JTAN - Data Sharing Network

The talk introduces JTAN, a project in which a consortium made mostly of national CERTs works to make threat information sharing faster, more proactive and more useful across European cyber defence organisations. The speakers walk through the open-source tools the project supports. MISP handles structured sharing, a tool for analysing unstructured text such as pastes, forums and dumps covers raw data, and a malware configuration repository feeds extracted settings into MISP through a connector.

A central problem is noisy automated data. Indicators collected automatically often contain false positives, so teams tend to withhold them from peers. The project's answer is dedicated MISP instances used only for machine-generated events, combined with MISP's caching feature. Correlations can then be found without loading every record into analysts' instances, and an analyst can export a relevant hit into a working instance for follow-up.

For high-volume raw data such as passive DNS, certificate transparency and scan results, the speakers presented Cocktail Party, a newly open-sourced Elixir and Phoenix service that offers real-time WebSocket streams and lets partners exchange and merge feeds. A hackathon in Luxembourg in December was announced. The practical takeaway is to separate automated feeds from analyst work and to use streaming where MISP's sync model is a poor fit for the data.