Subject: [Cacao] Summary

From: Bret Jordan <[email-masked]>
Date: Fri, 24 May 2019 12:00:02 -0600

And just to summarize for people here on the list..

This work needs to be able to define a playbook in JSON that can be linked to other threat intelligence.  We need the ability to share and collaborate on playbooks between trust groups, organizations, vendors, etc.  This means we need a standardized way of sharing the standardized playbook.  We also need the ability to send a playbook or part of a playbook to a device, product, or orchestrator and then receive back verification messages that the commands were processed, acted on, etc.  So this means:

A JSON model for playbooks
Playbooks and actions, and action trees need to have IDs that are globally unique, say UUIDv4
A taxonomy for various types of commands that can be included in an action
Ability to digitally sign these in parts or in whole while keeping the plain text JSON (JCS will help us here)
Ability to send to devices and get standardized messages back. So we will need a taxonomy for the messages as well.
We need to pick a protocol that vendors and groups can implement. Or a way of calling out what protocol must be used at the action level. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."