Open Registrations: CSIRT Forum and MISP Workshop 2026

* 14th Brazilian CSIRTs Forum dates: July 28 and 29, 2026.
* 7th MISP Workshop date: July 30, 2026.
* Location: Amcham Business Center, Rua da Paz, 1431, Chácara Santo Antônio, São Paulo/SP.
* Registration requires a NIC.br Courses and Events Portal account; registration deadline is July 20th.
* Presentations include topics on automated malware analysis using free tools (IDA Free, Ghidra, etc.).
* A session addresses the operational layer of data exposure involving illicit querying panels.
* Lessons from ransomware post-mortem analysis focusing on server logs are presented.
* Using NetFlow/IPFIX for cybersecurity in financial institutions based on CMN Resolutions.
* Analysis of root causes for high-impact financial incidents, including hardcoded credentials and lack of MFA.
* Methodologies combining CSIRT, DFIR, and data protection for investigating sensitive data access.
* Discussion on Zero Trust architecture using Open Source tools to manage privileged accounts.
* A presentation covers the CTI lifecycle, role of a CTI analyst, and the CTI-CMM Model.
* Topics include integrating Generative AI in security, risk-based vulnerability management based on CVEs/EPSS, and operationalizing intelligence sharing via MISP.

The collective focus of these sessions demonstrates a movement from purely technical defense mechanisms toward understanding the systemic and operational realities of modern cyber risk. There is an emerging pattern where the core challenge shifts from simply blocking known threats to managing the complex, often intentionally obscured, pathways through which adversaries leverage legitimate systems and human processes. The juxtaposition of discussions on data leakage versus operationalized use, and between technical indicators (NetFlow) and legal/governance requirements (CMN Resolutions), suggests a growing recognition that security efficacy is inseparable from organizational structure and legal accountability.
The tension observed lies between the need for rapid, practical incident response—as highlighted by forensic analysis and threat hunting exercises—and the slower, more deliberate work required to establish robust governance frameworks (like those demanded by data protection laws or CTI lifecycle maturity). When an organization attempts to achieve both simultaneously, gaps emerge where technical controls may succeed while governance fails to address the organizational enablement of the attack. The integration discussions surrounding AI and MISP also reveal a dynamic where new tools promise enhanced visibility but introduce new vectors for complexity if not governed by principled, structured workflows.
This forces consideration of agency: when operationalizing intelligence (MISP) or implementing Zero Trust policies relies on deeply integrated systems (like endpoint state or administrative flows), the integrity of that control rests not just on the technology itself, but on the established trust mechanisms and accountability structures within the institution. The pattern suggests that true resilience is found at the intersection of technical capability, forensic depth, and transparent legal/organizational consequence.
Bridge Questions: If operationalizing data flow monitoring requires integrating processes across legal, IT, and security domains, where should the primary locus of accountability reside when an automated response based on telemetry leads to a regulatory exposure? How can organizations structurally ensure that post-mortem findings immediately translate into non-negotiable changes in governance and process, rather than remaining artifacts within the incident report? What mechanisms are necessary to prevent new technological capabilities, such as advanced AI tooling or large-scale IoC sharing, from outpacing established human oversight capacity?