Solutions · CERTs, ISACs & sector bodies
Standards in, standards out. Sovereign in the middle.
Keep MISP. Keep TAXII. Add a platform that runs on your ground, gives each constituent an isolated tenant, runs vetted sharing groups for your sector, and computes a quality scorecard you can show your members.
Interoperability
We are the operating layer above the standard, not a replacement for it.
MISP feed · MISP REST
MISP both ways
Ingest any MISP manifest or event feed; publish a pullable MISP feed; push to and pull from a member’s MISP over its REST API, mapped to a MISP sharing group.
/taxii2
TAXII 2.1 server, client and inbox
Serve collections (including sector and group collections), pull from any TAXII 2.1 root, and accept STIX bundles into a group’s inbox.
STIX 2.1-native
STIX as the data model
Campaigns, intrusion sets, actors, attack patterns, identities and markings are first-class; bundles round-trip.
TLP
Markings enforced
TLP is checked at every dispatcher and export. A TLP:RED object cannot leave in a feed; between instances, TLP:AMBER is shared only inside a group.
Constituents as tenants
One instance. A database per member.
Each constituent gets an isolated tenant (its own database, jobs, users and reports) under an operator control plane that never queries across them. Cross-member sharing happens only through the exchange and its sharing groups, signed and scoped.
bank-a
member · contributes · receives
bank-b
member · contributes · receives
bank-c
steward · may retract
central-bank
reader · receives only
Sharing groups
Vetted communities, run by whoever holds the mandate.
vetted
Membership you verify
The hive operator admits each member after out-of-band verification and a recorded acceptance of the group’s terms. A CERT, an ISAC or a central bank can run the hive itself.
member · steward · reader
Roles that match a sector
Members contribute and receive; stewards can retract any observation; readers (a central bank, a supervisor, a national CERT) consume and never contribute.
attributed · anonymised
Per-group identity
Each group decides whether deliveries name the contributing member or only the group. Group data never enters the community or public feeds and is never re-shared.
DORA Art. 45
The paperwork, generated
Group terms are hashed and accepted per member, and the Art. 45 membership notice a financial entity gives its competent authority is rendered in English and Montenegrin.
Why a sector body
Credibility per logo, and the architecture to deserve it.
Sovereign by where it runs
Self-hosted on national or institutional infrastructure; no call-home; AI local, your own key, or off.
A feed members can audit
The first-party feed’s corroboration, uniqueness and collision rates are computed daily with history, ready for you to publish.
Data protection built in
DSAR export and erasure, records of processing, retention knobs, a breach-response runbook. For a body that handles other people’s incidents.
Sensors where the sector is
Device personas that match sector estates (routers, firewalls, cameras, VPN gateways) deployed on small hardware at member sites.
Stated plainly
Groups are formed by the hive operator, not self-service. MISP push/pull and the TAXII inbox are covered by the platform’s test suites; we prove the mapping against your own MISP in the pilot.
Standards-first reporting
Scheduled per-member reports and STIX exports for whoever the member reports to.
Bring your MISP and your mandate.
We will connect an existing MISP, stand up two member tenants and a reader in a sharing group, and show a TLP:AMBER delivery between them in one session.