README
An OASIS Work Product Repository
Members of the OASIS Open Command and Control (OpenC2) Technical Committee use this GitHub repository as part of the TC's chartered work. Contributors must be Members of the TC. Work is governed by the OASIS policies and is not done under typical open source licensing. For more details, see the Contributions and Licensing sections below.
:blue_book: OpenC2 Extension for CACAO :blue_book:
The Collaborative Automated Course of Action Operations (CACAO) specification describes how cybersecurity automation playbooks can be created, documented, and shared in a structured and standardized way across organizational boundaries and technological solutions. This extension builds on existing CACAO v2.0 OpenC2 features to improve modularity and utilize the current OpenC2 Transfer Specifications for MQTT (v1.0) and HTTPS (v1.1).
:twisted_rightwards_arrows: Repository Organization :twisted_rightwards_arrows:
OpenC2 work product repositories are organized a bit differently than typical open source software project repositories:
- The Published (default) branch represents the current, stable, approved version of the work product. If the product hasn't progressed past an OASIS Committee Specification Draft (CSD), this branch is essentially empty.
- The Working branch is where all work-in-progress content is captured, and is the place to go for the current working version of this work product.
More information about the TC's repository organizing conventions and branching strategy can be found in our Documentation Norms.
:left_speech_bubble: Description :left_speech_bubble:
The OpenC2 Extension for CACAO will provide guidance for specifying the use of OpenC2 commands and transfer mechanisms in CACAO playbooks in order to facilitate standardization of OpenC2 use in that contexts. Specific goals for this specification include:
- Defining an updated CACAO OpenC2 Command Type not bound to a specific transfer mechanism (extending/replacing the command-type-ov defined in section 5.2 of the CACAO v2.0 spec).
- Defining standardized CACAO MQTT and HTTPS Agents for OpenC2 message transfers.
- Identifying CACAO control flow capabilities needed for OpenC2 (e.g., await Consumer response) that may be missing from CACAO v2.0 spec.
:writing_hand: Contributions :writing_hand:
As stated in this repository's CONTRIBUTING file, contributors to this repository are expected to be Members of the OASIS OpenC2 TC, for any substantive change requests. Anyone wishing to contribute to this GitHub project and participate in the TC's technical activity is invited to join as an OASIS TC Member. Public feedback is also accepted, subject to the terms of the OASIS Feedback License.
:scroll: Licensing :scroll:
Please see the LICENSE file for description of the license terms and OASIS policies applicable to the TC's work in this GitHub project. Content in this repository is intended to be part of the OpenC2 TC's permanent record of activity, visible and freely available for all to use, subject to applicable OASIS policies, as presented in the repository LICENSE file.
:left_speech_bubble: Further Description of this Repository :left_speech_bubble:
This repository is designed to support TC members' work on a formal specification that describes an OpenC2 extension to the CACAO v2.0 specification. This GitHub repository supports development of the content and change tracking for the OpenC2 CACAO Extension as new working draft level revisions are created and the associated CSDs mature.
Members of the OASIS Open Command and Control (OpenC2) TC create and manage technical content in this TC GitHub repository ( https://github.com/oasis-tcs/openc2-cacao-ext ) as part of the TC's chartered work (i.e., the program of work and deliverables described in its charter).
OASIS TC GitHub repositories, as described in GitHub Repositories for OASIS TC Members' Chartered Work, are governed by the OASIS TC Process, IPR Policy, and other policies, similar to TC Wikis, TC JIRA issues tracking instances, TC SVN/Subversion repositories, etc. While they make use of public GitHub repositories, these TC GitHub repositories are distinct from OASIS Open Repositories, which are used for development of open source licensed content.
:envelope_with_arrow: Contact :envelope_with_arrow:
Please send questions or comments about OASIS TC GitHub repositories to the OASIS TC Administrator. For questions about content in this repository, please contact the TC Chair or Co-Chairs as listed on the the OpenC2 TC's OASIS home page.