  Many CSIRTs, including national CSIRTs, routinely use public data, including
open-source intelligence (OSINT) and free tools, which include open-source
tools in their work. However, we observed a lack of public information and
systematic discussions regarding how national CSIRTs use and perceive public
data and free tools in their operational practices. Therefore, this paper
provides a systematic literature review (SLR) to comprehensively understand how
national CSIRTs use and perceive public data and free tools in facilitating
incident responses in operations. Our SLR method followed a three-stage
approach: 1) a systematic search to identify relevant publications from
websites of pertinent CSIRT organisations, 2) a conventional SLR into the
research literature, and 3) synthesise data from stages one and two to answer
the research questions. In the first stage, we searched the websites of 100
national CSIRTs and 11 cross-CSIRT organisations to identify relevant
information about national CSIRTs. In the second stage, we searched a
scientific database (Scopus) to identify relevant research papers. Our primary
finding from the SLR is that most discussions concerning public data and free
tools by national CSIRTs are incomplete, ad hoc, or fragmented. We discovered a
lack of discussions on how the staff of national CSIRTs perceive the usefulness
of public data and free tools to facilitate incident responses. Such gaps can
prevent us from understanding how national CSIRTs can benefit from public data
and free tools and how other organisations, individuals and researchers can
help by providing such data and tools to improve national CSIRTs' operation.
These findings call for more empirical research on how national CSIRTs use and
perceive public data and free tools to improve the overall incident responses
at national CSIRTs and other incident response organisations.
