## Traffic Light Protocol (TLP)

Intelligence is useless if not shared, but dangerous if shared too widely. The **Traffic Light Protocol (TLP)** is the global standard for defining "Who can see this?"

It was updated to TLP 2.0 in 2022.

---

### TLP Levels

#### 🔴 TLP:RED (For Your Eyes Only)
*   **Definition**: Not for disclosure, restricted to participants only.
*   **Scenario**: A partner sends you a list of compromised employees involved in an internal investigation.
*   **Action**: You cannot share this with *anyone* outside the specific meeting/email thread. Not even your boss, unless they were named.

#### 🟠 TLP:AMBER (Limited Disclosure)
*   **Definition**: Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients.
*   **Scenario**: A vendor tells you about a vulnerability in their software that is actively exploited but no patch exists yet.
*   **Action**: You can tell your System Admins to block the port. You CANNOT write a blog post about it.
*   **TLP:AMBER+STRICT**: New in 2.0. Means "Organization Only" (No clients).

#### 🟢 TLP:GREEN (Community Wide)
*   **Definition**: Limited disclosure, restricted to the community.
*   **Scenario**: An industry ISAC (e.g., Financial-ISAC) shares a list of Phishing domains targeting banks.
*   **Action**: You can share this with partner organizations and peers. You CANNOT publish it on public Twitter.

#### ⚪ TLP:CLEAR (Public)
*   **Definition**: Subject to standard copyright rules, otherwise unrestricted.
*   **Scenario**: A published whitepaper on APT29.
*   **Action**: Post it on LinkedIn, print it, shout it from the rooftops.

---

### Sharing Standards: STIX & TAXII
How do we share this data technically?

1.  **STIX (Structured Threat Information Expression)**: The **Language**.
    *   It is a JSON format.
    *   It defines objects like `Attack Pattern`, `Identity`, `Malware`, `Indicator`.
2.  **TAXII (Trusted Automated eXchange of Intelligence Information)**: The **Transport**.
    *   It is the API (HTTPS) that carries the STIX packages.
    *   Think of STIX as the package and TAXII as the delivery truck.