7. Which Tools does a CSIRT need?

There are various tools available that enable a CSIRT to carry out its functions, many of them being open source and therefore free to use.  

The GFCE has identified various open-source and commercial tools to enable CSIRTs to provide services in the five service areas given in the FIRST CSIRT Services Framework of Information Security Event Management  (ISEM), Information Security, Incident Management (ISIM), Vulnerability Management (VM), Situational Awareness (SA), and Knowledge Transfer (KT).

FIRST provides a list of security tools (Appendix C) for domain and IP address query, network monitoring, network auditing, vulnerability assessment, intrusion detection, malware analysis, and WiFi tools.