All,
There is an issue that has been raised in the document, and we have had some back and forth on slack about what to do or not to do. The problem, as far as I understand it, is there is no way for a tool to understand if the JSON data is a CACAO playbook or some sort of other playbook. In STIX we solved this by using TAXII and defining MIME Types. But we do not have a transport for CACAO, at least not yet.Â
I think the concern is valid and should warrant some sort of proposedÂsolution that is acceptable.
There are several things that have already been proposed, but let me summarize those here and add maybe a different oneÂor two.Â
1) Change the playbook type from "playbook" to "cacao-playbook"
2) Change the ID from "playbook--uuid" to "cacao-playbook--uuid"
3) Change both the type and ID as shown in 1 and 2 above
4) Change the spec_version property to have a value of "cacao-1.1"
5) Another option would be to have a new property all together that is called "spec" and we give it a value of "cacao".Â
Once again I think the issue that was raised is valid and we should find a solution that works.Â
Thanks
Bret