FI社区与标准
FIRST
International network of incident response teams.
国际网络安全门户 / DIRECTORY
连接全球专业知识。
公共机构、响应团队、企业与研究。寻找适合您所在国家和需求的信息源。
FIRST资料分布 · 883
快照中的资料数 : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - 未说明领域
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
国家和领域不能确定其服务范围。请在官方资料中确认服务条件。 FIRST ↗
OW社区与标准
OWASP Foundation
Open projects for application and AI security.
MI研究与教育
MITRE ATT&CK
Public knowledge base of documented adversary tactics and techniques.
参考资料详情
- 已核实的数据或指标
- ATT&CK is a knowledge base grounded in observations. Its domains include Enterprise, Mobile and ICS.
- 使用方法
- Connect a technique with a trace and detection hypothesis. Distinguish having a log source from actually testing detection.
- 需要保留的局限
- A shared technique cannot establish actor attribution. Technique coverage counts do not fully measure security.
文档核查日期
MI研究与教育
MITRE ATLAS
Knowledge base of threats to AI systems.
参考资料详情
- 已核实的数据或指标
- The official repository publishes ATLAS tactics, techniques and case-study data. They support analysis of the actual deployed system.
- 使用方法
- Select scenarios matching your application’s data, interfaces and tools. Test permissions and consequences, not only model responses.
- 需要保留的局限
- A technique catalogue is neither an exhaustive coverage guarantee nor a test result for your system.
文档核查日期
CE社区与标准
Center for Internet Security
Security controls and benchmarks.
IE社区与标准
IETF
Open Internet protocol standards.
邮件安全：身份、对齐与传输
RFC 9989, published in May 2026, replaces RFC 7489 and RFC 9091. Aggregate and failure reporting are separated into RFC 9990 and RFC 9991.
Publication of an RFC does not show that every provider already implements that version. Check documentation, observed results and exceptions in your own streams. These examples are educational and provide no ready-to-deploy DNS record.
- SPF · RFC 7208 ·
- DKIM · RFC 6376 ·
- DKIM cryptography · RFC 8301 ·
- DMARC · RFC 9989 ·
- DMARC aggregate reports · RFC 9990 ·
- DMARC failure reports · RFC 9991 ·
- MTA-STS · RFC 8461 ·
- SMTP TLS Reporting · RFC 8460 ·
- DANE for SMTP · RFC 7672 ·
- ARC · RFC 8617 ·
Open the comparison and DMARC simulator →
References and status checked on
ETag、HTTP 缓存与并发更新
An ETag is an opaque validator for the selected representation. It compares versions; it is neither authorisation nor an access token, and it need not be a file hash. Personalised responses require separate decisions about access, cache selection and HTTP conditions.
If-Match requires strong comparison: neither tag may start with W/. If-None-Match uses weak comparison, matching the opaque values regardless of W/. Values remain case-sensitive. The * wildcard checks representation existence here, not a particular version.
Explore ETag comparisons and the simulator →
Primary references and limits
The standards define HTTP conditions and caching. The ten cases, laboratory and two-client walkthrough are original illustrations. Displayed results are calculated by this local model, not measurements of this site or your infrastructure.
- IETF · RFC 9110 — HTTP Semantics · June 2022 · STD 97
§8.8.3.2; §13.1.1–13.1.2; §13.2; §15.3.5; §15.4.5 - IETF · RFC 9111 — HTTP Caching · June 2022 · STD 98
§4.1; §4.3; §5.2.2.4–5.2.2.5; §5.2.2.7 - IETF · RFC 6585 — Additional HTTP Status Codes · April 2012 · Standards Track
§3 · 428 Precondition Required
References reviewed
Retry-After：等待、预算与重试决策
A waiting period answers “when?”, not “may this operation be repeated?”. Before retrying, identify the intended effect, read the provider contract and bound total work. An error status or a lost response does not prove that no earlier attempt produced an effect.
Durations are seconds. Absolute dates need an explicit clock policy; calculations here assume the stated accurate clock. Past dates become zero in this model without permitting an immediate loop. Integer syntax alone does not define a client’s numeric limits.
Explore Retry-After and the retry model →
Primary sources and limits
- IETF · RFC 9110 — Retry-After et idempotence HTTP · June 2022 · STD 97
§5.6.7; §9.2.2; §10.2.3; §15.6.4 - IETF · RFC 6585 — 429 Too Many Requests · April 2012 · Standards Track
§4
References reviewed
security.txt 与漏洞披露
Cyber exposure also includes the ability to receive a useful report. A security.txt file can make the contact discoverable, but its presence alone establishes neither channel availability nor case follow-through.
