Repository files navigation

This repository contains schema definitions for a DFIR (Digital Forensics Incident Response) Playbook.The scheme is based on YAML (http://yaml.org/), and describes an incident response runbook (aka. playbook, “use case”) that is a written guidance for identifying, containing, eradicating and recovering from cyber security incidents.

Yaml was chosen since it's both human readable and can describe complex nested data structure, we use YAML version 1.2.

• Open - open sourced, so analysts can create, share and contribute incident response process in same language.
• Semi/Fully automated - since playbooks in the incident response world can often be fully automated, but sometimes must include some manual steps.
• Visibility - give the organization members (SOC team, management) an overview on the incident response process.

This is version 0.2 of the spec

1. Playbook - the high level process.
2. Task - this is a single step in the process, which can represent a script execution or manual step.

• id: a unique id of the playbook, usually UUID
• name: playbook name
• description: the purpose of the playbook
• tasks: an (ordered) list of playbook tasks
• starttaskid: the id of the playbook first task
• inputs: a list of playbook inputs
• outputs: a list of playbook outputs

• id: this is the id of the task inside the playbook, it must by unique in playbook level only
• taskid: this is the global task id, should be unique globally (usually UUID), needed in order to share a task between playbooks
• type: one of the following: title (represent a new playbook section/header), regular (script or manual task) or condition (to decide what is the next branch/step)
• name: name of the task
• description: the purpose of the task
• scriptName: if this is an automated task, the script to execute for this task
• tags: general tags to add to task
• condition: if this task is a condition type, this fields will hold a nested map of string keys that map to the branch's (list of tasks), so that this task can continue to the correct branch according to result of script
• scriptarguments: these are the task inputs, can be simple or complex type, each has different inner structure
• nexttasks: the navigation to perform after the current task has ended,to which next task id to move
• conditions: the navigation logic conditions, based on the result the next task will be selected

id:40202fbb-9ed4-4b8f-86e1-68722d808e3dversion:0name:Hello-world-COPSdescription:This playbook is an example hello world of COPS formatstarttaskid:"0"tasks:"0":id:"0"taskid:c44160b9-16d8-4a1e-8765-1c034006a183type:starttask:id:c44160b9-16d8-4a1e-8765-1c034006a183version:-1name:""iscommand:falsebrand:""nexttasks:'#none#':      -"1"separatecontext:false"1":id:"1"taskid:015bd0d8-5d01-4c2d-8d38-fed3e5c77938type:regulartask:id:015bd0d8-5d01-4c2d-8d38-fed3e5c77938version:-1name:Hello world COPSscriptName:Printtype:regulariscommand:falsebrand:""nexttasks:'#none#':      -"2"scriptarguments:value:simple:Hello DFIR community, this is COPS!separatecontext:false"2":id:"2"taskid:b8193b45-293e-4035-858a-36d84050395atype:conditiontask:id:b8193b45-293e-4035-858a-36d84050395aversion:-1name:Is this incident high severitytype:conditioniscommand:falsebrand:""nexttasks:'#default#':      -"4""yes":      -"3"separatecontext:falseconditions:    -label:"yes"condition:      -- operator:string.isEqualleft:value:simple:incident.severityiscontext:trueright:value:simple:"3""3":id:"3"taskid:11e43d6c-a9bb-4fea-8641-6f256a5d11f7type:regulartask:id:11e43d6c-a9bb-4fea-8641-6f256a5d11f7version:-1name:Investigate it!type:regulariscommand:falsebrand:""separatecontext:falsesla:hours:0days:0weeks:1"4":id:"4"taskid:eb04267c-b749-40f7-888b-b00c720112eatype:regulartask:id:eb04267c-b749-40f7-888b-b00c720112eaversion:-1name:Go Sleeptype:regulariscommand:falsebrand:""separatecontext:falseinputs:[]outputs:[]

0. This is the playbook first task, just dummy task to hold start point of playbook
1. Hello world COPS - print/echo "Hello DFIR community, this is COPS!"
2. Is this incident high severity - condition task to check if incident severity high, if so go to task #3, otherwise go to task #4
3. Investigate it! - manual task the analyst needs to perform
4. Go Sleep - manual task the analyst needs to perform

This is of course a sample (and simple example) just to show an overview of the scheme.For real DFIR playbooks look at theDemisto content repo.

Feel free to contribute by providing feedback, creating new DFIR playbooks, or using the spec in your security product, contact using issues of this GitHub repo.