Nice Project and Maybe

[austinsonger]

Nice Project.

Looks like we could probably collaborate on something together related to my project about Incident Playbooks based on MITRE Attack framework.

• https://github.com/austinsonger/Incident-Playbook

[Ektoplasma]

Good idea! In the roadmap we are planning to add a new "TTP" tab to the Cases in order to probably match events to MITRE Attack techniques. Your project looks promising for this future functionality thanks

[austinsonger]

Yeah. I was thinking like a Playbook Module.

Possible Playbook Flow:

1. For a incident, a user will select main MITRE Attack Technique or Sub-Technique
   • And accessory "MITRE Attack Technique or Sub-Techniques"
2. And then the Playbook Module will automatically copy over incident response steps (In a checklist-style fasion) from repo of community driven playbooks.
3. The user will/can check off each item, that her/she performed, and then provide evidence under each checked item.

[Ektoplasma]

Very interesting thought! It could add great value and kinda like boilerplate procedures to handle new cases. I like very much the idea of having it as a module so that one team can choose whether or not to integrate it into their IR management.