MoRENet CSIRT uses flow analysis tools (Netflow), MRTGs, Intrusion Detection Systems (IDS), honeypots deployed at various points in its backbone to monitor traffic flowing over the network and to obtain statistics and detect anomalies and irregular use of the network.

These tools enable MoRENet CSIRT to identify possible attacks and their characteristics and create a knowledge base of incidents that allow to improve the capacity of reaction to eventual attacks.