opencybersecurityalliance / cacao-roaster

A web application for generating, parsing and validating, manipulating, and visualizing CACAO v2.0 playbooks.
Other
18 stars 7 forks source link

agent target address fields do not allow variables #11

Open lucamrgs opened 4 months ago

lucamrgs commented 4 months ago

The definitions of the properties for the "address" property, used in the agent-targets of type HTTP API, ssh, linux, net-address, contain regexes that do not allow variables to be placed instead of actual URL/IP/Mac/vlan values.

Besides being impractical, this is also not in line with the specification, which defines all values for address keys to be list of strings. See e.g. sec. 7.8 of CACAO V2 spec: "address (required) | dictionary | The key for each entry in the dictionary MUST be a stringthat uniquely identifies one or more address types. The key(s) MUST be one of the following values dname(domain name), ipv4, ipv6, l2mac, vlan, or url. The dictionary value associated with each key MUST be a listof string that contains the corresponding address(es) for that particular key type."

It would probably be the case that in the schemas, such properties are left as string, or else change the regex validation such that that CACAO variables strings are also allowed.

dlemire60 commented 3 months ago

Good point, however I think this isn't really a Roaster issue but a CACAO issue. I'd suggest you post this to either or both of: