On the Integration of Course of Action Playbooks into Shareable Cyber Threat Intelligence

10/20/2021

∙

by   Vasileios Mavroeidis, et al.

∙

Broadcom

∙

Siemens AG

∙

UNIVERSITETET I OSLO

∙

0

∙

share

Motivated by the introduction of CACAO, the first open standard that harmonizes the way we document courses of action in a machine-readable format for interoperability, and the benefits for cybersecurity operations derived from utilizing, and coupling and sharing course of action playbooks with cyber threat intelligence, we introduce a uniform metadata template that supports the management and integration of course of action playbooks into knowledge representation and knowledge management systems. We demonstrate the applicability of our approach through two use-case implementations where the proposed playbook metadata template is utilized to introduce and integrate course of action playbooks, such as CACAO, into the MISP threat intelligence platform and the OASIS Threat Actor Context ontology.