## Intelligence Dissemination\n\n### Dissemination Channels\n\n| Channel | Use Case | TLP |\n|---------|----------|-----|\n| **Email** | Reports, advisories | All |\n| **TIP Portal** | IOCs, events | AMBER/GREEN |\n| **TAXII Feed** | Automated sharing | GREEN/CLEAR |\n| **SIEM Integration** | Detection rules | N/A |\n| **Slack/Teams** | Flash alerts | RED/AMBER |\n| **ISAC Portal** | Sector sharing | AMBER/GREEN |\n\n### Stakeholder Matrix\n\n```\n┌──────────────┬──────────────┬──────────────┬──────────────┐\n│              │  Strategic   │ Operational  │   Tactical   │\n├──────────────┼──────────────┼──────────────┼──────────────┤\n│ Executives   │     ✅       │      ○       │      ✗       │\n│ Sec Managers │     ✅       │     ✅        │      ○       │\n│ SOC Analysts │     ○        │     ✅        │     ✅        │\n│ IT Ops       │     ✗        │      ○       │     ✅        │\n│ Red Team     │     ○        │     ✅        │     ✅        │\n└──────────────┴──────────────┴──────────────┴──────────────┘\n✅ = Primary recipient  ○ = FYI  ✗ = Not applicable\n```\n\n### Automated Dissemination\n\n**SIEM Integration**:\n- Push IOCs to SIEM for correlation\n- Create detection rules from TTPs\n- Alert on matches\n\n**EDR Integration**:\n- Push file hashes for blocking\n- Behavioral indicators\n\n**Firewall/Proxy**:\n- Block malicious IPs/domains\n- URL categories\n\n### Feedback Collection\n\nComplete the intelligence cycle:\n\n```\n1. Send intel to consumers\n         ↓\n2. Track delivery/read rates\n         ↓\n3. Collect feedback surveys\n         ↓\n4. Measure action taken\n         ↓\n5. Refine future products\n```