-
Type: Task
-
Status: Closed
-
Priority: Major
-
Resolution: Won't Do
-
Component/s: Version control request
-
Labels:None
-
Environment:
OpenC2
Your name:
David Lemire
Project name:
Open Command and Control (OpenC2)
Project email address:
[1]openc2@lists.oasis-open.org
GitHub repository name:
openc2-ap-hunt
Description
OASIS OpenC2 TC: This GitHub repository is used to develop an Actuator Profile to manage threat hunting activities. The AP will define the Actions, Targets, Specifiers and Options to manage Threat Hunting consistent with the OpenC2 Language Specification.
Purpose statement:
This specification defines an actuator profile to automate management of cyber threat hunting activities using OpenC2. Threat hunting is the process of proactively and iteratively searching through networks and on endpoints to detect and isolate cyber observables that may indicate threats that evade existing security solutions. This actuator profile defines the OpenC2 Actions, Targets, Arguments, and Specifiers along with conformance clauses to enable the operation of OpenC2 Producers and Consumers in the context of cyber threat hunting. It covers invocation of stored hunting processes (e.g., “hunt books”), passing of hunt parameters, selection of analytics to apply to hunt data, and the expected type(s) and format(s) of information returned by hunting processes.
Maintainer(s):
David Lemire, david.lemire@hii-tsd.com, dlemire60, National Security Agency
Duncan Sparrell, duncan@sfractal.com, sparrell, sFractal Consulting LLC
Michael Rosa, mjrosa@cyber.nsa.gov, mjrosa, National Security Agency
Approval:
[2]https://www.oasis-open.org/committees/document.php?document_id=70577&wg_abbrev=openc2
Notes:
Motion for approval is in section 3.1 of the referenced meeting minutes. A companion ticket has been submitted for a starter document in Markdown format.
The Write Team for this repository is consistent with the TC's conventions of including Secretary and Co-chairs as maintainers.
----------------------------------------------------------------------------------------
[1] openc2@lists.oasis-open.org
[2] https://www.oasis-open.org/committees/document.php?document_id=70577&wg_abbrev=openc2