Hi All,
On the working call yesterday there was a discussion about section 1.3 of the CACAO working document. Some of the important points:
The difference between an executable playbook and a playbook template is mostly subjective. There are suggestions to the text to help clarify this.
There is no difference between an executable playbook and a playbook template in terms of their properties
The term paybook class is confusing, since it is specified using the type property of a playbook.
A suggested proposal is to remove the concept of playbook classes, and replace it by a new Boolean property, maybe called “is_executable”, to differentiate between executable playbooks and playbook templates.
Rich
--
Rich Piazza
Lead Cyber Security Engineer
The MITRE Corporation
781-271-3760
––––––––––––––––––––––––––––––––––––
MITRE - Solving Problems for a Safer World™
