Anomali for ISACs: Share Threat Intelligence Across Your Sector

ISACs were created under U.S. Presidential Directive 63 in 1998 to move threat information across a sector faster than any single organization could manage alone. In 2015 the model widened into ISAOs, opening the same structure to any region, subsector, or affinity. The mission has held steady. The mechanics are where sharing programs stall: a parent organization curates intelligence, but its members run different tools, carry different skill levels, and work under different budgets, so distributing vetted intelligence to all of them, and collecting submissions back, becomes the hard part.

‍

What an ISAC needs from a sharing platform

‍

An ISAC coordinator sits between many intelligence sources and many members who each consume intelligence differently. The platform has to let the parent collect and curate once, then push finished intelligence out to every member and take submissions back, without requiring each member to buy and run a full enterprise stack. Bi-directional sharing, membership tiers, and a low barrier to entry for members are what decide whether a sharing program runs or stalls.

‍

How Anomali Community Edition works

‍

Anomali Community Edition gives a parent organization the rights and means to share curated intelligence with member organizations, built on ThreatStream Trusted Circles. The parent collects and curates intelligence in ThreatStream Next-Gen with full platform capabilities, then distributes finished intelligence downstream through bi-directional TAXII. Members work from a focused portal: unlimited user accounts, a dashboard for searching and alerting, normalized and deduplicated feeds, standard threat models including MITRE ATT&CK and the Diamond Model, and manual export to STIX. Members do not have to be ThreatStream customers, and a program can add members in bundles as it grows.

‍

The structure covers dedicated sector ISACs across healthcare, financial services, energy, and elections infrastructure, managed security providers that resell intelligence to clients, holding companies sharing with subsidiaries, and short-term coalitions formed around high-profile events. State and local governments use it to tailor intelligence for local, tribal, and territorial agencies. Maryland's ISAC used the approach to act on threats to state agencies before they took hold.

‍

Read the solutions brief

‍

The solutions brief Anomali for ISACs maps the Community Edition architecture, the full member-versus-parent feature comparison, and the licensing model for standing up a sector sharing program.

‍