A computer-implemented method for providing security threat information to a third party, comprising: receiving multiple datasets from multiple data sources, wherein the multiple datasets are formatted according to schemas that are specific to the multiple data sources; parsing each of the multiple datasets into subsets of data; for each dataset from multiple datasets that each include information about potential security threats: determining, by one or more computers and using one or more rules, which of one or more intelligence types apply to the dataset, comprising identifying one or more intelligence types that each categorize a respective subset of data in the dataset, wherein the intelligence types comprise one or more of: observables, indicators of compromise, vulnerabilities, exploits, threat actors, threat campaigns, courses of action, and adversary tactics, techniques and procedures; and associating, for each of the identified intelligence types, each of the subsets of data which are categorized by the intelligence type with the respective intelligence type; creating a data construct for each subset of data, wherein each created data construct comprises data from the respective subset and an identification of the intelligence type; determining one or more rules for a third party (206a-c) that each indicate that the third party (206a-c) should receive 1) data associated with particular types of potential security threats, and 2) priority information for the data; determining, for each of the particular types of potential security threats indicated in the rules, a group of the subsets that include information associated with the respective type of potential security threat; assigning, for each subset in each of the groups, a respective priority to the respective subset using the priority information; and providing data constructs corresponding to the determined subsets to the third party (206a-c) using the respective priorities. receiving multiple datasets from multiple data sources, wherein the multiple datasets are formatted according to schemas that are specific to the multiple data sources; parsing each of the multiple datasets into subsets of data; for each dataset from multiple datasets that each include information about potential security threats: determining, by one or more computers and using one or more rules, which of one or more intelligence types apply to the dataset, comprising identifying one or more intelligence types that each categorize a respective subset of data in the dataset, wherein the intelligence types comprise one or more of: observables, indicators of compromise, vulnerabilities, exploits, threat actors, threat campaigns, courses of action, and adversary tactics, techniques and procedures; and associating, for each of the identified intelligence types, each of the subsets of data which are categorized by the intelligence type with the respective intelligence type; determining, by one or more computers and using one or more rules, which of one or more intelligence types apply to the dataset, comprising identifying one or more intelligence types that each categorize a respective subset of data in the dataset, wherein the intelligence types comprise one or more of: observables, indicators of compromise, vulnerabilities, exploits, threat actors, threat campaigns, courses of action, and adversary tactics, techniques and procedures; and associating, for each of the identified intelligence types, each of the subsets of data which are categorized by the intelligence type with the respective intelligence type; creating a data construct for each subset of data, wherein each created data construct comprises data from the respective subset and an identification of the intelligence type; determining one or more rules for a third party (206a-c) that each indicate that the third party (206a-c) should receive 1) data associated with particular types of potential security threats, and 2) priority information for the data; 1) data associated with particular types of potential security threats, and 2) priority information for the data; determining, for each of the particular types of potential security threats indicated in the rules, a group of the subsets that include information associated with the respective type of potential security threat; assigning, for each subset in each of the groups, a respective priority to the respective subset using the priority information; and providing data constructs corresponding to the determined subsets to the third party (206a-c) using the respective priorities.