TG2 – Inter-SOC Cooperation

The operational cooperation pillar provides a trusted framework for Identity-SOC-to-Identity-SOC sharing, threat detection and coordinated analysis. Participating SOCs can correlate operational information and identify emerging attack patterns.

• Inter-Identity-SOC cooperation and identity-focused operational intelligence exchange.
• Share and correlate Indicators of Compromise (IoCs), detection rules and indicators.
• OSINT collection and analysis; detect leaked credentials and cryptographic keys.
• Identify compromised assets, attacker signatures, TTPs and recurring patterns.
• Issue early warnings and jointly analyse significant threats or attack campaigns.
• Exchange mitigation practices, coordinate operational response where relevant and escalate new attack techniques to the other groups.

• Operational Threat Intelligence
• IoCs and Detection Indicators
• Early Warnings
• Operational Intelligence Packages: identity-fraud signals, IoCs, detection rules and warning indicators

The Steering Committee coordinates the groups and validates critical deliverables before adoption or external use. Confidentiality rules apply to operational information and its distribution.