Current FIRST Special Interest Groups

Special Interest Groups exist to provide a forum where FIRST Members can discuss topics of common interest to the Incident Response community. A SIG is a group of individuals composed of FIRST Members and invited parties, typically coming together to explore an area of interest or specific technology area, with a goal of collaborating and sharing expertise and experiences to address common challenges.

These are the FIRST SIGs currently active:


Abuse Handling (AH-SIG)

To improve abuse handling on the Internet, by bringing together abuse teams worldwide, encouraging the exchange of experiences and developing best practices.


Artifact Analysis (AA-SIG)

To improve Artifact Analysis Capability within the FIRST community.


Common Vulnerabilities Scoring System (CVSS-SIG)

The biggest challenge facing any new standard is the universal adoption of the standard. In order to address the inconsistency of scoring metrics for vulnerabilities, FIRST believes that a global approach towards adoption of the new standard is the best strategy.

CSIRT Metrics SIG

This SIG aims to improve CSIRT incident management practices within the FIRST community.


Internet Infrastructure Vendors (Vendor SIG)

The goal of this SIG is to provide forum for Internet Infrastructure vendors. In this context Internet infrastructure is considered to be Operating Systems, computer hardware, networking equipment and critical applications.

Law Enforcement/CSIRT Cooperation (LECC-SIG)

To further co-operation between Incident Response and Law Enforcement, by the development of better understanding of organisational mission and specific requirements and producing practical trust and information-sharing protocols.


Network Monitoring (NM-SIG)

To advocate, develop and promote knowledge and techniques for collection and analysis of network sensor and monitoring data to build the capabilities of CSIRTs to quantify and measure malicious activity on networks to create more secure systems.