We see breaking news alerts popping up with some dramatic headline, but headlines can be tricky and bring a lot of chaos to the organization and more specifically to the SOC.

Where will be the best place to go to gather information and to plan follow up actions (IR) when those very not detailed breaking news titles come about a brand new hack (ex. struts)?

closed as off-topic by schroeder Oct 24 '18 at 20:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I am deeply confused by your question. You seem to answer it yourself. 1) don't freak out by headlines, 2) gather information (in your question), 3) plan follow up actions based on details, not headlines (also in your question). If you are asking how to gather details, there is no way we can answer in a way that would address all possible reports because every report is different. – schroeder Oct 2 '18 at 16:23
  • It's not about how to find but where to look for, many times I will find myself lookinfg for new questions related in reddit or here by sorting to see related recent questions. – Filopn Oct 2 '18 at 16:28
  • 2
    Find the post by the researcher. This almost always has the most information. – paj28 Oct 2 '18 at 16:38
  • I wish it was that easy, but until good research papers come it usually takes few days but I was talking about those time where we just heard about the news and we need to get more info right away to see how to plan our IR. – Filopn Oct 2 '18 at 23:40
  • @Filopn wait, what? Research papers take a few days? If something has hit the news, then there will be details available from the source that reported it in the first place or the vendor. I'm not sure that I am clear about what you are actually talking about now. What about this, instead of referencing a particular named hack, can you describe or link to a news headline where you don't have the info you need to plan and prepare remediations? – schroeder Oct 5 '18 at 12:53

I have plenty of bookmarks to check and confirm the information. Here is some of the good ones to check the latest updates:

Additionally, I suggest you subscribe to US-Cert's mailing list.

Not the answer you're looking for? Browse other questions tagged or ask your own question.