instance may no longer be retractable from every downstream system.
Use controlled test events to verify that intended recipients receive the right fields and others do not. Keep a process for corrections and indicator retirement. Trust in a source is useful context, but each high-impact action still needs its own risk decision.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Observation
The analyst records evidence and its sensitivity.
Read every step without animation
Policy-aware sharing
- Observation. The analyst records evidence and its sensitivity.
- Distribution. Recipients are restricted under the sharing policy.
- Partner receives. Only permitted information is sent to the partner.
- Sighting feedback. The partner reports relevant observations or false positives.
- Review. The originator updates context and usefulness.
Sharing and feedback require explicit policy at both ends.
Attack view
An event marked with a handling label is exported too broadly because distribution was not restricted. The visual separates the label from the access decision.
Defender view
- Set distribution and sharing groups deliberately.
- Validate synchronization and export behavior with non-sensitive test data.
- Incorporate false-positive feedback and retirement into downstream workflows.
Common mistakes
- A handling tag is not the same as an enforced sharing boundary.
- Repeated sightings do not automatically prove maliciousness.
Check your understanding
Active recall: explain this idea in 30 seconds
Sharing intelligence is a decision about recipients, sensitivity and purpose. MISP distribution settings and sharing groups help control recipients. Handling labels communicate expectations, but a label alone is not a technical permission boundary.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.