Joint Regional Symposium Europe February 2026: Agenda

Trainers

• Sergio Albea
• Angel Ares Arias

The Workshop

This is a practical Threat Hunting workshop where we’ll dive into real-world threat scenarios based on multiple cases observed during this 2025.

Don’t worry if you’re not familiar with this topic — this workshop is designed for all skill levels, oriented to Threat Hunting, and we’ll start with a clear and simple introduction to basic detections so you can get comfortable before jumping into the action.

What to Expect?

Learn how to hunt for threats across different scenario such as:
- Network-based threats
- Identity-based anomalies
- Host-based suspicious behavior
- Apply Threat Intelligence on Threat Hunting
- Explore how to turn raw data into real detections
- Discover how to build your own hunting queries and detection rules

Bring Your Laptop!

You’ll need your computer — in the second part of the session, we’ll break into groups to solve real-world threat hunting cases using the tools and queries we explored during the training.

Trainers

• Alexandre Dulaunoy

The Workshop

This hands-on workshop introduces the open-source Vulnerability Lookup project and the Global Common Vulnerabilities and Exposures (GCVE.eu) initiative, two complementary efforts designed to modernize and decentralize the way vulnerabilities are published, shared, and consumed.

Participants discovered how Vulnerability Lookup acts as a collaborative platform for collecting, enriching, and analyzing vulnerability data, supporting every stage of the vulnerability management lifecycle, from discovery and prioritization to tracking remediation and assessing exposure. The session introduced GCVE, a next-generation, decentralized framework for vulnerability identification that empowers organizations to act as GCVE Numbering Authorities (GNAs) with greater autonomy and flexibility.

• How to publish and synchronize vulnerabilities using the GCVE and vulnerability-lookup ReST API.
• How decentralized allocation empowers vendors, researchers, and CSIRTs to disclose vulnerabilities more efficiently.
• How to leverage Vulnerability Lookup to support vulnerability triage, enrichment (EPSS, CVSS, Multi KEV), and exposure tracking.
• How Vulnerability Lookup integrates with GCVE to provide real-time insights, cross-references, and analytics.
• Best practices for integrating GCVE and Vulnerability Lookup into your existing vulnerability management workflows.

Background Information

• Website https://www.vulnerability-lookup.org/ - https://gcve.eu/
• Online service of vulnerability-lookup at CIRCL - https://vulnerability.circl.lu/

Trainers

• Marcin Fronczak
• Miroslaw Maj

The Training

This half-day training uses CyberBastion, an interactive simulation and training platform designed to teach prevention and response to cyberattacks through practical, scenario-based exercises. Participants work in small teams and learn how to build, operate, and defend a complex ICT environment under realistic constraints.

CyberBastion simulates the functioning of an organisation exposed to cyber threats. Each team receives a predefined budget that can be increased during the game. Participants must choose and deploy security measures across eight categories: Organization, Physical Infrastructure, Entire Network, Network Perimeter, Internal Network, Endpoints, Applications, and Data.

Each security measure provides a different contribution to prevention and response. The winning team is the one that most effectively prepares its environment for cyber incidents.

The training consists of four progressively more complex scenarios.

1. Demo Scenario – Introduction to platform and mechanics.
2. Basic Scenario – Fundamentals of defensive strategies and incident reaction.
3. Advanced Scenario (with Playbooks & Data Sources) – Complex attacks with predefined playbooks.
4. Advanced Scenario – TTX Mode – Discussion-based exercise with separate roles: CSIRTs, internal CSIRTs, authorities, vendors, ISACs.

Target Audience

National and sectoral CSIRTs, enterprise/internal CSIRTs, SOC teams, analysts, incident responders, cybersecurity teams of essential service operators, authorities, vendors, ISACs.

Learning Objectives

During the training, participants gradually develop a practical understanding of how to build a resilient security posture while working under real-world constraints. They experience the consequences of strategic choices and learn to balance preventive and responsive capabilities. The scenarios guide them through coordinated incident handling, showing how effective teamwork, structured playbooks, and available data sources support decision‑making throughout the incident lifecycle. An important element of the training is also improving communication and collaboration in a multi‑stakeholder environment, reflecting the dynamics between CSIRTs, operators of essential services, vendors, and authorities.

Requirements

Participants should bring laptops configured for access to a public internet connection.

Trainers

• Armins Palms
• Dana Ludviga

The Workshop

There are many ticketing systems available to help manage and oversee the daily work of an Incident Response (IR) team. Among them, RTIR (Request Tracker for Incident Response) is one of the most widely used systems by CERT and CSIRT teams. It offers extensive functionality, including support for manual scripting. However, to truly extend RTIR’s capabilities, it’s often necessary to go beyond the standard interface and leverage its API.

In this workshop, you will learn how to enhance RTIR through automation and integration.

Using the RTIR API, you will explore how to:

• Prepare RTIR for automation
• Parse and process incoming events
• Automate routine tasks within RTIR
• Enrich tickets with data from external sources
• Integrate RTIR with external tools such as Mattermost

This hands-on course is designed for beginners and provides the foundational knowledge needed to automate and extend RTIR. By the end of the workshop, participants will be equipped with the skills to customize and automate their organization’s RTIR environment to better suit their needs.