Documentation rendue
Cette page rend le Markdown et Mermaid du module directement depuis la source publique de documentation.
Overview#
The CERT Operations Workbench is a cyber-response workspace for national CSIRTs, sectoral CERT teams, and incident-response organisations that need a consolidated view of threat detection, intelligence exchange, malware triage, automation, and advisory workflows. It packages the most relevant detection and intelligence modules into a focused operational preset so CERT teams can move from feed review to response coordination without building a custom workspace from scratch.
The workbench is especially valuable for organisations operating within European or multi-national CERT networks where advisory intake, detection engineering, malware analysis, and controlled intelligence sharing must happen inside one coordinated operational surface.
Key Features#
- Threat Detection Posture - Combines Suricata, Sigma, SIEM, and related detection surfaces into a single review space for ongoing monitoring
- Threat Intelligence Exchange - Brings STIX/TAXII, MISP, indicators, and intelligence-report surfaces together for feed review and dissemination
- Malware and Sandbox Analysis - Provides quick access to malware repositories and sandbox-backed triage workflows for newly received samples
- Playbook and Automation Support - Supports CACAO-style response automation and guided incident-handling pivots for repeatable CERT actions
- CERT-Focused Presets - Narrows the broader cyber and DFIR workspace into a CERT-relevant operational view rather than forcing teams to assemble their own composition
Use Cases#
- National Advisory Monitoring - CERT operators review incoming advisories, indicators, and malicious artefacts from national and partner sources in one operational view
- Coordinated Incident Response - Teams move from new detections into playbook-driven response, malware review, and controlled intelligence distribution without leaving the workbench
- Detection Engineering Support - Analysts review new rules, signatures, and feed content to update local detection posture against current threats
- Cross-Border CERT Collaboration - Multi-national response teams maintain a shared view of threat posture and response inputs during coordinated incidents
Integration#
- EU CERT and CSIRT network feeds
- STIX/TAXII, MISP, Sigma, Suricata, SIEM, YARA, and related cyber integrations
- Malware analysis and DFIR surfaces including MWDB and sandbox workflows
- Automation and response-playbook systems
Last Reviewed: 2026-03-24