---
title: "The Publish Feature | ThreatConnect"
slug: "the-publish-feature"
description: "This article describes how to publish a Group in a JSON file so that you may share it with users on other instances of ThreatConnect via the Cross-Intel Sharing App."
tags: ["Data Sharing and Collaboration"]
updated: 2024-09-11T16:12:43Z
published: 2024-09-11T16:12:43Z
canonical: "knowledge.threatconnect.com/the-publish-feature"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Publish Feature

## Overview

The Publish feature in ThreatConnect® packages intelligence in the form of [Group](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model) data objects and writes it to a JSON file. It is a necessary step in the process of sharing the data with users on other instances of ThreatConnect via the [Cross-Intel Sharing App](https://knowledge.threatconnect.com/docs/the-cross-intel-sharing-app-sharing-data-across-threatconnect-instances). When a Group is published, the following objects will be included in the corresponding JSON file (unless they are excluded via a Security Label:

- Associated [Indicators and Groups](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model)
- [Security Labels](https://knowledge.threatconnect.com/docs/applying-security-labels) applied to the Group
- [Attributes](https://knowledge.threatconnect.com/docs/creating-attributes) added to the Group
- [Tags](https://knowledge.threatconnect.com/docs/applying-tags) applied to the Group

The following Group types can be published: Adversary, Attack Pattern, Campaign, Course of Action, Document, E-mail, Event, Incident, Intrusion Set, Malware, Report, Signature, Tactic, Threat, Tool, and Vulnerability. In order to publish a Group, it must first exist in, or be [contributed to, a Community or Source](https://knowledge.threatconnect.com/docs/contributing-a-group-to-a-community-or-source).

NoteIf a System Administrator has enabled publishing from Organizations, Organization Administrators may publish Groups that exist in their Organization without needing to contribute them to a Community or Source (i.e., they can publish Groups directly from their Organization).

| Minimum Role(s) | Community role of Contributor, Editor, or Director |
| --- | --- |
| Prerequisites | A Group that has exists in or has been contributed to a Community or Source |

## Publishing a Group

1. [Navigate to the legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for a Group that exists in or has been contributed to a Community or Source.
2. Click the **Sharing**tab. The **Sharing**screen will be displayed (Figure 1).  
NoteThe **Sharing**tab is available only on the legacy **Details**screen.

![Figure 1_The Publish Feature_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_The%20Publish%20Feature_7.0.0.png)
3. Click the **PUBLISH…** button. The **Initial**screen of the **Publish Intel**window will be displayed (Figure 2). This screen provides a summary of the Group that is to be published for cross-instance sharing.

![Graphical user interface, application, Teams Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_The%20Publish%20Feature_7.0.0.png)
  - Click the **Next** button.
4. The **Security Labels**screen will be displayed (Figure 3).

![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_The%20Publish%20Feature_7.0.0.png)
  - **Excluded Security Labels**: Select Security Labels to exclude. Any associated objects and Attributes with the selected Security Labels applied to them will not be included in the published JSON file.
  - Click the **Next** button.
5. The **Save**screen will be displayed (Figure 4). This screen lists the Group and associated Groups that will be published.

![Graphical user interface, text, website Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_The%20Publish%20Feature_7.0.0.png)
  - Click the **PUBLISH** button.

The **Sharing**tab of the Group's legacy **Details** screen will be displayed again, with the newly created JSON file listed in the **Published in:**table at the bottom of the screen (Figure 5). Once a Group has been published, it—and its associated Indicators and Groups, Security Labels, Attributes, and Tags—can be [shared across instances via the ThreatConnect Cross-Intel Sharing App](https://knowledge.threatconnect.com/docs/the-cross-intel-sharing-app-sharing-data-across-threatconnect-instances).

![Timeline Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_The%20Publish%20Feature_7.0.0.png)

NoteA Group can also be published at the same time that it is being [contributed to a Community or Source](https://knowledge.threatconnect.com/docs/contributing-a-group-to-a-community-or-source) by selecting the **Publish after Copy** checkbox on the **Save** screen of the **Contribute to Community/Source** window.ImportantChanges that are made to a Group after it has been published will not be reflected in the JSON file. The Group will need to be published again in order to capture any changes that occur after its publication.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20060-01 v.03.D

## Related

- [Contributing to a Community or Source](/contributing-to-a-community-or-source.md)
- [The Cross-Intel Sharing App: Sharing Data Across ThreatConnect Instances](/the-cross-intel-sharing-app-sharing-data-across-threatconnect-instances.md)