playbook

Documentation

Overview

Package playbook implements the CACAO 2.0 playbook object.

CACAO playbooks are made up of five parts; playbook metadata, the workflow logic, a list of agents, a list of extensions, and a list of data markings. Playbooks MAY refer to other playbooks in the workflow, similar to how programs refer to function calls or modules that comprise the program. The definition and normative requirements for all data types listed in the property table below and other property tables in this document can be found in Section 9.

Index

• func GetPlaybookTypesVocab() []string
• type Playbook
  • func Decode(data []byte) (*Playbook, error)
  • func New() *Playbook
  • func (p *Playbook) AddAgent(v agents.AgentObject) error
  • func (p *Playbook) AddDerivedFrom(values interface{}) error
  • func (p *Playbook) AddIndustrySectors(values interface{}) error
  • func (p *Playbook) AddLabels(values interface{}) error
  • func (p *Playbook) AddMarkingDefinition(v markings.DataMarkingObject) error
  • func (p *Playbook) AddMarkings(values interface{}) error
  • func (p *Playbook) AddPlaybookActivities(values interface{}) error
  • func (p *Playbook) AddPlaybookTypes(values interface{}) error
  • func (p *Playbook) AddTarget(v agents.AgentObject) error
  • func (p *Playbook) AddVariable(v objects.Variables) error
  • func (p *Playbook) AddWorkflowStep(v workflow.StepObject) error
  • func (p *Playbook) ClearWorkflowStepIDs() error
  • func (p *Playbook) Compare(p2 *Playbook, debug bool) (bool, int, []string)
  • func (p *Playbook) Encode() ([]byte, error)
  • func (p *Playbook) EncodeToString() (string, error)
  • func (p *Playbook) GetCurrentSpecVersion() string
  • func (p *Playbook) GetCurrentTime(precision string) string
  • func (p *Playbook) NewExternalReference(r ...objects.ExternalReference) (*objects.ExternalReference, error)
  • func (p *Playbook) SetCreated(t interface{}) error
  • func (p *Playbook) SetModified(t interface{}) error
  • func (p *Playbook) SetNewID(objType string) error
  • func (p *Playbook) Sign(method string, key interface{}, sig *signature.Signature) error
  • func (p *Playbook) Valid(debug bool) (bool, int, []string)
• type ProcessingSummary

Functions

func GetPlaybookTypesVocab

func GetPlaybookTypesVocab() []string

GetPlaybookTypesVocab - This will return a slice of officially supported playbook types

Types

type Playbook

type Playbook struct {
	ObjectType                string                         `json:"type,omitempty"`
	SpecVersion               string                         `json:"spec_version,omitempty"`
	ID                        string                         `json:"id,omitempty"`
	Name                      string                         `json:"name,omitempty"`
	Description               string                         `json:"description,omitempty"`
	PlaybookTypes             []string                       `json:"playbook_types,omitempty"`
	PlaybookActivities        []string                       `json:"playbook_activities,omitempty"`
	PlaybookProcessingSummary *ProcessingSummary             `json:"playbook_processing_summary,omitempty"`
	CreatedBy                 string                         `json:"created_by,omitempty"`
	Created                   string                         `json:"created,omitempty"`
	Modified                  string                         `json:"modified,omitempty"`
	Revoked                   bool                           `json:"revoked,omitempty"`
	ValidFrom                 string                         `json:"valid_from,omitempty"`
	ValidUntil                string                         `json:"valid_until,omitempty"`
	DerivedFrom               []string                       `json:"derived_from,omitempty"`
	RelatedTo                 []string                       `json:"related_to,omitempty"`
	Priority                  int                            `json:"priority,omitempty"`
	Severity                  int                            `json:"severity,omitempty"`
	Impact                    int                            `json:"impact,omitempty"`
	IndustrySectors           []string                       `json:"industry_sectors,omitempty"`
	Labels                    []string                       `json:"labels,omitempty"`
	ExternalReferences        []objects.ExternalReference    `json:"external_references,omitempty"`
	Markings                  []string                       `json:"markings,omitempty"`
	PlaybookVariables         map[string]objects.Variables   `json:"playbook_variables,omitempty"`
	WorkflowStart             string                         `json:"workflow_start,omitempty"`
	WorkflowException         string                         `json:"workflow_exception,omitempty"`
	Workflow                  map[string]workflow.StepObject `json:"workflow,omitempty"`
	//PlaybookExtensions            map[string]????                     `json:"playbook_extensions,omitempty"`
	//AuthenticationInfoDefinitions map[string]????                     `json:"authentication_info_definitions,omitempty"`
	AgentDefinitions  map[string]agents.AgentObject `json:"agent_definitions,omitempty"`
	TargetDefinitions map[string]agents.AgentObject `json:"target_definitions,omitempty"`
	//ExtensionDefinitions          map[string]????                     `json:extension_definitions,omitempty"`
	DataMarkingDefinitions map[string]markings.DataMarkingObject `json:"data_marking_definitions,omitempty"`
	Signatures             []signature.Signature                 `json:"signatures,omitempty"`
}

Playbook - This type implements the CACAO 2.0 Playbook object and defines all of the properties and methods needed to create and work with this object.

func Decode

func Decode(data []byte) (*Playbook, error)

