Mission Snapshot Focus: Threat hunt, incident support, digital forensics. Partners: JIIM community. Posture: Agile, expeditionary, data-driven.
Lines of Effort 1 Operational Threat Intelligence Collection, fusion, and partner distribution with measurable effects. 2 Malware Analysis & Attribution Reverse engineering, tooling baselines, and family mapping. 3 Partner Capacity Building Exercises, TT&E, and deployable kits for surge response. 4 Secure Information Sharing Standards-based exchange, SBOM guidance, and zero-trust patterns.
Things We’re Doing Threat-hunting playbooks Deploying artifact triage kits for rapid, repeatable hunts. Remote forensic labs Field-ready kits for evidence capture and analysis. TTP advisories Publishing mitigations for priority threats and CVEs. Red / Blue validations Joint exercises to verify detection and response.
Mission Snapshot Focus: Critical infrastructure & supply-chain security. Partners: DoD components, Allies, regional CSIRTs. Posture: Persistent engagement, interoperability.
Lines of Effort 1 OT/ICS Threat Detection Telemetry, anomaly detection, and playbook validation. 2 VDP & Remediation Coordinated disclosure pathways and mitigations for high-risk CVEs. 3 Exercise & Wargame OT tabletop, joint scenarios, and lessons learned. 4 Secure Dev & SBOM Supply-chain hardening, SBOM guidance, and interoperability.
Things We’re Doing Regional VDP engagements Coordinating disclosure channels with partners. Mitigation bulletins Publishing patches and compensating controls. OT tabletop playbooks Validating procedures with live scenarios. Supply-chain pilots Secure Dev practices and SBOM alignment.
Mission Snapshot Focus: Joint incident response & forensic surge. Partners: NATO bodies, national CSIRTs, DIB entities. Posture: Interoperable frameworks, shared standards.
Lines of Effort 1 Incident Response & Hunt Joint surge teams, containment, and eradication. 2 Digital Forensics & Evidence Chain-of-custody, standardized tooling, reporting. 3 Intel Fusion & Sharing Common schemas, STIX/TAXII alignment, feedback loops. 4 Training & Exchange Hands-on labs, workshops, and partner exchanges.
Things We’re Doing Allied incident reports Co-authored reports and shared lessons learned. Forensic templates Curated chain-of-custody and evidence forms. Intel exchange groups Recurring working groups for faster sharing. Hands-on labs Workshops and partner exchanges with allied teams.