From: Jyoti Verma (jyoverma) <jyoverma@cisco.com>
Date: Wednesday, September 4, 2024 at 12:01 PM
To: David Lemire <david.lemire@hii-tsd.com>, Duncan Sparrell <duncan@sfractal.com>, Michael Rosa <mjrosa@cyber.nsa.gov>, Aleksandra Scalco <aleksandra.scalco.civ@mail.mil>, Alex Everett <alex.everett@unc.edu>, Anthony Librera <al8109@att.com>, Aviv Ron <rona@il.ibm.com>, Bill Trost <wt1354@att.com>, Chet Ensign <chet.ensign@oasis-open.org>, Chris Ricard <cricard@fsisac.us>, Christian Hunt <ch@ctin.us>, Christopher Robinson <cfr@ctin.us>, David Bizeul <david.bizeul@sekoia.com>, David Kemp <d.kemp@cyber.nsa.gov>, Drew Varner <drew.varner@ninefx.com>, Duane Skeen <duane.skeen@ngc.com>, James Crossland <James.Crossland@ngc.com>, Jane Ginn <jg@ctin.us>, Jason Callaway <jasoncallaway@google.com>, Jason Liu <jason.liu@ngc.com>, Lauri Korts-Pärn <lauri@cyberdefense.jp>, Marco Caselli <marco.caselli@siemens.com>, Michael Stair <ms1784@att.com>, Michelle Barry <mb8523@att.com>, Patrick Maroney <Patrick.Maroney@att.com>, Paul Patrick <ppatrick@darklight.ai>, Randall Sharo <randall.sharo@navy.mil>, Russ Warren <russell.warren@us.ibm.com>, Ryan Joyce <rjoyce@darklight.ai>, Stephanie Hazlewood <stephanie@ca.ibm.com>, Stephen Banghart <stephen.banghart@nist.gov>, Takahiro Kakumaru <kakumaru@nec.com>, Toby Considine <toby.considine@unc.edu>, Vasileios Mavroeidis <vasileim@ifi.uio.no>, Zachary Gorak <zgorak@everwatchsolutions.com>
Subject: OpenC2 Working Mtg (1st Weds)

Hi there,

We are using an OpenC2 style format to express actions in the project that I am working on and I wanted to understand how to build a command that quarantines a file (identified by its sha256) on an endpoint (identified by its hostname). I have the file and the endpoint details and would like to capture all of them in the action. Below is what I have so far. I am struggling with how to include the details of the endpoint on which this action was taken.

"open_c2_coa": {

    "action": {

      "type": "deny"

    },

    "target": {

      "type": "sha256",

      "specifiers": " abcd1235"

    },

    "actuator": {

      "type": "endpoint.server",

      "specifiers": "Cisco Secure Endpoint"

    },

    "modifiers": {

      "response": "failed" //captures the action response

    }

Appreciate any pointers you can share.

Thanks,

Jyoti