本专题内容
Public doctrine · Resilience · Defence · Satellites · Information conflict
Build a cyber defence watch from public sources
How can you monitor cyber defence without confusing signals, communications and evidence? Bound a strategic question, establish a chronology and assess original sources. A useful brief identifies affected infrastructure, civilian dependencies, verified facts and unknowns. It states what would change the assessment and which defensive actions merit review. This guide concerns documentary analysis of public material.
阅读指南 EN新闻观察
全部国际新闻 →已保存的标题 · 无法更新 · 最近成功获取时间 : 2026年10月22日 21:23
PHP漏洞曝光后，亚洲各国政府加强网络防御 - TradingView
via Google News · aggregatorPHP漏洞曝光后，亚洲各国政府加强网络防御 - TradingView
via Google News · aggregatorPHP漏洞曝光后，亚洲各国政府加强网络防御 - TradingView
via Google News · aggregator思科报告：企业自身或成为网络安全团队面临的最大挑战 - 人工智能
via Google News · aggregator每日消息（共同社） - 日本总务省将设立研究会讨论加强网络防御 - 客观日本
via Google News · aggregator思科发布《持续防御报告》报告 - 新浪财经
via Google News · aggregator参考资料：数据、用途与局限
文档核查日期 .
此语言版本的详细参考说明以英语提供。
| 来源与目的 | 已核实的数据或指标 | 使用方法 | 需要保留的局限 |
|---|---|---|---|
| FIRST · Traffic Light Protocol Indicate who may receive redistributed information. |
TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated. | Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity. | TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy. |
| OASIS · STIX 2.1 Describe threat intelligence through structured objects and relationships. |
STIX 2.1 is an OASIS Standard dated 10 June 2021. It defines objects, properties and JSON serialisation. | Keep identifiers, dates, provenance and relationships. Check that the recipient interprets the same object type and validity period. | A syntactically valid object can still be stale, misattributed or weakly supported. |
| MITRE ATT&CK Connect observations with adversary tactics and techniques. |
ATT&CK is a knowledge base grounded in observations. Its domains include Enterprise, Mobile and ICS. | Connect a technique with a trace and detection hypothesis. Distinguish having a log source from actually testing detection. | A shared technique cannot establish actor attribution. Technique coverage counts do not fully measure security. |
STIX 指标与 TLP 共享
此语言版本的详细参考说明以英语提供。
Connect the indicator to observations and retirement
An indicator match opens an analytical lead. To assess its significance, preserve observed events, technical context, sensor coverage and alternative hypotheses.
- Distinguish Indicator, Observed Data and Sighting; an intelligence assertion does not replace observed data.
- Do not equate a DNS resolution with execution or a Sighting count=0 with worldwide threat absence.
- Assign an owner and a mechanism for retiring derived rules after expiry or revocation.
Read the STIX, observations and TLP sharing reference →
Sources checked on · OASIS · STIX 2.1