Playbook Types

Hi All,

On the working call yesterday there was a discussion about section 1.3 of the CACAO working document. Some of the important points:

The difference between an executable playbook and a playbook template is mostly subjective. There are suggestions to the text to help clarify this.
There is no difference between an executable playbook and a playbook template in terms of their properties
The term paybook class is confusing, since it is specified using the type property of a playbook.

A suggested proposal is to remove the concept of playbook classes, and replace it by a new Boolean property, maybe called “is_executable”, to differentiate between executable playbooks and playbook templates.

Rich

Rich Piazza

Lead Cyber Security Engineer

The MITRE Corporation

781-271-3760

––––––––––––––––––––––––––––––––––––

MITRE - Solving Problems for a Safer World™

cacao message