CSIRT Assistance Program

The Team Cymru CSIRT Assistance Program provides:

  • Actionable compromise data for Regional and National CSIRTs.
  • Information directly into the hands of people who can use that insight.

CSIRT Assistance Program Intro Video

View the video full-resolution (30MB QuickTime Movie) (right click and "Save Link As" to download)

Frequently Asked Questions

What do you mean by "actionable compromise data"?

Team Cymru provides daily lists of compromised or abused devices for the ASNs and/or netblocks with a CSIRT's jurisdiction. This includes such information as bot infected hosts, command and control systems, open resolvers, malware urls, phishing urls, and brute force attacks.

Who is eligible?

Any verifiable regional or national CSIRT is welcome to join the program.

Why Regional and National CSIRTs?

Such organizations know their local providers and know know who to contact about threats. Also, they often have the mandate and authority to require a response from providers. Basically, it is a natural and obvious partnership for Team Cymru to foster with our CSIRT partners. We welcome CSIRTs from anywhere in the world, especially newly formed CSIRTs who can often benefit the most from available information.

How do I get it?

For information on how to join the program, please send an email with the subject "CSIRT Assistance Program" to outreach@cymru.com.

How much does it cost?

All costs will be borne by Team Cymru. The CAP is offered as a service to the Internet security community for the benefit of the Internet.

Are there limitations?

There are, though they are very few. A short memorandum of understanding is required for participation and outlines those limitations in detail.