We are continuing to support IntelMQ, an open-source solution for collecting and processing security feeds. Recently, the IntelMQ Community announced the release of new version 3.2.0.

Some thoughts from 2021 on the ideas of how to get SOCs to collaborate.

This is a TLP:WHITE summary of my presentation at the 15th CSIRTs Network meeting in Ljubljana on November 11th 2021. This is not a complete review of the current state of the NIS2 discussions.

The latest maintenance release for the incident-management toolbox IntelMQ brings few changes, but notable performance increases for high-load data collection processes.

The IntelMQ 3.0.1 release batch fixes some issues in IntelMQ, the API and the Manager.

"Tuency" is a new Open-Source constituency management portal with capabilities for self-management and managing abuse-contacts for network objects. With Keycloak, the database can be used for authenticating users on other applications. Nowadays, managing your own constituency in terms of security incidents is very important and challenging, but with Tuency you are able to do so with ease. Tuency has been built from scratch to address this issue and furthermore you're able query data via the Tuency API. Additionally, Tuency offers a special API to query the correct abuse contact for a network object (ASN, IP-Address, Domain) including hierarchical inheritance and notification rules!

IntelMQ 3.0 provides more possibilities to process domain-based data. For this purpose, we developed new "expert" bots - building blocks written in Python - which extend or filter events based on their URL- or Domain-properties. In addition we've introduced so-called IEPs (IntelMQ Enhancement Proposals), for a better way to discuss major changes within the community. The first IEP concerned a revamped configuration system for IntelMQ, which is part of IntelMQ 3.0.

For several years the FIRST SecLounge SIG has been organizing Capture The Flag (CTF) challenges during the annual FIRST conference and due to the pandemic this year's challenge had to move online. Three members of CERT.at participated and we scored the 9. place of 42 teams. This is a writeup of the challenges we solved.

The newest IntelMQ release 2.3.3 comes with various error corrections and supports a bunch of new feeds provided by the non-profit Shadowserver.

Domain Names are the center piece of locating services on the internet and they can be used for a variety of purposes and services. Understanding the type of services a Domain Name offers is one of the key aspects of Internet Security. In another post last year we already introduced tag2domain, our tagging / labelling framework for domain names that helps us to better understand this landscape of services and software.