Org/SANS Institute/Internet Storm Center

• SANS Internet Storm Center

  • Summary

    • The SANS Internet Storm Center (ISC) is a global cyber-threat monitoring and early-warning service run by SANS Institute.
    • ISC tracks internet-wide attack activity and publishes actionable analysis for defenders.

  • Purpose

    • Detect and track internet-wide attack activity.
    • Provide early warning on emerging threats such as worms, mass scanning, botnets, and exploit campaigns.
    • Publish technical analysis for security defenders.

  • How It Works

    • ISC aggregates telemetry from many volunteer sensors and security devices worldwide.
    • Typical telemetry includes:
      • Port scans
      • Exploit attempts
      • Malware callbacks
      • Unusual traffic patterns
    • Security analysts ("handlers") review activity and publish daily analysis.

  • Typical Outputs

    • Handler diaries with short technical write-ups.
    • Threat level indicators for internet "storm" severity.
    • Top target ports and scanning trend observations.
    • Malware and exploit observations.

  • Why Teams Watch ISC

    • Supports SOC situational awareness.
    • Helps teams detect what attack activity is actively spreading, often before formal advisories.

  • Images

    • 
    • 
    • 
    •