Indicator sharing
Share reviewed indicators across Guard while controlling provenance, disclosure, withdrawal, and local exceptions.
Indicator sharing distributes reviewed indicators across the Guard customer network. It shares threat identifiers and approved context, not incident attachments, raw employee telemetry, or customer credentials.
Submit and review
An Administrator enables participation at Intelligence → Sharing → Participation. A user with the intelligence contribution grant opens Intelligence → Indicators → Submit, enters the indicator type and value, confidence, validity interval, reason, and a non-sensitive provenance note. Submission enters review; it is not immediately distributed or promoted to a blocking rule.
Remove customer names, internal hostnames, personal identifiers, access tokens, and private URL parameters before submission. Do not submit a private document as a hash indicator merely to transfer it to another organization. Attach supporting evidence only to the local incident under its evidence permissions.
The security team reviews validity and distribution eligibility. Intelligence → Sharing → Submissions shows pending, accepted, rejected, or withdrawn, with the review reason. Acceptance does not mean every recipient blocks the indicator; each organization chooses its enforcement policy.
Consume and withdraw
Received indicators show their shared-network provenance, confidence, and expiry. Keep local exceptions scoped to the affected service or endpoint. A global allow rule can suppress unrelated future observations.
For an incorrect contribution, open Sharing → Submission → Request withdrawal, explain the correction, and use a local exception if immediate relief is required. Withdrawal updates subsequent feed versions; already delivered records and historical detections remain in recipients' retained history. It cannot retract an export previously downloaded by a recipient.
Disabling participation stops new local contributions and consumption of the shared source according to the selected feed policy. It does not remove separately licensed curated feeds. Verify source status under Intelligence → Feeds and use audit records to review contribution and withdrawal decisions.