FIRST CSIRT Services Framework and Standards FIRST-CSIRTF-SA4-SituationalAwareness: Service Area 4 - Situational Awareness and Threat Intelligence

FIRST CSIRT Services Framework v2.1 Service Area 4 - Situational Awareness. SCOPE: maintaining + sharing operational + tactical + strategic awareness of the cyber threat landscape relevant to the constituency. SUB-SERVICES: (1) DATA ACQUISITION + COLLECTION - threat-intel feeds (CTI) + ISAC sharing + government feeds + vendor feeds + open-source intelligence (OSINT) + dark-web monitoring + sensor data; (2) ANALYSIS + SYNTHESIS - correlation + enrichment + analytic tradecraft (Diamond Model + Kill Chain + MITRE ATT&CK) + threat actor profiling + campaign tracking + indicator-of-compromise + indicator-of-attack development; (3) COMMUNICATION + DISSEMINATION - tailored bulletins + briefings + alerts to executive + technical + constituency audiences with TLP + IEP + STIX/TAXII machine-readable feeds for automation. COORDINATION: cross-feed with FIRST member CSIRTs + national CSIRT networks + sector ISACs + the FIRST CTI special interest group.