Playbook Oriented Cyber Response

Cyber analysts tend to respond to anomalous events manually, often using subjective judgment that can lead to responses that are less than optimal. Additionally, analysts tend to report on events and share cyber knowledge in unstructured, textual formats, which not only require more time to parse – thus taking more time to respond – but also lead to multiple conclusions from the same input. To remedy this, we have proposed a framework designed to provide an analyst with a set of timely and accurate courses of action in response to events, in some cases automating those responses. As part of this framework, we have created a playbook specification format that allows analysts to specify the right course of action to take in response to events, given certain risk conditions and mission context. In addition to providing the specification format, we have also created an initial ontology to help analysts build their playbook contents and have laid out a notional architecture that can operationalize these playbooks. Our playbook format can help standardize how analysts should respond to events, thus decreasing the time to response and enabling analysts to share key knowledge in a common format. Ultimately, this should increase the efficacy of security operations center personnel.