SOC digital artifact analysis and threat intelligence sharing maturity buildout and operation in East Europe (Romania, Lithuania, and beyond)

ongoing

The SOCcare project is aimed at building better cyber threat intelligence through improved analysis of digital artefacts, and then sharing this threat intelligence across the Eastern Europe region and beyond to increase cooperation and cyber resilience of Digital Europe. Currently, all consortium partners NRD, REVEL and UPB have operational SOCs covering detections in various digital infrastructures. However, the maturity of digital artefact analysis and related threat intelligence generation and sharing processes after incident identification in the subsequent incident analysis process is relatively low due to a non-standardised approach to this digital artefact analysis and related threat intelligence generation & sharing across SOCs. The objectives of the project are to address this shortcoming by: 1. Establishing standardised practices for digital artefact analysis using the open source Dissect tool - creating a methodology, processes and standard operating procedures to improve incident analysis maturity. 2. Building cyber threat intelligence creation process and procedure practices from the aforementioned digital artifact analysis practices, based on the Dissect tool. 3. Continually practice and refine the above practices, providing and sharing actual cyber threat intelligence from observed incidents. 4. Creating and sharing the applied methodologies with wider SOC communities in Romania, Lithuania, neighbouring countries and EU Member States.