Our Mission: We improve network security by identifying and detecting threats early; sharing data in near real time; and playing an active role in providing the knowledge, capability, and capacity to secure and monitor valuable networks.

Achieving network situational awareness depends on an organization's ability to effectively monitor its networks and, ultimately, to analyze that data to detect malicious activity. The CERT Network Situational Awareness (NetSA) group has analyzed hundreds of real-world cases of malicious activity on large, enterprise-scale networks to develop tools and approaches that can help organizations defend their networks from potential attacks.

The CERT NetSA group works to provide broad quantitative insights on network traffic characteristics relevant to the security of the networks involved. This insight ranges from descriptive (What is happening on the network right now? What changed before and after an incident?) to exploratory (What new traffic is appearing on the network? How often does an event happen?) to predictive (If this change is made, what will the impact be? How effective will this kind of additional protection be?). The tools and methods providing this insight are in a constant state of development and improvement. Learn more about our work.