Read the security.txt reference and disclosure cases →
Primary sources and scope
- IETF · RFC 9116 · security.txt · Informational · 2022-04
§2.3–2.5, §3–3.1, §4, §5.1–5.7
Sources checked on
Robots.txt：抓取、索引与证据
Discovering a URL, allowing crawling, indexing content and citing a source are separate stages. A 200 response and an Allow rule do not establish that a search engine selected the page. This reference shows which evidence belongs to each stage.
The three files and twelve requests below are fictional. IndexBot, PreviewBot and OtherBot do not identify real services. Examples use ASCII prefixes and an exact $ ending, without encoding, path wildcards, redirects or cache handling. Filters organise explained outcomes; they neither test a domain nor modify this site’s robots.txt.
Review the twelve robots.txt cases →
Primary sources and scope
REP rules come from RFC 9309; Google-specific details are attributed to its own documentation. Examples and the diagram are educational. Filtering performs no crawling and the tables contain no client results.
- IETF · RFC 9309 — Robots Exclusion Protocol · September 2022 · Standards Track
§2.2.1–2.2.3; §2.3–2.5; §3 - Google · Interprétation de robots.txt / robots.txt interpretation · Documentation consultée / accessed 2026-10-22
Group selection; path matching; HTTP errors and caching - Google Search Central · Block indexing with noindex · Documentation consultée / accessed 2026-10-22
Crawler access required to observe noindex - Google Search Central · Canonical URLs · Documentation consultée / accessed 2026-10-22
Signals, best practices and sitemap inclusion
References reviewed
ET社区与标准
ETSI
Technical standards and quantum-safe cryptography.
AR研究与教育
arXiv
Scientific preprints; peer review is not guaranteed.
HU私营部门
Hugging Face
AI models, datasets and open tools.
MI私营部门
Microsoft Security
Security research and analysis published by Microsoft.
GO私营部门
Google Threat Intelligence
Threat intelligence research publications.
UN私营部门
Unit 42 · Palo Alto Networks
Threat research and technical reports.
CI私营部门
Cisco Talos
Threat analysis and research publications.
CL私营部门
Cloudflare
Networking, security and infrastructure analysis.
PO私营部门
PortSwigger Web Security Academy
Web security learning in authorised labs.
BE社区与标准
Bellingcat
Open-source verification methods and resources.
FI社区与标准
FIRST · EPSS
Vulnerability exploitation probability model. Compare with technical severity, local exposure and business impact.
参考资料详情
- 已核实的数据或指标
- The model looks ahead 30 days. Its score is a probability; its percentile ranks that score relative to other CVEs.
- 使用方法
- Record the data date and distinguish probability from percentile. Add asset exposure and confirmed exploitation evidence.
- 需要保留的局限
- The model does not predict harm to your organisation. Low probability does not cancel a critical exposure.
文档核查日期
CVSS、EPSS、KEV 与 VEX
What is the estimated probability of observing exploitation of this CVE in the next thirty days?
It does not describe compromise of your instance, its controls or business loss.
Read the CVSS, EPSS, KEV and VEX reference →
Primary sources and scope
- FIRST · EPSS Frequently Asked Questions · Living FAQ · reviewed 2026-10-22
What is EPSS? · Reading the score · Percentile · Score changes
Sources checked on
FI社区与标准
FIRST · CVSS
Vulnerability severity specification and calculators. A score alone does not describe organisation-specific risk.
参考资料详情
- 已核实的数据或指标
- CVSS 4.0 scores run from 0.0 to 10.0. Base, Threat, Environmental and Supplemental metric groups serve different purposes.
- 使用方法
- Retain the score version, vector and date. Compare it with the installed version, access paths and business consequences before ordering remediation.
- 需要保留的局限
- A high score is not evidence of exploitation; a low score does not mean a service has no risk.
文档核查日期
CVSS、EPSS、KEV 与 VEX
What is the technical severity under the assessed metrics?
The score proves neither exploitation nor consequences for your service.
Read the CVSS, EPSS, KEV and VEX reference →
Primary sources and scope
- FIRST · CVSS 4.0 Specification · CVSS 4.0 · document 1.2 · reviewed 2026-10-22
Overview · Assessment · Nomenclature · Supplemental Metrics
Sources checked on
FI社区与标准
FIRST · Traffic Light Protocol
Security information-sharing designations set by the source. Check their meaning before redistribution.
参考资料详情
- 已核实的数据或指标
- TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated.
- 使用方法
- Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.
