> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Alliance Contribution

> Contributions are anonymized, weighted, and combined into a shared intelligence pool that strengthens proactive threat prevention

**OneFirewall Alliance** extracts IoC (Indicator of Compromise) data from alliance members, anonymizes and weights it, and aggregates it into a shared object used by all members for prevention.

OneFirewall rewards alliance members who contribute new IoCs (IPv4, domains, files, URLs) or confirm that existing IoCs are malicious.

OneFirewall also gathers data from security partners, open-source repositories, and internal security teams. The breakdown:

***

## Threat Intel Source Contribution

| Source                     | Contribution | Notes                                                                 |
| -------------------------- | ------------ | --------------------------------------------------------------------- |
| Security Partners          | ∼27%         | Security Partners specialized in cyber-attack hunting                 |
| Alliance Members           | ∼43%         | Customers of OneFirewall contributing to the Threat Intel data lake   |
| Open-Source Data           | ∼21%         | Crafted and collected by the Security Engineering team of OneFirewall |
| Internal Security Research | ∼6%          | OneFirewall’s research team, monitoring and reporting                 |
| Machine Learning           | ∼0.1%        | Pattern extraction for forecasting threat actors                      |
| OneFirewall Honey-net      | ∼2%          | Honeypot network collecting attack threat intel                       |

***

## Member Participation

An alliance member of OneFirewall can choose between two modes:

* **Consumer-only**\
  Regardless of on-prem or cloud installation, the member only consumes (reads) the latest threat intelligence.

* **Consumer-and-contributor**\
  The member can also report threat intelligence information back to the alliance, enhancing other members’ awareness of the latest threats.

***

## Contributor

A **Contributor** is a member that reports IoCs — IPv4 addresses, domains, URLs, or file digests — back to the OneFirewall SaaS service, based on the organization's internal intelligence from events flagged as malicious through automated or manual processes.

***

## Outbound Data Sharing

In Contributor mode, members send data back to the OneFirewall SaaS Cloud service. Contributing members share at least the following information (in JSON format):

* **Actor**: IPv4, URL, FileDigest, or domain name
* **Timestamp**: Date and time of the report
* **Confidence**: A numeric value (0.0 to 1.0) representing confidence in the actor’s maliciousness
* **Source (Optional)**: Appliance/Process used (e.g., `manual`, `Appliance-X`)
* **Event ID (Optional)**: Internal unique event ID
* **STIX (Optional)**: STIX v2.0 format bundle of the cyber attack
* **tags (Optional)**: Tags separated by "," example `report-00000`

In addition, contributors must authenticate against OneFirewall SaaS, which identifies the Member Organization (via random ID). This ID is used for subsequent calculations to either add a new feed or update an existing feed with enhanced confidence.

<img src="https://mintcdn.com/onefirewall/WDi-dI7jVFz2iVVH/images/contributor.webp?fit=max&auto=format&n=WDi-dI7jVFz2iVVH&q=85&s=f3d022d27925a1f12a4df87d1b3e2935" width="1688" height="632" data-path="images/contributor.webp" />

The information is submitted via the **OneFirewall public HTTPS/API endpoint**, which updates the **Cyber Crime Score** based on combined intelligence from other sources.

## Example of Data

```json theme={null}
[
  {
    "ip": "8.8.8.8",
    "timestamp": 1759158848,
    "confidence": 0.5,
    "tags": "report_00000"
  }
]

```

### Current Data Collection Plugins

1. Manual replication of submitted events (UI on-prem instance)
2. SIEM connector with ELK (Logstash config, case by case)
3. Apache and NGINX ModSecurity
4. SSH Logs

> Being a contributing member implies OneFirewall can acknowledge the customer as an active contributor. No other information is shared or disclosed without explicit reference to this status.

***

## FAQs

**Q: How is this information stored in the OneFirewall Data Lake?**\
A: The JSON information is stored with a randomly generated ID linked to the member, used only to generate anonymous data for updating the Cyber Crime Score.

**Q: Do other OneFirewall members have access to what I submitted?**\
A: No. Other members only see the updated Crime Score.

**Q: If I share information, can I later delete it?**\
A: Yes. At any point, a member can permanently delete (hard delete) their contributions.

**Q: Is the handling of this information GDPR compliant?**\
A: Yes. The shared information contains no PII.

**Q: Can I stop or pause my contributions?**\
A: Yes. Data collection/sharing is managed entirely on-premises, so you can pause or stop anytime.

**Q: Can I choose which cyber events to contribute?**\
A: Currently, event-level selection is not supported, but a custom pattern can be applied upon request.

**Q: How often is information contributed to the community?**\
A: Every 60 seconds (configurable).

***