CISA's Automated Indicator Sharing, or AIS, lets public and private organizations exchange machine readable cyber threat indicators in real time. CISA calls it a no cost service. To join you contact CISA, agree to terms, set up a TAXII client, get a certificate and sign an interconnection agreement.
Who can take part
CISA lists private sector entities, federal agencies, state, local, tribal and territorial governments, ISACs and ISAOs, and foreign government partners and companies. You do not need to be a security vendor.
The five onboarding steps
CISA's page lays out the sequence:
- Contact CISA to start the engagement and get technical help.
- Agree to the Terms of Use if you are non federal, or the MISA if you are federal.
- Acquire a STIX and TAXII capability. CISA says you can use an open source TAXII 2.1 client or a commercial product.
- Obtain a PKI certificate, if you do not already have one.
- Sign an Interconnection Agreement and give CISA your IP address.
The service is free, but the certificate may cost money. CISA says participants may need to buy one from a Federal Bridge Certificate Authority provider.
What to prepare before you start
An owner. Pick one person to run the connection and one backup.
A place for the data. Decide where indicators land: a threat intelligence platform, your SIEM or a simple database. Make sure it can parse STIX.
A policy for use. Decide which indicators may block automatically, which only alert, and which need a person to review. Shared indicators vary in quality and age.
A policy for sharing. If the connection is two way, decide what you will send, who approves it and how you remove sensitive data first. NIST's guidance on information sharing suggests setting goals, scope and rules for publishing and distribution before you begin.
What to expect afterward
You will receive indicators, mostly atomic ones such as addresses and domains. In the Pyramid of Pain these are lower level, so use them for quick matching and scoping, not as your only defense.
Alternatives
If a machine to machine feed is more than you need, a sector sharing group may be a better first step. They are people based and often add context that raw indicators lack.
Questions to settle internally
Who may see incoming indicators, and how long do you keep them? What happens when an indicator matches something important, such as a production server? Who is on call to look? Answering these before the first feed arrives avoids a confused first week.
Also decide how you will measure value: number of indicators received, number that matched your logs, number that led to action. Review after a quarter.
Quick check
Do I need to understand STIX before joining?
You need software that can handle it. Learning the basics helps you check what arrives, but you do not need to write it by hand.
Is joining required by law?
This post makes no such claim. CISA presents it as a voluntary service.
Sources
Last reviewed: 19 October 2026.
