Re: [cti-comment] STIX Course of Action object

[aa tt <atcyber1000@gmail.com>]

Hi Ben - 

There was a version of STIX CoA that was proposed (and actually included) previously in 2.1 that included a property to allow a pointer from CoA to a CACAO Playbook.

That was removed at the last minute from STIX2.1 due to lack of implementation verification that STIX2.1 required for inclusion of new features.

However, that spec work exists and could be used for either a) adding to STIX2.1 as standard or b) add to STIX2.1 COA as a standard extension for connecting STIX to CACAO.

At this point, I would suggest b) is the best path forward.

If you would like suggestions on how to do that then we can talk off-line.

Allan

On Mar 16, 2021, at 9:25 AM, Ben Whale <bwhale@caci.co.uk> wrote:

Hi all, 

I was wondering how the thinking behind the STIX Course of Action object is developing? We are considering using the course of action object in a system we are developing and are interested in the potential of capturing a machine automatable action within it. Given the development of the CACAO standard, is it likely that STIX will adopt CACAO in the action field, or is there other current thinking around this? 

Kind regards, 

Ben Whale 

Software Engineer, 
CACI Ltd

This electronic message contains information from CACI International Inc or
subsidiary companies, which may be confidential, proprietary,
privileged or otherwise protected from disclosure.  The information is
intended to be used solely by the recipient(s) named above.  If you are not
an intended recipient, be aware that any review, disclosure, copying,
distribution or use of this transmission or its contents is prohibited.  If
you have received this transmission in error, please notify us immediately
at postmaster@caci.co.uk
Viruses: Although we have taken steps to ensure that this e-mail and 
attachments are free from any virus, we advise that in keeping with good 
computing practice the recipient should ensure they are actually virus free.

CACI Limited. Registered in England & Wales. Registration No. 1649776. CACI House, Avonmore Road, London, W14 8TS

Attachment: signature.asc
Description: Message signed with OpenPGP