Threat Intelligence: EU National CERT and CSIRT Network

Overview#

During a coordinated cyberattack campaign targeting European government networks in early 2025, CERT-EE and CERT-LV were among the first to publish technical indicators, drawing on their substantial experience with state-sponsored operations active in their geography. Within hours, BSI and NCSC-NL had published corroborating advisories with additional technical detail. An analyst using Argus saw all four national authority advisories in a single consolidated view, deduplicated the overlapping IOC set, and confirmed that three C2 domains were independently reported by four separate national authorities. That multi-source confirmation elevated the confidence assessment from possible to high. The combined intelligence from twelve national CERT feeds, processed automatically, provided a threat picture no single national authority could have produced alone.

The European Union maintains a network of national Computer Security Incident Response Teams (CSIRTs) and cybersecurity agencies coordinated through ENISA (European Union Agency for Cybersecurity) and the CSIRTs Network established under Article 12 of the NIS Directive. Each member state operates one or more authoritative national bodies responsible for threat information collection, incident coordination, and cybersecurity advisories. Argus integrates with twelve national cybersecurity authorities across the EU, exposing their authority-specific advisory, alert, incident, warning, and statistics surfaces inside a single operational workspace.

flowchart LR
    A[12 National CERT Feeds] --> B[Per-Authority Sync Mutations]
    B --> C[IOC Deduplication at Ingest]
    C --> D[TLP Level Mapping to secrecy_level]
    D --> E[Multi-Source Provenance Preserved]
    E --> F[Analyst Consolidated View]
    F --> G[MISP Indicator Cross-Reference]
    F --> H[Sigma / Suricata Rule Correlation]
    F --> I[NIS2 Compliance Workflow Support]

Last Reviewed: 2026-03-18 Last Updated: 2026-04-14

Integrated National Authorities#

Key Features#

National Feed Synchronization#

Each national authority integration exposes its own typed query and sync mutation pair rather than a single shared contract. Examples include certBeAdvisories with syncCertBeAdvisory, certBundAlerts with syncCertBundAlert, certEeIncidents with syncCertEeIncident, bsiAdvisories with syncBsiAdvisory, and ncscNlAdvisories with syncNcscNlAdvisory. Feed data is persisted under organisation and clearance-level scoping.

Authoritative National Vulnerability Advisories#

National CERT advisories frequently precede or supplement CVE entries in NVD. Authorities such as BSI and NCSC-NL produce detailed technical advisories for vulnerabilities affecting industrial control systems, critical infrastructure, and government IT. These advisories contain exploitation context, including active exploitation in the wild and public proof-of-concept availability, that is not always reflected in CVSS base scores alone.

Country-of-Origin Attribution Context#

Indicators and advisories from each national authority carry country-of-origin metadata. Attribution claims and victim country context from Eastern European CSIRTs (CERT-EE, CERT-LV) carry particular weight for threats originating from state actors active in that geography. Argus preserves this provenance metadata through the data model.

Cross-Border Incident Correlation#

ENISA's CSIRTs Network enables cross-border incident information sharing. When a coordinated attack campaign impacts multiple EU member states, multiple national feeds may produce overlapping indicators from different national perspectives. Argus deduplicates at the IOC level while preserving the multi-source provenance: an indicator confirmed by four national CSIRTs carries significantly higher confidence than one reported by a single commercial feed.

NIS2 Incident Reporting Integration#

NIS2 Article 23 requires essential and important entities to report significant incidents to national authorities. Argus supports the surrounding compliance workflow, but the national CERT integrations documented here are authority-specific ingest and synchronization surfaces rather than direct outbound notification submission channels to those authorities.

Clearance-Segregated TLP Distribution#

National CERT feeds carry Traffic Light Protocol (TLP) markings. TLP:RED material (restricted to named recipients), TLP:AMBER (limited distribution), TLP:GREEN (community distribution), and TLP:CLEAR (unrestricted) are handled according to the TLP standard. Argus maps TLP levels to secrecy_level values, ensuring that TLP:RED material from a national CERT bilateral sharing relationship is not leaked to users below the clearance level for that sharing arrangement.

Advisory Deduplication Across Authorities#

BSI (the German federal cybersecurity authority) and CERT-Bund (BSI's CERT function) are both integrated and sometimes produce overlapping advisories on the same vulnerability. Argus deduplicates advisory content across sources at ingest, preserving multi-source attribution while presenting a single advisory record to analysts.

Use Cases#

• European Threat Landscape Morning Brief: SOC analysts start their shift with a consolidated view of overnight advisories from all twelve national authorities, highlighting new critical advisories and active exploitation warnings relevant to their asset inventory.
• Sector-Specific Critical Infrastructure Alerting: BSI and NCSC-NL produce detailed ICS/SCADA vulnerability advisories. Operators managing critical infrastructure can filter the combined EU CERT feed for energy, water, and transport sector advisories and correlate against their OT asset inventory.
• NIS2 Compliance Operations: EU member state organisations required to report to their national CERT can track the advisory landscape from all national authorities, identify what peer organisations in their sector are being warned about, and prepare compliance workflows in Argus alongside the national CERT data they consume.
• Election Integrity and Democratic Process Protection: CERT-EE and CERT-LV have extensive experience with state-sponsored cyber operations targeting democratic institutions. Their feeds carry high-value pre-disclosure intelligence for threat actors active against European democratic institutions and government networks.
• NATO Collective Defence Intelligence Fusion: During heightened geopolitical tension, Argus aggregates the real-time advisory outputs of the NATO and EU member state CERT network into a single fused threat picture for NATO ISR and cyber operations.

Integration#

Each national authority is individually accessible via its own GraphQL surface, for example certBeAdvisories, certBundAlerts, certEeIncidents, ncscNlAdvisories, bsiAdvisories, nukibWarnings, and the corresponding per-authority stats and sync mutations. There is no single euCertFeed GraphQL field; consolidated European views are composed at the application layer from the individual authority domains.

All operations require authentication and organisation scoping. TLP-restricted material requires matching clearance level assignment.

Works alongside MISP (many national CERTs share via the MISP protocol), STIX/TAXII (some national authorities publish machine-readable STIX-formatted indicators), Sigma rules (national authority advisories frequently include detection rule recommendations), and Suricata IDS (some authorities publish network signatures alongside advisories).