- 需要保留的局限
- TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
文档核查日期
STIX 指标与 TLP 共享
A traceable note does not by itself grant permission to redistribute it. TLP markings, additional restrictions and intended recipients must accompany a redaction or publication decision.
TLP describes a sharing scope; it certifies neither accuracy, official classification nor a usage licence. Encryption and retention rules need separate definition. Obtain explicit source permission before widening the received scope.
Read the STIX, observations and TLP sharing reference →
References and verification scope
- FIRST · Traffic Light Protocol 2.0 · TLP 2.0 · 2022-08
§1, §2, §3 · TLP:AMBER+STRICT
Sources checked on
CV社区与标准
CVE Program
Public vulnerability identifiers and records. Check products, affected versions and links to original advisories.
参考资料详情
- 已核实的数据或指标
- A JSON schema defines the CVE record format. An identifier and the published contents of its record are distinct things.
- 使用方法
- Open the record and references; check its state, described affected versions and supplier information. Keep the identifier in action tracking.
- 需要保留的局限
- A CVE identifier is neither a severity score nor proof that your installation is affected.
文档核查日期
NI公共机构
NIST · National Vulnerability Database
Vulnerability database and technical enrichment. Cross-check records against vendor advisories and the deployed configuration.
NI公共机构
NIST · Cybersecurity Framework
Cyber risk management framework and implementation resources. Organises intended outcomes rather than providing certification.
参考资料详情
- 已核实的数据或指标
- CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe a single way to achieve outcomes.
- 使用方法
- Describe current and target profiles with evidence, gaps and owners. Connect each priority to the services it helps protect.
- 需要保留的局限
- Mapping to the framework is neither certification nor proof that every control works.
文档核查日期
网络事件：恢复决策与证据
Qualifying a signal, preserving investigative material and restoring a service answer different questions. CSF 2.0 distinguishes recovery initiation, integrity of restoration assets, validation of restored assets and the end of recovery. These are outcomes to document, not certification or one mandatory procedure.
The twelve entries below are a selected, paraphrased part of CSF 2.0. Evidence columns, timelines and injects are original teaching proposals. They do not replace a local plan and imply no universal timing, severity level or authority. SP 800-61 Revision 3 has been final since April 2025 and supersedes Revision 2.
Explore NIST outcomes and the timeline →
Primary references and limits
Identifiers and outcome meanings come from CSF 2.0; SP 800-61r3 adds incident response and recovery recommendations. Evidence tables, times and scenarios are educational, with no client results, certification or actual notification.
- NIST · SP 800-61 Rev. 3 · Final · 2025-04-03
Community Profile CSF 2.0 ; remplace / supersedes Rev. 2 - NIST · SP 800-61r3 — recommandations détaillées / detailed recommendations · April 2025
Pages imprimées / printed pages 27–29, 34–35 : RS.MA, RS.AN, RC.RP, RC.CO - NIST · Cybersecurity Framework 2.0 · 2024-02-26 · NIST CSWP 29
Appendix A, printed pages 22–23 : official outcome identifiers - NIST · SP 800-184 — Guide for Cybersecurity Event Recovery · Final · 2016-12-22
Recovery planning, playbooks, testing and improvement
References reviewed
NI公共机构
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
参考资料详情
- 已核实的数据或指标
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- 使用方法
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- 需要保留的局限
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
文档核查日期
OW社区与标准
OWASP · GenAI Security Project
Open risk reference for LLM and generative AI applications, including prompt injection, disclosure and excessive permissions.
参考资料详情
- 已核实的数据或指标
- The 2025 edition includes Prompt Injection, Sensitive Information Disclosure and Excessive Agency.
- 使用方法
- Turn a risk into an observable scenario: hostile document, restricted data or out-of-scope tool. Record expected behaviour and evidence of refusal.
- 需要保留的局限
- A risk list is not a complete assessment. Input filtering alone does not establish authorisation for every action.
文档核查日期
RAG：访问权限、引用与缓存
An accurate answer can disclose a forbidden document. Retrieval relevance, citation validity and access authorisation are separate checks. The service providing passages must enforce the current identity’s rights before exposing them to the model.
- OWASP · LLM08:2025 Vector and Embedding Weaknesses · 2025
- OWASP · LLM01:2025 Prompt Injection · 2025
- OWASP · LLM06:2025 Excessive Agency · 2025
- OWASP · LLM05:2025 Improper Output Handling · 2025
- OWASP · LLM07:2025 System Prompt Leakage · 2025
- OWASP · LLM10:2025 Unbounded Consumption · 2025
- OWASP · API1:2023 Broken Object Level Authorization · 2023
Explore the RAG access matrix and replay cases →
References consulted on