oasis-tcs / cacao Goto Github PK
View Code? Open in Web Editor NEWOASIS CACAO TC: Official repository for work of the CACAO TC https://github.com/oasis-tcs/cacao
License: Other
OASIS CACAO TC: Official repository for work of the CACAO TC https://github.com/oasis-tcs/cacao
License: Other
After carefully reading the CACAO v2.0 spec and looking at the examples there and in playbooks from the GH repo, I have some questions regarding the realities of OpenC2 commands being sent from CACAO playbooks. This is loosely related to issue #6.
First, we describe OpenC2 as the Acting capability at the end of a cyber defense OODA loop (e.g., IACD's S-SM-D-A loop) so there's an expectation that the details of the action to be taken are determined dynamically. If the OpenC2 command message is b64encoded w/in the playbook that doesn't seem to offer much opportunity for real-time adjustment. Even if there was a Block-Traffic-OC2 playbook that incorporated knowledge of all of the “firewall” elements in the infrastructure:
Second, there's a question of transferring (addressing) the OpenC2 command to the appropriate Consumer(s), either via the endpoint an HTTP POST would be sent to or the selection of a pub/sub topic to publish the comment onto. There's really nothing in the spec to indicate how the destination of a command would either be determined or passed to the transfer mechanism.
I’d be happy to learn more about how this is envisioned to operate in practice.
After careful review of the current CACAO specification I have a few detailed questions / comments:
The CACAO v2.0 spec includes a command type of openc2-http
which provides a starting point for integrating the two standards. However, this support needs updating:
openc2-mqtt
command type to use pub/sub message transfer and add our MQTT specification as a reference.Working on an OpenC2 extension for CACAO. Is there any underlying rationale for why the openc2-http
and http-api
commands in CACAO uniquely use content_b64
rather than command_b64
as the name of their base64-encoded field? It seems like a distinction without a difference.
Originally we had implemented a limited version of the STIX design for a hash property. However, it became clear that without extra details, there is no good way of implementing that. Meaning do you include the headers, or just the content. Is it the whole resource or just part of it. So we dropped this from the spec for now but need to add it back later when we do digital signatures.
The idea is to have playbooks that can contact/notify (or alert) one or more entities about a particular situation (proactive/ongoing/reactive) and share relevant information in different forms like structured threat information (STIX feeds), threat reports, information about an early-stage ongoing adversarial operation, notes, and also for disseminating actionable/executable playbooks for (example) detection and remediation.
We need a new playbook type as the proposed functionality cannot be reflected within one of the available playbook tags. Maybe call them notification playbooks.
The information is included by using the external_references property within the workflow steps. The URL of an external reference may direct the consumer (target of the workflow step) to secure infrastructure for accessing all the relevant information or the playbooks. The external_id field annotates the note, STIX bundle, CACAO playbooks to be accessed related to the notification issued.
Observing that:
Note that:
Hi - please point me in the right direction if this is not the appropriate place for this.
I am using the spec defined here to create an application that creates CACAO playbooks.
To do this, a couple of tools that are essential:
Both of these toolings can easily be created from a JSON Schema spec.
So question is:
Does a JSON Schema spec already exist?
Does it make sense to the committee to use a JSON schema spec?
For what it's worth, I currently have a tool that scrapes the documentation page and converts the tables into CSVs, and I then convert those into TypeScript typings. I can probably modify my tooling to convert to JSON Schema instead, at least to give a starting point.
Let me know if it'll be helpful, and I can give you my scripts and/or a generated JSON Schema
The following is the definition of step_variables
in the v2.0 CACAO Spec (emphasis added):
This property contains the variables that can be used within this workflow step or within commands, agents, and targets referenced by this workflow step. See section 10.18.2 for information about referencing variables.
The key for each entry in the dictionary MUST be a string that uniquely identifies the variable. The value for each key MUST be a CACAO variable data type (see section 10.18.3).
The first sentence refers to "variables, ... agents, and targets referenced" but then the second sentence limits the values to "a CACAO variable data type", which seems to exclude "agents, and targets". In addition, the Workflow Action Step example 4.3 calls out an agent independent of any step_variables
context:
{
"workflow": {
...,
"action--ba23c1b3-fdd2-4264-bc5b-c056c6862ba2": {
"type": "action",
"commands": [
{
"type": "manual",
"command": "Disconnect the machines from the network",
}
],
"agent": "individual--328a89ab-3b8f-40c4-a491-24a40bcd3cd4",
"delay": 5000,
"timeout": 60000,
"on_success": "action--e5f0d00d-3047-4432-8964-cc0c56e5ab12",
"on_failure": "action--e7e93280-ab26-45aa-baa8-423c44f917a6"
},
...
}
}
What is the correct / permitted content for step_variables
? There are no examples of this field in the spec.
What is the proper approach to linking agents and targets to actions steps? Is a correction to the spec text needed?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.