updated COA proposal && additional topic for working call tomorrow

[Allan Thomson <athomson@lookingglasscyber.com>]

All â

 

Please find a link to a Course of Action simplified proposal that builds upon the 2.0 specification of COA.

 

https://docs.google.com/document/d/1jAZiyo0M5TpKLPQRFR9O7Ct67v_AxudTbL2rQf5dCic/edit?usp=sharing

 

Summary of Proposal

 

1. Added action_type
   1. Why: To allow the producer to define whether the COA has embedded content or referenced content (similar to Artifact object)
2. Added property action_ref
   1. Why: To allow referencing external coa content to the STIX COA object instead of having to embedded all COA definitions/actions
3. Changed action reserved property to well-defined meaning/definition that allows numerous content types based on action_type to be embedded on COA
4. Added 2 new named relationships for investigates & remediates
   1. Why: Support additional uses of a COA that are commonly used in the industry

 

The changes proposed in this document would replace the existing proposal for STIX2.1 COA work as several of the authors of that proposal have decided to submit this new simpler proposal for easy adoption.

 

The link allows comments in the document but if you have questions and are able to join the working call tomorrow please do.

 

This is a very much simplified proposal for COA to make it more useful/usable in STIX2.1 and therefore would propose we adopt this work quickly for inclusion the next STIX2.1 CSD.

 

Regards

 

Allan