<p>Attendees: David Crooks, Liviu Valsan, Adam Bouthcer, George Field, James McLoughlin, Jiarong Wang, Manon, Michael Davis, Mihai Carabas, Nicole Stewart, Romain Wartel, Sven Gabriel, Tian Yan, Vlad Grigorescu, Nigel Watkinson</p>

<p>Outcomes:</p>

<p>Especially going forward, working group has sites and organisations of different types and at different stages:</p>

<ul>
	<li>Orgs with mature operational security facilities and tools: would benefit from best ways of working with threat intelligence, how to optimally use the central MISP instance, etc</li>
	<li>Places that are implementing SOC components from ~scratch, who would benefit from help starting up, including deployment guides, tuning help and so on.</li>
</ul>

<p>From this and other discussions, consider a set of distinct strands:</p>

<ul>
	<li>new deployments (bootstrapping)</li>
	<li>optimising use of threat intelligence (inc translation between formats)</li>
	<li>containerisation (training/demos/canned deployments for small bandwidth context)</li>
	<li>High bandwidth network contexts (&gt;100G)&nbsp;</li>
</ul>

<p>Intent is to have members identify which of these strands they could contribute to then work can continue somewhat in parallel.</p>