Add a min_tlp value in Cortex

Add a min_tlp value in Cortex alongside max_tlp. to control what the minimum tlp level is for an analyzer to run.

Request Type

Feature Request

Work Environment

Problem Description

We have internal Cortex instances and external Cortex instances. When we add external observables we want those to be sent to the external Cortex instance for analysis by 3rd party threat Intel providers. When we add an internal IP we want that to be sent to the internal Cortex instance and not to external.

We've set the TLP values on the observables as per the guidance. An external IP is set to tlp:green. An internal IP seen is set to tlp:red. When we set the SecurityCenter max_tlp to red, external IP's get accepted by the analyzer. When we set the max_tlp on the analyzer to white, external IP's aren't accepted but also internal IP's aren't accepted either.

What we want to do is set the min_tlp of the SecurityCenter analyzer (and other internal analyzers too) to have a min_tlp:red so that it will only accept observables with a tlp:red (essentially internal observables we don't want to share).

Steps to Reproduce

Enable SecurityCenter Analyzer.
Create a case, and an an external IP as an observable. Set the TLP to red as you don't want to share this externally.
Run the SecurityCenter analyzer. It attempts to scan the external target.

Possible Solutions

Create a min_tlp value for analyzers get the analyzers to respect that.

Start by tracing how the SecurityCenter analyzer and other analyzers read and enforce max_tlp during observable analysis. Compare the reported external and internal observable cases, then identify the analyzer configuration and execution points involved; done means the requested minimum TLP behavior is defined and verified for those cases.