Configure Sharing Options
After adding alert details, configure the Sharing Options to define how the alert is shared, delivered, and handled by recipients. You can select recipients, enable push notifications, share the alert with integrated applications, add special handling instructions, and apply restrictions. These settings ensure the alert reaches the right audience through the appropriate channels.
Recipients are users who receive alerts created by analysts. Adding recipients is a mandatory step during alert creation. As an analyst, you can categorize members into different recipient groups for targeted sharing of alerts. For example, if there is a malware threat that is relevant to the finance team in your organization, you can configure the finance team as a recipient group and send an alert to them. A member can be associated with multiple recipient groups.
Before you Start
Ensure that you have configured recipient groups. For more information, see Recipient Group.
Steps
To add recipients to alerts, follow these steps:
In the alert creation form, click Sharing Options and go to the Recipients section.
Note
Send alerts to recipient groups, individual recipients, or both, based on your preference.
To add the alert recipients, use the following information:
Recipient Groups: Analysts can send an alert to multiple recipient groups at the same time. You can use the dropdown to add recipient groups or use one of the following methods:
By Groupset: Select a groupset to add the associated recipient groups. Groupsets allow the association of multiple recipient groups as a collection. To create a groupset, see Create Groupsets for Recipient Groups.
By Traffic Light Protocol (TLP): Select a TLP value to add the associated recipient groups. Recipient groups are associated with a TLP classification to ensure that the alert information is rightly shared with the intended recipients.
Note
Based on the TLP you select in the Basic Information section (Enter Basic Information), you can choose the corresponding TLP for the recipient groups. For example, if you choose TLP WHITE in the Basic Information section, you can share the alert with RED, AMBER, GREEN, and WHITE recipient groups. However, if you choose TLP RED in the Basic Information section, you can only share the alert with RED recipient groups.
By Group Type: Select a type to add the associated recipient groups. There are three types of recipient groups namely Public Groups, Invite-only Groups, and System Groups. For more information, see Recipient Group.
Individual Users: Add individual users by their email addresses to send alerts to individual recipients.
Show Additional Settings: Filter recipients based on location and organization from the added recipient groups. You can filter recipients only if you choose a recipient group or individual recipients. Use the following information to filter recipients:
Locations: Select a country or region to send the alert to members operating from the specific geographic location. Configure member locations in Member Settings.
Organizations: Select an organization or organization type to send the alert to members operating from the specific organization or sector. Configure member organizations in Member Settings.
If you have added Threat Assessment or Recommended Actions in Additional Information, choose the recipients who should have access to them. The list is displayed based on your recipient selection.
Threat Assessment: Select recipients who will receive and assess the threat assessment for the alert.
Recommended Actions: Select recipients who need to take follow-up actions based on the alert details. If multiple recommended actions are added, each action appears with its title in parentheses. You can assign different recipients to each action.
Configure preferences to send push notifications for the alert and initiate notifications for mobile and email alerts. You can configure push notifications only if you choose a recipient group or individual recipients.
In the alert creation form, click Sharing Options, go to the Push Notifications section, and use the following information:
Turn on the Push Notifications toggle to send mobile and email notifications for the alert. You can also select the notification type (Email and Mobile) for specific recipient groups and individual recipients added to the alert.
If you do not enable push notifications, the alert will be published without notifying recipients. This disables all notifications for the alert, regardless of other notification configurations. For example, channel-specific push notifications enabled by members get disabled for the alert.
You can post an alert you create in the Collaborate Analyst Portal to Intel Exchange, MISP, Flexera, and other supported applications.
Before you Start
Ensure that you have integrated the supported applications with Collaborate. For more information, see Manage Integrations.
Steps
To post the alert to other applications, follow these steps:
In the alert creation form, click Sharing Options.
Go to Post to Other Apps and select the checkbox for the applications you want to post the alert to.
Analysts can attach special handling flags to alerts to share priority alerts with members, allowing them to stand out from regular alerts. For example, you can create a special handling flag named Top Secret to share alerts containing confidential information with the member. Recipients of the alert can view special handling instructions in the footer section of the email alert.
Before you Start
Ensure that you have configured special handling instructions. For more information, see Special Handlings.
Steps
To post the alert to other applications, follow these steps:
In the alert creation form, click Sharing Options.
Go to Special Handling Instructions and select the special handling instructions you want for the alert.
As an analyst, you can configure restrictions and options to manage how an alert is shared, scheduled, and handled. These settings help control access, distribution, and the alert's lifecycle based on your requirements.
Steps
To configure the restrictions and alert options, follow these steps:
In the alert creation form, click Sharing Options.
Go to Restrictions & Alert Options and use the following information:
Allow recipients to export this alert: Select the checkbox to allow members to export this alert for offline analysis.
Allow export as PDF: Select the checkbox to export the alert as a PDF for offline analysis.
Schedule this alert to be published on a specific date/time: Select the checkbox to set a date and time for publishing the alert.
Repeat this alert multiple times: Select the checkbox to repeat the alert between specified intervals. You cannot select this checkbox if you have previously selected the checkbox to self-destruct the alert.
Self-destruct this alert from the user's devices and from the server: Select the checkbox to self-destruct an alert after a specific time. You cannot select this checkbox if you have selected the checkbox to expire the alert. This will remove the alert from Collaborate Member Portal and Cyware Enterprise mobile app. For example, if the alert information is going to be redundant after a time period, you can choose to self-destruct the alert.
In the Analyst Portal, the alerts display page shows the alert with the title Self Destructed. You can no longer view alert details such as summary, category, and other alert details. However, you can still view details like the date and time of self-destruction.
Schedule this alert to be expired on a specific date/time: Select the checkbox to expire the alert after a specific time. You cannot select this checkbox if you have previously selected the checkbox to self-destruct the alert. After an alert has expired, it cannot be edited or published. Analysts can view it as an expired alert, but the alert is deleted in the Member Portal. Unlike a self-destructed alert, you can still see all the details of an expired alert, such as summary, category, and other details in the Analyst Portal. For more information about expired alerts, see Expire Alerts.
Send Email to Publisher: Select the checkbox to send an email of the published alert to the publisher. By default, this option is mapped to TLP Controls > Send Email to Publisher in Alert Settings. To configure this setting in TLP Controls, see Alert Settings.
Note
In TLP Controls, for each TLP, the administrator can choose if an email notification is sent to publishers. Your selection in the Restrictions & Alert Options overrides the selection defined in TLP Controls
Publishers (optional): Select the publishers to whom the alert is submitted for review. Publishers review alerts and publish them to the recipients. The list of publishers displayed depends on the category selected for the alert. Publishers can only review alerts based on the categories assigned to their role. After the alert is published, you can view the publisher names in Alert Details of the alert. If you only have Creator permissions, you have to submit the alert to a publisher for review.
Next Steps
After configuring Sharing Options, click Preview to preview the alert and then click Publish to publish the alert and send it to the selected recipients. If you have creator permissions, submit the alert to a publisher for review by clicking Submit to Publisher. If you are a publisher, see Publish Alerts.