Internet Abuse Watch System (ThreatObserver) is a solution for CERT/CIRT/CSIRT to gather cyber attacks data from various sources. ThreatObserver is designed to assist CERT/CIRT/CSIRT in incident handling to make the task easier. Consequently, response team is left with more opportunities for other important work.

Incident response team faces challenges including:

• Details of an attack not readily available or they simply don’t exist;
• Inadequate or absence of tools for reliable and comprehensive threat information;
• Data too scattered and insufficiently filtered to work with;
• Lack of expert skills to distinguish critical data from raw data; and
• As a result, responders are unable to coordinate appropriate actions.

ThreatObserver provides the means to collect data from various abuse feeds, processes the events, and sends out aggregated and actionable reports to be disseminated to relevant agencies or organisations. It facilitates the incident response task hence freeing the response team to attend to other pressing matters. ThreatObserver supports incident response team by:

• Collecting and correlating global data on reported Internet abuse in near real time;
• Making sense of raw data through aggregating and enriching processes;
• Producing actionable intelligence report; and
• Simplifying incident coordination with the relevant agencies.

For more information, email us at support@threat.observer.