Hi Ben -
There was a version of STIX CoA that was proposed (and actually included) previously in 2.1 that included a property to allow a pointer from CoA to a CACAO Playbook.
That was removed at the last minute from STIX2.1 due to lack of implementation verification that STIX2.1 required for inclusion of new features.
However, that spec work exists and could be used for either a) adding to STIX2.1 as standard or b) add to STIX2.1 COA as a standard extension for connecting STIX to CACAO.
At this point, I would suggest b) is the best path forward.
If you would like suggestions on how to do that then we can talk off-line.
Allan
On Mar 16, 2021, at 9:25 AM, Ben Whale <> wrote:
Hi all, I was wondering how the thinking behind the STIX Course of Action object is developing? We are considering using the course of action object in a system we are developing and are interested in the potential of capturing a machine automatable action within it. Given the development of the CACAO standard, is it likely that STIX will adopt CACAO in the action field, or is there other current thinking around this? Kind regards, Ben Whale Software Engineer, CACI Ltd
This electronic message contains information from CACI International Inc orsubsidiary companies, which may be confidential, proprietary,privileged or otherwise protected from disclosure. The information isintended to be used solely by the recipient(s) named above. If you are notan intended recipient, be aware that any review, disclosure, copying,distribution or use of this transmission or its contents is prohibited. Ifyou have received this transmission in error, please notify us immediatelyat : Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free.
CACI Limited. Registered in England & Wales. Registration No. 1649776. CACI House, Avonmore Road, London, W14 8TS
Attachment:
signature.asc
Description: Message signed with OpenPGP
