# For CERTs, ISACs & sector bodies

> Threat intelligence for CERTs, ISACs and sector bodies: two-way MISP and TAXII, vetted sharing groups, constituent tenants and a feed quality scorecard.

Source: https://wahukeza.com/solutions/cert

Solutions · CERTs, ISACs & sector bodies

## Standards in, standards out. Sovereign in the middle.

Keep MISP. Keep TAXII. Add a platform that runs on your ground, gives each constituent an isolated tenant, runs vetted sharing groups for your sector, and computes a quality scorecard you can show your members.

[Talk to us](https://wahukeza.com/contact?intent=cert)

[Sector sharing groups](https://wahukeza.com/platform/exchange#groups)

Interoperability

## We are the operating layer above the standard, not a replacement for it.

-   MISP feed · MISP REST
    
    ### MISP both ways
    
    Ingest any MISP manifest or event feed; publish a pullable MISP feed; push to and pull from a member’s MISP over its REST API, mapped to a MISP sharing group.
    
-   /taxii2
    
    ### TAXII 2.1 server, client and inbox
    
    Serve collections (including sector and group collections), pull from any TAXII 2.1 root, and accept STIX bundles into a group’s inbox.
    
-   STIX 2.1-native
    
    ### STIX as the data model
    
    Campaigns, intrusion sets, actors, attack patterns, identities and markings are first-class; bundles round-trip.
    
-   TLP
    
    ### Markings enforced
    
    TLP is checked at every dispatcher and export. A TLP:RED object cannot leave in a feed; between instances, TLP:AMBER is shared only inside a group.
    

Constituents as tenants

## One instance. A database per member.

Each constituent gets an isolated tenant (its own database, jobs, users and reports) under an operator control plane that never queries across them. Cross-member sharing happens only through the exchange and its sharing groups, signed and scoped.

[The tenancy model in detail](https://wahukeza.com/solutions/mssp)

group · me-banks · TLP:AMBER5 members · 1 reader

-   bank-a
    
    member · contributes · receives
    
-   bank-b
    
    member · contributes · receives
    
-   bank-c
    
    steward · may retract
    
-   central-bank
    
    reader · receives only
    

Illustrative group. Signed terms per member, allowlist gate, poisoning counters per contributor.

Sharing groups

## Vetted communities, run by whoever holds the mandate.

-   vetted
    
    ### Membership you verify
    
    The hive operator admits each member after out-of-band verification and a recorded acceptance of the group’s terms. A CERT, an ISAC or a central bank can run the hive itself.
    
-   member · steward · reader
    
    ### Roles that match a sector
    
    Members contribute and receive; stewards can retract any observation; readers (a central bank, a supervisor, a national CERT) consume and never contribute.
    
-   attributed · anonymised
    
    ### Per-group identity
    
    Each group decides whether deliveries name the contributing member or only the group. Group data never enters the community or public feeds and is never re-shared.
    
-   DORA Art. 45
    
    ### The paperwork, generated
    
    Group terms are hashed and accepted per member, and the Art. 45 membership notice a financial entity gives its competent authority is rendered in English and Montenegrin.
    

Why a sector body

## Credibility per logo, and the architecture to deserve it.

-   ### Sovereign by where it runs
    
    Self-hosted on national or institutional infrastructure; no call-home; AI local, your own key, or off.
    
-   ### A feed members can audit
    
    The first-party feed’s corroboration, uniqueness and collision rates are computed daily with history, ready for you to publish.
    
-   ### Data protection built in
    
    DSAR export and erasure, records of processing, retention knobs, a breach-response runbook. For a body that handles other people’s incidents.
    
-   ### Sensors where the sector is
    
    Device personas that match sector estates (routers, firewalls, cameras, VPN gateways) deployed on small hardware at member sites.
    
-   ### Stated plainly
    
    Groups are formed by the hive operator, not self-service. MISP push/pull and the TAXII inbox are covered by the platform’s test suites; we prove the mapping against your own MISP in the pilot.
    
-   ### Standards-first reporting
    
    Scheduled per-member reports and STIX exports for whoever the member reports to.
    

## Bring your MISP and your mandate.

We will connect an existing MISP, stand up two member tenants and a reader in a sharing group, and show a TLP:AMBER delivery between them in one session.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[Evidence for regulators](https://wahukeza.com/solutions/compliance)