# National CERTs URL: https://www.deepinfo.com/audience/national-certs/ ## Exposure Visibility at the Scale of a Country. A national CERT answers for institutions it does not operate: ministries, banks, operators, hospitals, universities. Its questions run across all of them at once, and often across every domain under the country code. The Deepinfo Platform gives a CERT portfolios that scan and score each constituent on one scale, and the index underneath, queried through the API or delivered as bulk files. [Talk to us](https://www.deepinfo.com/contact/) [Browse the data feeds](https://www.deepinfo.com/data-api/feeds/) ### The Jobs That Sit Above One Organization. A national CERT coordinates. It watches across constituents, warns the ones at risk and gets hostile infrastructure taken down, all with data from outside any one network. Watch #### Sector Exposure Follow the external posture of the institutions in each critical sector, and see which ones fall behind. Warn #### Constituent Alerts When a CVE joins CISA KEV, see which monitored constituent assets carry it and warn those owners first. Remove #### Hostile Infrastructure Lookalikes of ministries, banks and public services, with the DNS, certificate and HTTP evidence a registrar or host needs to act. Research #### Country-Wide Questions Questions that span all domains under your country code, including ones no constituent registered. ### Constituents Scored on One Shared Scale. The platform keeps organizations other than your own as portfolios. Third-Party Risk Management uses them for vendors, groups use them for subsidiaries, and a CERT can hold one per constituent. Each portfolio gets its own discovery, its own scans across all data layers and its own score, on a scale shared with the rest. A sector then reads as a set of comparable scores, not a stack of self-assessments. [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) - **Scanning**: All data layers, per asset, per constituent - **Issue states**: With the history of every change - **Severity**: From Critical to Information - **Notifications**: Including a drop in a domain’s score ### Questions Only the Index Can Answer. Some questions concern the whole country rather than a list of constituents. Deep Search & Insights filters every domain in the index on WHOIS, DNS, IP history, SSL and web data, and its finders pivot from one indicator to everything that shares it. - 400M+ domains: across every TLD - 2B+ subdomains: discovered and resolved - 200B+ DNS records: cumulative, with history - 30B+ SSL certificates: indexed #### Which Domains Under Our Country Code Serve a Self-Signed or Invalid Certificate? `domain-search` #### Which Recently Registered Names Sit Close to a Ministry’s or a National Bank’s? `domain-search` with `fuzzy` #### How Many Domains Were Registered This Week, Which TLDs Led, and Which Name Keywords Recur? `registration-stats`, `tld-stats`, `keyword-stats` #### What Else Did the Registrant of a Phishing Domain Register Within the Same Hour? `sametime-domain-finder` #### Which Domains Share This Mail Server, Name Server or IP Address? `reverse-mx`, `reverse-ns`, `reverse-ip` #### Which CVEs Joined CISA KEV This Month, and How Do They Rank by EPSS? `vulnerability-search` [Domain Search reference](https://docs.deepinfo.com/reference/discovery/domain-search/) ### Get the Domain Layer as Files. Some analysis belongs inside your own environment, next to data only you hold. Deepinfo Data Feeds deliver the domain layer as files, CSV or JSON, each fetched through a pre-signed link that is valid for one hour. The files: [All Domains](https://www.deepinfo.com/data-api/feeds/all-domain-names/), [All Subdomains](https://www.deepinfo.com/data-api/feeds/all-subdomains/), [Daily Registered Domains](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/), [Daily Updated Domains](https://www.deepinfo.com/data-api/feeds/daily-updated-domain-names/), [Daily Deleted Domains](https://www.deepinfo.com/data-api/feeds/daily-deleted-domain-names/) and [Daily Discovered Subdomains](https://www.deepinfo.com/data-api/feeds/daily-discovered-subdomains/). [All data feeds](https://www.deepinfo.com/data-api/feeds/) ### See Who Targets Your Country’s Sectors. Cyber Threat Intelligence keeps a profile per threat actor: origin countries, the leak sites, forums and markets it appears in, and whom it targets, down to regions, countries, industries and organizations. Aggregate views rank the most targeted countries and industries and the CVEs and tools actors use most. A sector warning can then start from actor behavior as well as from vulnerability data. [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) - **Profiles**: Identity, origin, activity, targets - **Capabilities**: CVEs and tools used - **Aggregates**: Most targeted countries, industries - **Search**: Filters across profile fields ### The Modules a CERT Draws On. #### [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) The index, queried directly: Domain Search, reverse lookups, WHOIS and DNS history, vulnerability search and live lookups. #### [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) Portfolios for organizations other than yours, discovered, scanned across all data layers and scored on one scale. #### [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) Keyword rules with exact, fuzzy and confusable matching for the names of public institutions, monitoring of each approved lookalike across DNS, MX, SSL and HTTP, and Managed Takedown. #### [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/) Threat actor profiles by targeted country and industry, and dark web search by email domain, IP address or CVE. ### Questions About National CERTs **Can we cover the whole country beyond constituent domains?** Yes, through the index. Domain Search filters every domain Deepinfo knows about, including by extension, and the All Domains and All Subdomains feeds deliver the full lists as files. Portfolio monitoring is separate and covers the assets you add to it. **Is there a real-time feed of new registrations?** Not in the public API. New registrations arrive as a daily file, the [Daily Registered Domains](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/) feed, which lists the domains registered in the last day as of its `file_update_time`. **Can analysts work with the data in their own tools?** Yes. Every search and finder exports JSON or CSV, the feeds arrive as files, and the platform API covers findings, notifications and reports under one `apikey` header. **Can analysts port-scan any host?** No. [Port Scan](https://docs.deepinfo.com/reference/lookup/port-scan/) only targets hosts you own or are authorized to test. For other hosts, the index holds what it has observed: the domain record with its WHOIS, DNS, IP history, SSL and web data, and DNS and WHOIS history. **Does Deepinfo file takedown requests?** Managed Takedown is part of Brand Risk Protection: Deepinfo’s team assembles the evidence from monitoring and files the request with the registrar or host. Teams with their own reporting channels can use that evidence, exported through the API. **How are scope and terms agreed?** Directly with each CERT, starting from the sectors, the number of constituents and the data you need inside your environment. ### Start From Your Sector List. The opening conversation is operational: which sectors, how many constituents, which data you need in-house. We’ll say plainly what fits. [Talk to us](https://www.deepinfo.com/contact/) [Browse the data feeds](https://www.deepinfo.com/data-api/feeds/)