cacao — archive

How best to do multiple actions

From: Frans Schippers <[email protected]>
To: [email protected]
Date: Thu, 19 Sep 2019 10:47:00 -0000

Vasileios I would be willing to help. See email I send to the list about this. Frans Schippers Cyber Security Lecturer / Researcher Amsterdam Universe of Applied Science HBO-ICT Wibautstraat 2-4 1091 GM Amsterdam PGP: 12D1 D930 488C 22B7 6AFF BFF7 218C 865E D6E0 6B48 > On 19 Sep 2019, at 10:39, Vasileios Mavroeidis <[email protected]> wrote: > > +1 > > Having two abstract layers, one for the actions and one for logic would allow to reuse the actions (in a more appropriate manner/better engineering). I can imagine that I have a bucket that is filled with actions that I can re-use. > > This can also support the use of playbooks in deriving extra intelligence and insights. Just a thought, for example in terms of CTI, we can map and visualise playbooks in respect to common actions related to IoCs easily and why not having a similarity index that can show overlap percentage among playbooks. > > Ill try to engineer a schema for the second approach starting next week. If somebody wants to help please let me know. > > > Best, > > Vasileios Mavroeidis Security Researcher and Ph.D. Research Fellow > Research Group of Information and Cyber Security (SECURITY) > SecurityLab > University of Oslo > >> On 18 Sep 2019, at 19:24, Ghosh, Anup A. <[email protected]> wrote: >> >> Hi Bret, >> >> I think this is a useful discussion to get us thinking about these details. I like the second approach for the following reasons: it lists the atomic actions which can be considered building blocks to a play. The play then is able to add (temporal) logic to the building blocks to meet both the end objective of the play as well as capture the dependencies. Different plays will have different logic and dependencies which allows us to re-use the building blocks rather than starting from scratch each time. >> >> Thanks! >> >> Anup >> >>