Associations among data records in a security information sharing platform

A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device for creating associations among data records in a security information sharing platform, the machine-readable storage medium comprising:

• instructions to determine that a first observable is associated with a second observable, a threat actor, a malware, a chain of attack, an organization, an industry sector, a community of a security information sharing platform, a domain name, or any combination thereof;
• instructions to identify, in the security information sharing platform, a data record that corresponds to the second observable, the threat actor, the malware, the chain of attack, the organization, the industry sector, the community, the domain name, or any combination thereof;
• instructions to create, in the security information sharing platform, an association between a first security indicator comprising the first observable and the data record.
• instructions to obtain a search query that specifies the first security indicator;
• and
• in response to the search query, instructions to provide the data record, a second security indicator associated with the data record, or any combination thereof.

A system for creating associations among data records in a security information sharing platform comprising:

• a processor that:
• creates, in a security information sharing platform that enables sharing of security information among a plurality of users, an association between a security indicator comprising an observable and a data record based on sightings of the observable;
• obtains a search query that specifies the security indicator;
• identifies a set of data records that satisfy the search query, the set of data records including the data record;
• and
• provides a visual representation of associations between the security indicator and the set of data records.