EUמוסדות
Europol · Cybercrime
Law enforcement cooperation and cybercrime publications.
פורטל הסייבר הבינלאומי / DIRECTORY
עולם של מומחיות.
מוסדות ציבוריים, צוותי תגובה, חברות ומחקר. מצאו מקורות מתאימים למדינה ולצרכים שלכם.
התפלגות פרופילי FIRST · 883
פרופילים בתמונת הנתונים : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - מגזר לא צוין
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
המדינה והמגזר אינם קובעים את תחום השירות. יש לבדוק את התנאים בפרופיל הרשמי. FIRST ↗
CEמוסדות
CERT Polska
Security reports and incident response in Poland.
JPמוסדות
JPCERT/CC
Coordination, alerts and technical analysis in Japan.
FIקהילות ותקנים
FIRST
International network of incident response teams.
MIמחקר והכשרה
MITRE ATT&CK
Public knowledge base of documented adversary tactics and techniques.
פרטי המקור
- נתון או מדד מאומת
- ATT&CK is a knowledge base grounded in observations. Its domains include Enterprise, Mobile and ICS.
- כיצד להשתמש
- Connect a technique with a trace and detection hypothesis. Distinguish having a log source from actually testing detection.
- מגבלה שיש לשמר
- A shared technique cannot establish actor attribution. Technique coverage counts do not fully measure security.
מועד בדיקת התיעוד
GOהמגזר הפרטי
Google Threat Intelligence
Threat intelligence research publications.
UNהמגזר הפרטי
Unit 42 · Palo Alto Networks
Threat research and technical reports.
CIהמגזר הפרטי
Cisco Talos
Threat analysis and research publications.
BEקהילות ותקנים
Bellingcat
Open-source verification methods and resources.
FIקהילות ותקנים
FIRST · EPSS
Vulnerability exploitation probability model. Compare with technical severity, local exposure and business impact.
פרטי המקור
- נתון או מדד מאומת
- The model looks ahead 30 days. Its score is a probability; its percentile ranks that score relative to other CVEs.
- כיצד להשתמש
- Record the data date and distinguish probability from percentile. Add asset exposure and confirmed exploitation evidence.
- מגבלה שיש לשמר
- The model does not predict harm to your organisation. Low probability does not cancel a critical exposure.
מועד בדיקת התיעוד
CVSS, EPSS, KEV ו-VEX
What is the estimated probability of observing exploitation of this CVE in the next thirty days?
It does not describe compromise of your instance, its controls or business loss.
Read the CVSS, EPSS, KEV and VEX reference →
Primary sources and scope
- FIRST · EPSS Frequently Asked Questions · Living FAQ · reviewed 2026-10-22
What is EPSS? · Reading the score · Percentile · Score changes
Sources checked on
FIקהילות ותקנים
FIRST · Traffic Light Protocol
Security information-sharing designations set by the source. Check their meaning before redistribution.
פרטי המקור
- נתון או מדד מאומת
- TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated.
- כיצד להשתמש
- Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.
- מגבלה שיש לשמר
- TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
מועד בדיקת התיעוד
מדדי STIX ושיתוף לפי TLP
A traceable note does not by itself grant permission to redistribute it. TLP markings, additional restrictions and intended recipients must accompany a redaction or publication decision.
TLP describes a sharing scope; it certifies neither accuracy, official classification nor a usage licence. Encryption and retention rules need separate definition. Obtain explicit source permission before widening the received scope.
Read the STIX, observations and TLP sharing reference →
References and verification scope
- FIRST · Traffic Light Protocol 2.0 · TLP 2.0 · 2022-08
§1, §2, §3 · TLP:AMBER+STRICT
Sources checked on
ICקהילות ותקנים
ICANN · Registration Data Lookup
Domain registration data lookup. Redacted data or a technical provider alone cannot establish control by an entity.
פרטי המקור
- נתון או מדד מאומת
- RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data.
- כיצד להשתמש
- Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.
- מגבלה שיש לשמר
- Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.
מועד בדיקת התיעוד
OAקהילות ותקנים
OASIS · STIX 2.1
Describe threat intelligence through structured objects and relationships.
פרטי המקור
- נתון או מדד מאומת
- STIX 2.1 is an OASIS Standard dated 10 June 2021. It defines objects, properties and JSON serialisation.
- כיצד להשתמש
- Keep identifiers, dates, provenance and relationships. Check that the recipient interprets the same object type and validity period.
- מגבלה שיש לשמר
- A syntactically valid object can still be stale, misattributed or weakly supported.
מועד בדיקת התיעוד
מדדי STIX ושיתוף לפי TLP
Structured intelligence retains provenance and a version history. For an actionable OSINT note, separate collected facts, the producer’s assertion and the local conclusion, then state what still needs confirmation.
Version note: at review time the OASIS latest-stage URL points to a document dated 2 April 2025 titled STIX 2.1 Errata 01, incorporating Draft 01. Its draft errata status is retained in the citation; it is not presented as a newly approved final version. Agree marking encodings with the recipient and check the edition actually used.
Read the STIX, observations and TLP sharing reference →
References and verification scope
- OASIS · STIX 2.1 · OASIS Standard · 2021-06-10
§3.2, §3.6, §4.7, §4.14, §5.2, §7.2 - OASIS · STIX 2.1 Errata 01 · Draft 01 · 2025-04-02 · OASIS Standard incorporating Draft 01 of Errata 01
Status / Citation format · draft status identified separately
Sources checked on
OAקהילות ותקנים
OASIS · TAXII 2.1
Exchange threat intelligence through an application protocol.
פרטי המקור
- נתון או מדד מאומת
- TAXII 2.1 is an OASIS Standard dated 10 June 2021. It includes service discovery and access to collections.
- כיצד להשתמש
- Test authentication, collection permissions, pagination and recovery after interruption. Record which objects were actually received and processed.
- מגבלה שיש לשמר
- TAXII transports data; it replaces neither the content model nor assessment of reliability.
מועד בדיקת התיעוד
C2קהילות ותקנים
C2PA · Content Credentials
Describe and verify certain content provenance information.
פרטי המקור
- נתון או מדד מאומת
- C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media.
- כיצד להשתמש
- Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.
- מגבלה שיש לשמר
- Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
מועד בדיקת התיעוד
מקור מדיה ואימות C2PA
A provenance report combines findings with different scopes. Signature, credential trust, content binding and scene context are separate assurances. Retain the exact asset and full report before summarising a result.
This JSON-LD representation is a derived view of C2PA data for reporting and interoperability. It is not independently verifiable or a validation input format.
- C2PA · Content Credentials Technical Specification 2.4 · 2.4 · April 2026
- C2PA · Content Credentials Explainer · 2.4
- C2PA · Security Considerations · 2.4
Open the C2PA explorer and publication cases →
References consulted on