-
The time at which the playbook was originally created.
-An object to manage, represent, and share course of action playbooks (security playbooks) for cyberspace defense.
+The security-playbook object provides meta-information and allows managing, storing, and sharing cybersecurity playbooks and orchestration workflows.
datetime |
-
- The time at which the playbook was originally created. - |
-
- - |
-
- - |
-
-||||||||||||
creator |
-text |
-
- The entity that created this playbook. It can be a natural person or an organization. It may be represented using an id that identifies the creator. - |
-
- - |
-
- - |
-|||||||||||
description |
text |
- More details, context, and possibly an explanation about what this playbook does and tries to accomplish. +An explanation, details, and more context about what this playbook does and tries to accomplish. |
@@ -59267,36 +59241,10 @@ security-playbook is a MISP object available in JSON format at id |
+labels |
text |
- A value that uniquely identifies the playbook. - |
-
- - |
-
- - |
-|||||||
impact |
-counter |
-
- An integer that represents the impact the playbook has on the organization from 0 to 100. A value of 0 means specifically undefined. Values range from 1, the lowest impact, to a value of 100, the highest. For example, a purely investigative playbook that is non-invasive would have a low impact value of 1, whereas a playbook that performs changes such as adding rules into a firewall would have a higher impact value. - |
-
- - |
-
- - |
-|||||||||||
label |
-text |
-
- An optional set of terms, labels or tags associated with this playbook (e.g., aliases of adversary groups or operations that this playbook is related to). +Labels for this playbook (e.g., adversary persona names, associated groups, malware family/variant/name that this playbook is related to). Another option is to use MISP tags, taxonomies, and galaxies. |
@@ -59306,23 +59254,23 @@ security-playbook is a MISP object available in JSON format at modified |
-datetime |
-
- The time that this particular version of the playbook was last modified. - |
-
- - |
-
- - |
-||||||||
organization-type |
text |
- Type of an organization, that the playbook is intended for. This can be an industry sector. +The type of organization that the playbook is intended for. This can be an industry sector. Another option is to use MISP tags, taxonomies, and galaxies. + |
+
+ + |
+
+ + |
+|||||||||||
playbook-abstraction |
+text |
+
+ The playbookâs level of abstraction (with regards to consumption). ['template', 'executable'] |
@@ -59332,10 +59280,10 @@ security-playbook is a MISP object available in JSON format at playbook |
-attachment |
+playbook-base64 |
+text |
- The whole playbook in its native format (e.g., CACAO JSON). Producers and consumers of playbooks use this property to share and retrieve playbooks. +The entire playbook file/document encoded in base64. |
@@ -59345,10 +59293,101 @@ security-playbook is a MISP object available in JSON format at playbook-abstraction |
+playbook-creation-time |
+datetime |
+
+ The date and time at which the playbook was originally created. + |
+
+ + |
+
+ + |
+||
playbook-creator |
text |
- Identifies the level of completeness of the playbook. ['guideline', 'playbook template', 'playbook', 'partial workflow', 'full workflow', 'fully scripted'] +The entity that created the playbook. It can be a natural person or an organization. It may be represented using a unique identifier that identifies the creator. + |
+
+ + |
+
+ + |
+|||||||||||
playbook-file |
+attachment |
+
+ The entire playbook file/document in its native format (e.g., CACAO JSON or BPMN). + |
+
+ + |
+
+ + |
+|||||||||||
playbook-id |
+text |
+
+ A value that uniquely identifies the playbook. If the playbook itself embeds an identifier then the playbook-id SHOULD use the same identifier (value). If not, the producer MAY generate a unique identifier for the playbook. + |
+
+ + |
+
+ + |
+|||||||||||
playbook-impact |
+text |
+
+ From 0 to 100, a value representing the impact the playbook has on the organization. A value of 0 means specifically undefined. Impact values range from 1, the lowest impact, to a value of 100, the highest. For example, a purely investigative playbook that is non-invasive could have a low impact value of 1. In contrast, a playbook that performs changes such as adding rules into a firewall should have a higher impact value. + |
+
+ + |
+
+ + |
+|||||||||||
playbook-modification-time |
+datetime |
+
+ The date and time at which the playbook was last modified. + |
+
+ + |
+
+ + |
+|||||||||||
playbook-priority |
+text |
+
+ From 0 to 100, a value representing the priority of this playbook relative to other defined playbooks. A value of 0 means specifically undefined. Priority values range from 1, the highest priority, to a value of 100, the lowest. + |
+
+ + |
+
+ + |
+|||||||||||
playbook-severity |
+text |
+
+ From 0 to 100, a value representing the seriousness of the conditions that this playbook addresses. A value of 0 means specifically undefined. Severity values range from 1, the lowest severity, to a value of 100, the highest. |
@@ -59361,7 +59400,7 @@ security-playbook is a MISP object available in JSON format at playbook-standard |
text |
- Identification of the playbook standard. +The standard/format/notation the playbook conforms to (e.g., CACAO, BPMN). |
@@ -59374,7 +59413,7 @@ security-playbook is a MISP object available in JSON format at playbook-type |
text |
- The security operational functions the playbook addresses. A playbook may account for multiple types (e.g., detection, investigation). ['notification playbook', 'detection playbook', 'investigation playbook', 'prevention playbook', 'mitigation playbook', 'remediation playbook', 'attack playbook'] +The security-related functions the playbook supports. A playbook may account for multiple types (e.g., detection and investigation). The listed options are based on the CACAO standard and NIST SP 800-61 rev2. Another option is to use MISP tags, taxonomies, and galaxies. ['notification', 'detection', 'investigation', 'prevention', 'mitigation', 'remediation', 'analysis', 'containment', 'eradication', 'recovery', 'attack'] |
@@ -59384,10 +59423,23 @@ security-playbook is a MISP object available in JSON format at priority |
-counter |
+playbook-valid-from |
+datetime |
- An integer that represents the priority of this playbook relative to other defined playbooks. A value of 0 means specifically undefined. Values range from 1, the highest priority, to a value of 100, the lowest. +The date and time from which the playbook is considered valid and the steps that it contains can be executed. + |
+
+ + |
+
+ + |
+
playbook-valid-until |
+datetime |
+
+ The date and time from which the playbook should no longer be considered a valid playbook to be executed. |
@@ -59400,46 +59452,7 @@ security-playbook is a MISP object available in JSON format at revoked |
boolean |
- A boolean that identifies if the playbook creator deems that this playbook is no longer valid. ['True', 'False'] - |
-
- - |
-
- - |
-||||||||
severity |
-counter |
-
- A positive integer that represents the seriousness of the conditions that this playbook addresses. A value of 0 means specifically undefined. Values range from 1, the lowest severity, to a value of 100, the highest. - |
-
- - |
-
- - |
-|||||||||||
valid-from |
-datetime |
-
- The time from which the playbook is considered valid and the steps that it contains can be executed. - |
-
- - |
-
- - |
-|||||||||||
valid-until |
-datetime |
-
- The time at which this playbook should no longer be considered a valid playbook to be executed. +A boolean that identifies if the playbook is no longer valid (revoked). ['True', 'False'] |