SURICON AMSTERDAM2019 - CERTitude: An open-source and agentless compromise assessment tool - Who are we, Why are we here, and the needs behind the tool

Sep 17, 2026

Upload by Blitz

SURICON AMSTERDAM2019 introduces CERT-W personnel and their internal organization within cybersecurity and digital trust. It explains the historical role of the Open Information Security Foundation (OISF) and how ANSSI support led to CERTitude being presented as a candidate for sponsorship. The document details why CERTitude was built: fast compromise assessment of workstations and servers, compliance-driven IOC search for French companies, and support for REC assignments. It also highlights infosec incentives and a brief chronology of tool development from Scanopy to a rework starting in 2019, ending with an assignment workflow toward identifying IOC.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages41

Reading Time1 h 43 min

AccessFree to download

$whoarewe

VAVESTONE

Internal organization

Our activities

$whyarewehere

CERTitude-the needs behind the tool

Business needs

Infosec incentives

Chronology

A short story about digital forensics assignments

SURICON审角AMSTERDAM2019@ERTITUDEAn open-source and agentless compromiseassessment tool@iansus |@nguvinIVAVESTONE # $whoarewe Jean MARSAULT CERT-W-Head of R&D @iansus 》 Original dev of CERTitude 》Player for YoloSw4g CTF 》Likes penetration tests andDFIR 》Also likes beer-any suggestion in Amsterdam? Vincent NGUYEN Head of the CERT-W @nguvin 》I'm Batman(shhht) SURICON AMSTERDAM2019 # VAVESTONE Internal organization 》 Split into 18 business and technological practices》 Working in the Cybersecurity and Digital Trust practice》 Attached to the \#Pool-Audit and CERT-W teams Our activities 》 Security audits and penetration tests 》 Digital forensics,Incident response and Cyber crises 》Research &Development(5+ongoing projects) # $whyarewehere Historically,the Open Information Security Foundation(OISF)was builtcirca 2010 around the Suricata IDS/IPS project to support and raisefunds for the tool's development. 1 OISF $whyarewehere Historically,the Open Information Security Foundation(OISF)was builtcirca 2010 around the Suricata IDS/IPS project to support and raisefunds for the tool's development. 1 In 2016,the National Cybersecurity Agency of France(ANSSI)joined theOISF as a gold member to highlight the wish to see France get involvedin worldwide open-source security projects. 2 OISF $whyarewehere Historically,the Open Information Security Foundation(OISF)was builtcirca 2010 around the Suricata IDS/IPS project to support and raisefunds for the tool's development. 1 In 2016,the National Cybersecurity Agency of France(ANSSI)joined theOISF as a gold member to highlight the wish to see France get involvedin worldwide open-source security projects. 2 In 2019,in coordination with the ANSSI,Wavestone decided to presentits tool CERTitude as a candidate to be sponsored by the OISF 3 # CERTitude-the needs behind the tool Business needs 》 A field need:quickly assess which workstations and servers have been compromised 》 A compliance need:French companies should be able to perform search campaignswhen provided with indicators of compromise(IOC)from the ANSSI 》 Also stated in the PRIS qualification from the ANSSI that qualified investigationservices providers must be able to perform REC assignments(IOC search) # CERTitude-the needs behind the tool Business needs 》 A field need:quickly assess which workstations and servers have been compromised 》 A compliance need:French companies should be able to perform search campaignswhen provided with indicators of compromise (IOC)from the ANSSI 》 Also stated in the PRIS qualification from the ANSSI that qualified investigationservices providers must be able to perform REC assignments(IOC search) # Infosec incentives 》 Be able to interact with the worldwide Threat Intelligence sphere: 》 Be a part of the global "IOC sharing"between private and state actors(MISP,Mitre ATT&CK,etc.) 》Know your enemy better:"Supreme excellence consists of breaking the enemy's resistance withoutfighting”(Sun-Tzu) # CERTitude-the needs behind the tool Business needs 》 A field need:quickly assess which workstations and servers have been compromised 》 A compliance need:French companies should be able to perform search campaignswhen provided with indicators of compromise (IOC)from the ANSSI 》 Also stated in the PRIS qualification from the ANSSI that qualified investigationservices providers must be able to perform REC assignments(IOC search) # Infosec incentives 》 Be able to interact with the worldwide Threat Intelligence sphere: Be a part of the global "IOC sharing"between private and state actors(MISP,Mitre ATT&CK,etc.) Know your enemy better:"Supreme excellence consists of breaking the enemy's resistance withoutfighting”(Sun-Tzu) Chronology 2013 》Scanopy,a first approach toautomating IOC tooling 2014/2015 》 First version of CERTitude,presented at the CORI&IN 2015 to 2017 》 First tests of the toolinternally and

FAQs

Who are the key people introduced in the document?

Jean Marsault (CERT-W Head of R&D) and Vincent Nguyen (Head of the CERT-W) are introduced along with brief background and interests.

Why was CERTitude developed according to the document?

It was built to quickly assess compromised workstations and servers and to support compliance needs such as IOC search campaigns using ANSSI-provided indicators, including REC assignments.

How is CERTitude connected to OISF and ANSSI?

OISF was historically formed around the Suricata project, ANSSI joined as a gold member, and in 2019 (with ANSSI coordination) Wavestone presented CERTitude as a candidate to be sponsored by OISF.

Sep 17, 2026

Upload by Blitz