Immunity: One Hour at Moldova's National CSIRT | Memory and Reflex, Part 3

Monday, 10h12m. At the end of Part 1, Ana didn't paste the command: she reported the email. Now her report reaches Moldova's Cybersecurity Agency, the country's national CSIRT. Follow the next hour from one analyst's chair: one report becomes a warning to forty institutions, and at 11h40m one of them answers that its computers have been talking to the attacker since Friday. A SIEM is an organization's memory. An XDR is its reflex. A national CSIRT is a country's immune system: it can't live inside every body, so it learns from one infection and teaches the rest to recognize it. Each step is shown twice: as Moldova's law and the Agency's public record show it in 2026, and as a mature national team does it. For anyone who wants to know how a national CSIRT works, or is preparing to work in one: SOC and CSIRT analysts, public-sector IT and security staff, students. What you'll learn • The Agency's four roles, the two legal doors for a public body's report (through CERT-GOV-MD or direct), what it can and can't do without sensors, and the gaps the National Programme 2026–2030 names • Seeing without sensors: the reporting form, handling a lure in isolation, why a public scanner can tip off the attacker, PAP, passive DNS, a private sandbox, and how CERT Polska handles reports at scale • Antibodies in MISP: events and attributes, the to_ids flag, warning lists (a blocked CDN address is autoimmunity), sharing groups vs the default, sightings and decay, the Pyramid of Pain; CVE, CVSS, EPSS, KEV, EUVD and CISA's BOD 26-04; coordinated vulnerability disclosure under Government Decision 824 • Writing the alert: early warning vs notificare, alert vs advisory, TLP 2.0, real formats from Moldova and from CISA, a Sigma rule and a KQL query sent with it, and a request to search logs back to Friday • When a second victim appears: the sighting, the 24-hour, 72-hour and one-month clocks that start at awareness, when an unannounced inspection is possible, the duty to warn users, help on request (CNAM, 2026), and where crisis thresholds are set • Vaccination: why a phishing simulation should count reports, not clicks, what Lithuania's national rounds showed, and why the people who click are never punished • The same hour side by side, Moldova and mature practice; six legal acts in one line each, and how the civil-service competition (the concurs) for such a post tests them Seven times the film stops with a question in the style of a written test or an interview. Answer before the countdown ends. Chapters 0:00 Cold open: Monday, 10:12 1:32 The immune system 5:27 Seeing without sensors 9:00 Antibodies 13:20 The alert 17:35 Patient zero is somewhere else 21:38 Vaccination 24:26 The same hour, two ways, and how the concurs asks 27:24 Recap Part 1, SIEM and XDR explained through one attack:    • SIEM and XDR, Explained Through One Attack...   Part 2, the same attack in Microsoft Sentinel and Defender XDR:    • Microsoft Sentinel and Defender XDR for SC...   Notes • The story is fiction: the Wells Registry, Ana, the second institution, the forty recipients, every time inside the hour, and the Agency's internal steps, tools and alert. The screen marks it ILLUSTRATION. IP addresses and domains come from ranges reserved for documentation (RFC 5737, .example). • The law and the practice are real. Moldova's acts, the Agency's and STISC's public record, the named cases and the mature practice are sourced line by line and fact-checked against primary sources (September 2026). Where the public record stops, the screen says NOT PUBLIC. No real staff are named; real documents are redrawn, without logos. • The gaps shown are the ones the government's own National Programme 2026–2030 names, shown as work to be done, not as criticism. • Sources include: Law 48/2023, the government decisions under it and the civil-service acts (legis.md); the Agency's 2025 report, 2026 plan and public alerts; STISC; the NIS2 directive; CERT Polska; FIRST; MISP and CIRCL; CISA; NCSC-UK; NCSC-NL; Lithuania's NKSC; ENISA; Bitdefender; NewsMaker; DataBreaches.net; field studies at UC San Diego Health and ETH Zürich. • Narration: AI voice (ElevenLabs). Animation made in code. • Not affiliated with or endorsed by the Cybersecurity Agency, STISC, or any team, vendor or agency named, and none of them reviewed it. MITRE ATT&CK® and CVE® are registered trademarks of The MITRE Corporation. #CSIRT #cybersecurity #Moldova