RT @davehull: Mature CIRTs gather intel on their attackers. What sources & methods are used for this? <- added ? to S ...