Beyond Incident Reporting - An Analysis of Structured Representations for Incident Response

### Overview Presented by Marco Caselli (Siemens) and Daniel Schlette (University of Regensburg), this presentation explores how organizations can represent, evaluate, and operationalize incident response (IR) procedures beyond basic Cyber Threat Intelligence (CTI) indicators. Drawing on research from the European project Concordia and standards development (including OASIS CACAO and OpenC2), the speakers analyze existing structured formats for IR playbooks and examine the organizational factors required to adapt shared playbooks to specific enterprise environments.

### Key Topics - **Evolution from CTI to IR Courses of Action**: Shifting from atomic indicators of compromise (hashes, IP addresses) and TTPs toward standardized courses of action and executable playbooks. - **Categorization of IR Standards**: Distinguishing between high-level frameworks (e.g., RE&CT, MITRE D3FEND), procedural playbook formats (e.g., CACAO), and granular command-level execution standards (e.g., OpenC2). - **Core Structural and Evaluation Concepts**: Breaking IR down to essential structural primitives—workflow, actuator, action, and artifact—and evaluating standards against general, technological, and security criteria. - **Organizational Factors and Context**: Examining why technical representations alone are insufficient for cross-organization sharing due to variations in legal regulations, internal policies, team resources, and command structures.

### Technical Details At its base, incident response consists of a workflow where an actuator executes an action on an artifact. While an analysis of existing standards revealed that all formats adequately cover the core *actions*, coverage of actuators, workflows, and artifacts varies significantly.

To evaluate formats for specific use cases (such as playbook sharing, automation, and internal management reporting), the speakers derived broader evaluation criteria: - **General Concepts**: Aggregability (bundling IR steps together), versioning, and machine vs. human readability. - **Technology Concepts**: Community backing, serialization formats, and implementation scope. - **Security Concepts**: Confidentiality markings (e.g., TLP, IEP), authorization requirements prior to execution, and prioritization.

Applying these criteria to an incident response sharing use case, CACAO emerged as a strong candidate because it structures procedures into workflows and steps, aggregates playbook information, is backed by an OASIS community, and supports confidentiality markings (TLP/IEP). However, technical playbooks must be contextualized using an organization's specific operational factors. The authors proposed conceptualizing a transformation engine that merges technical playbooks with organizational context to automatically tailor response steps. Key organizational dimensions include: 1. **External Regulations & Compliance**: E.g., GDPR requiring legal consultation before analyzing customer data. 2. **Internal Policies**: E.g., rules requiring IP redirection rather than direct blocking, or restrictions on copying forensic files. 3. **Attacker Context & Responsibility**: E.g., past encounters with a threat group triggering escalation branches to the CISO. 4. **Security Setting & Resources**: Team size, budget, tooling, and time limits.

### Takeaways Standardized formats like CACAO provide structured, machine-readable mechanisms to represent IR procedures, but technical playbooks cannot simply be imported without accounting for an organization's specific context. Ongoing research and industry feedback aim to formally categorize organizational factors so that automated transformation engines can adapt shared community playbooks to local constraints, compliance rules, and technical architectures.