Operationalizing Cybersecurity Knowledge: Design, Implementation & Evaluation of a Knowledge Management System for CACAO Playbooks
Orestis Tsirakis, Konstantinos Fysarakis, Vasileios Mavroeidis, Ioannis Papaefstathiou
TL;DR
This work tackles the lack of lifecycle management tools for CACAO playbooks by designing a CACAO-focused Knowledge Management System (KMS) that stores, retrieves, executes, and shares playbooks using open standards. It integrates STIX 2.1 and TAXII 2.1 for structured sharing, uses the SOARCA execution engine for automated actions, and employs a document-versioning approach in MongoDB to manage playbook history. The PoC demonstrates end-to-end workflows with a low-code frontend, CACAO Roaster for authoring, a FastAPI REST API, and secure sharing, achieving CACAO 2.0 compliance and scalable performance under load. The work contributes a reproducible, open-source platform that can accelerate CACAO adoption, interoperability, and automated cybersecurity operations across organizations.
Abstract
Modern cybersecurity threats are growing in complexity, targeting increasingly intricate & interconnected systems. To effectively defend against these evolving threats, security teams utilize automation & orchestration to enhance response efficiency and consistency. In that sense, cybersecurity playbooks are key enablers, providing a structured, reusable, and continuously improving approach to incident response, enabling organizations to codify requirements, domain expertise, and best practices and automate decision-making processes to the extent possible. The emerging Collaborative Automated Course of Action Operations (CACAO) standard defines a common machine-processable schema for cybersecurity playbooks, facilitating interoperability for their exchange and ensuring the ability to orchestrate and automate cybersecurity operations. However, despite its potential and the fact that it is a relatively new standardization work, there is a lack of tools to support its adoption and, in particular, the management & lifecycle development of CACAO playbooks, limiting their practical deployment. Motivated by the above, this work presents the design, development, and evaluation of a Knowledge Management System (KMS) for managing CACAO cybersecurity playbooks throughout their lifecycle, providing essential tools to streamline playbook management. Using open technologies & standards, the proposed approach fosters standards-based interoperability & enhances the usability of state-of-the-art cybersecurity orchestration & automation primitives. To encourage adoption, the resulting implementation is released as open-source, which, to the extent of our knowledge, comprises the first publicly available & documented work in this domain, supporting the broader uptake of CACAO playbooks & promoting the widespread use of interoperable automation and orchestration mechanisms in cybersecurity operations.