Enum: OsintTlpEnum

The Traffic Light

Protocol was created to facilitate greater sharing of potentially sensitive

information and more effective collaboration. TLP provides a simple and

intuitive schema for indicating with whom potentially sensitive information can

be shared.

URI: ocsf:OsintTlpEnum

Permissible Values

Value	Meaning	Description
TLP_AMBER	None	TLP:AMBER is for limited disclosure, recipients can only spread this on a
TLP_AMBER_STRICT	None	TLP:AMBER is for limited disclosure, recipients can only spread this on a
TLP_CLEAR	None	TLP:CLEAR denotes that recipients can spread this to the world, there is no
TLP_GREEN	None	TLP:GREEN is for limited disclosure, recipients can spread this within their
TLP_RED	None	TLP:RED is for the eyes and ears of individual recipients only, no further
TLP_WHITE	None	TLP:WHITE and TLP:CLEAR may be used interchangeably, TLP:WHITE is the most up

Slots

Name	Description
tlp	The <a target='_blank' href='https://www

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/ocsf

LinkML Source

name: OsintTlpEnum
description: 'The <a target=''_blank'' href=''https://www.first.org/tlp/''>Traffic
  Light

  Protocol</a> was created to facilitate greater sharing of potentially sensitive

  information and more effective collaboration. TLP provides a simple and

  intuitive schema for indicating with whom potentially sensitive information can

  be shared.'
from_schema: https://w3id.org/lmodel/ocsf
rank: 1000
permissible_values:
  TLP_AMBER:
    text: TLP_AMBER
    description: 'TLP:AMBER is for limited disclosure, recipients can only spread
      this on a

      need-to-know basis within their organization and its clients. Note that

      TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use

      TLP:AMBER when information requires support to be effectively acted upon, yet

      carries risk to privacy, reputation, or operations if shared outside of the

      organizations involved. Recipients may share TLP:AMBER information with members

      of their own organization and its clients, but only on a need-to-know basis
      to

      protect their organization and its clients and prevent further harm. Note: if

      the source wants to restrict sharing to the organization only, they must

      specify TLP:AMBER+STRICT.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: AMBER
      caption:
        tag: caption
        value: TLP:AMBER
  TLP_AMBER_STRICT:
    text: TLP_AMBER_STRICT
    description: 'TLP:AMBER is for limited disclosure, recipients can only spread
      this on a

      need-to-know basis within their organization and its clients. Note that

      TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use

      TLP:AMBER when information requires support to be effectively acted upon, yet

      carries risk to privacy, reputation, or operations if shared outside of the

      organizations involved. Recipients may share TLP:AMBER information with members

      of their own organization and its clients, but only on a need-to-know basis
      to

      protect their organization and its clients and prevent further harm. Note: if

      the source wants to restrict sharing to the organization only, they must

      specify TLP:AMBER+STRICT.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: AMBER STRICT
      caption:
        tag: caption
        value: TLP:AMBER+STRICT
  TLP_CLEAR:
    text: TLP_CLEAR
    description: 'TLP:CLEAR denotes that recipients can spread this to the world,
      there is no

      limit on disclosure. Sources may use TLP:CLEAR when information carries minimal

      or no foreseeable risk of misuse, in accordance with applicable rules and

      procedures for public release. Subject to standard copyright rules, TLP:CLEAR

      information may be shared without restriction.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: CLEAR
      caption:
        tag: caption
        value: TLP:CLEAR
  TLP_GREEN:
    text: TLP_GREEN
    description: 'TLP:GREEN is for limited disclosure, recipients can spread this
      within their

      community. Sources may use TLP:GREEN when information is useful to increase

      awareness within their wider community. Recipients may share TLP:GREEN

      information with peers and partner organizations within their community, but

      not via publicly accessible channels. TLP:GREEN information may not be shared

      outside of the community. Note: when “community” is not defined, assume the

      cybersecurity/defense community.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: GREEN
      caption:
        tag: caption
        value: TLP:GREEN
  TLP_RED:
    text: TLP_RED
    description: 'TLP:RED is for the eyes and ears of individual recipients only,
      no further

      disclosure. Sources may use TLP:RED when information cannot be effectively

      acted upon without significant risk for the privacy, reputation, or operations

      of the organizations involved. Recipients may therefore not share TLP:RED

      information with anyone else. In the context of a meeting, for example, TLP:RED

      information is limited to those present at the meeting.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: RED
      caption:
        tag: caption
        value: TLP:RED
  TLP_WHITE:
    text: TLP_WHITE
    description: 'TLP:WHITE and TLP:CLEAR may be used interchangeably, TLP:WHITE is
      the most up

      to date (as of TLP 2.0) usage.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: WHITE
      caption:
        tag: caption
        value: TLP:WHITE