## 1 Introduction
On the same line, and conversely to what happens in microgrids, the production or storage of energy lies in the same physical infrastructure as consumers; thus, control communications in active buildings can be exchanged through the existing network channel of the building. Different organisations may manage these communicating active buildings. We assume a context where, as a system gets eventually compromised, security officers will share CTI across pertaining trusted organisations that can benefit from using such knowledge to deter impending cyber-attacks. This exchange of CTI highlights the importance of effectively describe, report, and share it by using standardised and structured formats comprehensible by analysts across diverse disciplines. One of the most popular standard format used by cybersecurity analysts is STIX(tm) (Structured Threat Information eXpression) [29]. STIX allows to describe, visualise, and share CTI models to support richer and wider cyber-attack narratives to explain ongoing incursions. As such, the complexity and the number of attack vectors, as well as their capacity to harm, is higher than regular smart  
Figure 1: Active buildings have a different energy profile; they also exchange power with other entities, and the corresponding handshake to establish all the parameters of the energy transfer requires additional communications. Adapted from [PERSON] et al. [27]. buildings in microgrids. Such additional complexity reflects to models that hinder the effectiveness of timely responses to incidents. To tame such complexity, we model a basic scenario to manage CTI in the context of active buildings. We used the tool cyberaCTlve [30] to create and manage our model. The model can be exported and it is fully compliant to the STIX format, so other tools can easily manipulate it. We have chosen this tool as it implements a _timeline_ that can be used for real-time analysis, where an analyst could inspect the _chain of events_ and then try to reason about the progression of cyber-attacks, or other anomalies that require attention from the cybersecurity perspective. However, changes to the model in cyberaCTlve are manual, so the effectiveness of the timeline is restricted. To make it effective, we extended the tool with a service that accepts security feeds from (automated) external sources, such as intrusion detection systems (IDS). So, if an IDS detects a cyber attack, it can automatically augment the CTI with such knowledge and notify security officers, who can then promptly intervene and share their information with security officers in adjacent buildings. Next, we highlight our paper contributions:  
* we survey on solutions on how to integrate CTI directly into active buildings as well as any cyber-physical system that produces output data relevant to analysis;
* an overview of literature on CTI, discussing shortcomings and advantages of its use and measures on how to best integrate indicators of anomalies, expert opinions, threat agents, and so forth, into standardised models (here, described using STIX);
* we provide a comprehensive discussion on cybersecurity prospects of active buildings, differentiating them from smart buildings and highlighting the additional datasets that are produced and how to leverage them using CTI;
* we exemplify the use of an auxiliary tool called cyberaCTlve to assist the process of identifying intelligence items and storing in a specialised information system to support sharing and understanding about cyber-attack progression and timely defences against malicious incursions; and
* we give an in-depth analysis on how to integrate cybersecurity in early phases of any active building proposition, showing the novel range of services and systems that they aggregate into the attack surface and how to cope with CTI under these considerations. We organise our paper as follows. In Section 2, we discuss active buildings and CTI.