Lion Cipher Lab
Mark and share threat intel with TLP 2.0 (and enforce it in STIX)
- Threat Intel Analyst
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Threat intelligence is only useful when it is shared — and dangerous when it is shared too far. The moment your team writes up an incident, an indicator, or a partner's confidential tip, someone has to decide who is allowed to see it: everyone, your trust community, only people inside your organisation, or a single named recipient. For decades that decision travelled as a word in an email subject line or a colour stamped on a PDF, and it leaked constantly, because a human forwarding forty items at 2 a.m. cannot reliably eyeball forty handling decisions. The Traffic Light Protocol (TLP),…
What you'll learn
- defining the Traffic Light Protocol (TLP) and stating precisely what each TLP 2.0 label permits for redistribution: CLEAR (no limits), GREEN (community), AMBER (need-to-know within your org and its clients), AMBER+STRICT (your org only), RED (named recipients only)
- explaining the 2022 TLP 1.0 -> 2.0 change: WHITE was renamed CLEAR and AMBER+STRICT was added, and why that matters when you read older markings
- encoding a handling decision machine-readably as a STIX 2.1 marking-definition object and attaching it to intel with object_marking_refs, instead of typing a colour into an email subject line
- building a deterministic Python 'release gate' (stdlib json only) that reads the markings on every object in a bundle and ALLOWS or BLOCKS each one against a chosen threshold, so TLP:AMBER/RED can never leave an outbound feed by accident
- measuring the before/after: an unmarked bundle a human has to eyeball (and over-shares TLP:RED) versus a marked bundle where the gate blocks the restricted items automatically and prints its allow/block reasoning
- being honest about the legacy-vs-2.0 STIX gap: the four predefined STIX TLP markings are TLP 1.0, TLP 2.0 markings come from FIRST-published definitions, and why keying the gate on the human-readable TLP name keeps it correct either way
- judgment: knowing TLP is a HANDLING convention that recipients must honour, not encryption or access control, and that it does not classify content sensitivity — so it must be paired with a data-classification scheme
Steps in this lab
- What TLP 2.0 is, and exactly what each label permits
- The 2022 change: TLP 1.0 -> 2.0 (WHITE became CLEAR, AMBER+STRICT was added)
- BEFORE: an unmarked bundle a human has to eyeball (and over-shares)
- Encode the handling: STIX 2.1 marking-definition + object_marking_refs
- AFTER: build a release gate that BLOCKS anything above your threshold
- Do it better — the judgment, and the honest limits of TLP