Decode - This function is a simple wrapper for decoding JSON data. It will decode a slice of bytes into an actual struct and return a pointer to that object along with any errors.

func New

func New() *Playbook

New - This function will create a new Playbook object and return it as a pointer. It will also initialize the object by setting all of the basic properties.

func (*Playbook) AddAgent

func (p *Playbook) AddAgent(v agents.AgentObject) error

AddAgent - This method takes in an interface represening an agent object that satisfies the agent.AgentObject interface and adds it to the map.

func (*Playbook) AddDerivedFrom

func (p *Playbook) AddDerivedFrom(values interface{}) error

AddDerivedFrom - This method takes in a string value, a comma separated list of string values, or a slice of string values that all representing a playbook uuid and adds it to the derived_from property.

func (*Playbook) AddIndustrySectors

func (p *Playbook) AddIndustrySectors(values interface{}) error

AddIndustrySectors - This method takes in a string value, a comma separated list of string values, or a slice of string values that all representing an industry sector and adds it to the industry sectors property.

func (*Playbook) AddLabels

func (p *Playbook) AddLabels(values interface{}) error

AddLabels - This method takes in a string value, a comma separated list of string values, or a slice of string values that all representing a label and adds it to the labels property.

func (*Playbook) AddMarkingDefinition

func (p *Playbook) AddMarkingDefinition(v markings.DataMarkingObject) error

AddMarkingDefinition - This method takes in an interface represening a marking definition object that satisfies the markings.DataMarkingObject interface and adds it to the map.

func (*Playbook) AddMarkings

func (p *Playbook) AddMarkings(values interface{}) error

AddMarkings - This method takes in a string value, a comma separated list of string values, or a slice of string values that all representing a data marking and adds it to the markings property.

func (*Playbook) AddPlaybookActivities

func (p *Playbook) AddPlaybookActivities(values interface{}) error

AddPlaybookActivities - This method takes in a string value, a comma separated list of string values, or a slice of string values that all represent a playbook type and adds it to the playbook_activites property.

func (*Playbook) AddPlaybookTypes

func (p *Playbook) AddPlaybookTypes(values interface{}) error

AddPlaybookTypes - This method takes in a string value, a comma separated list of string values, or a slice of string values that all represent a playbook type and adds it to the playbook_types property.

func (*Playbook) AddTarget

func (p *Playbook) AddTarget(v agents.AgentObject) error

AddTarget - This method takes in an interface represening a target object that satisfies the agent.AgentObject interface and adds it to the map.

func (*Playbook) AddVariable

func (p *Playbook) AddVariable(v objects.Variables) error

AddVariable - This method takes in a Variable object and adds it to the playbook object as a global playbook variable.

func (*Playbook) AddWorkflowStep

func (p *Playbook) AddWorkflowStep(v workflow.StepObject) error

AddWorkflowStep - This method takes in an interface represening a workflow step object that satisfies the workflow.StepObject interface and adds it to the map.

func (*Playbook) ClearWorkflowStepIDs

func (p *Playbook) ClearWorkflowStepIDs() error

ClearWorkflowStepIDs - This method will zero out all of the IDs that are in the workflow step objects since the specification only has the IDs at the dictionary level.

func (*Playbook) Compare

func (p *Playbook) Compare(p2 *Playbook, debug bool) (bool, int, []string)

Compare - This method will compare two objects to make sure they are the same and will return a boolean, an integer that tracks the number of problems found, and a slice of strings that contain the detailed results, whether good or bad.

func (*Playbook) Encode

func (p *Playbook) Encode() ([]byte, error)

Encode - This method is a simple wrapper for encoding an object into JSON

func (*Playbook) EncodeToString

func (p *Playbook) EncodeToString() (string, error)

EncodeToString - This method is a simple wrapper for encoding an object into JSON

func (*Playbook) GetCurrentSpecVersion

func (p *Playbook) GetCurrentSpecVersion() string

GetCurrentSpecVersion - This method returns the current specification version that this library is using.

func (*Playbook) GetCurrentTime

func (p *Playbook) GetCurrentTime(precision string) string

GetCurrentTime - This method takes in a value of either milli or micro and returns the current time in RFC 3339 format

func (*Playbook) NewExternalReference

func (p *Playbook) NewExternalReference(r ...objects.ExternalReference) (*objects.ExternalReference, error)

NewExternalReference - This method creates a new empty external reference and returns a reference to it so it can be populated. However, if one or more external references are passed in they are all added and the reference that is returned is for the last entry added.

func (*Playbook) SetCreated

func (p *Playbook) SetCreated(t interface{}) error

SetCreated - This method takes in a timestamp in either time.Time or string format and updates the created property with it. The value is stored as a string, so if the value is in time.Time format, it will be converted to the correct timestamp format.

func (*Playbook) SetModified

func (p *Playbook) SetModified(t interface{}) error

SetModified - This method takes in a timestamp in either time.Time or string format and updates the modified property with it. The value is stored as a string, so if the value is in time.Time format, it will be converted to the correct timestamp format.

func (*Playbook) SetNewID

func (p *Playbook) SetNewID(objType string) error

SetNewID - This method takes in a string value representing an object type and creates a new ID based on the specification format and updates the id property for the object.

func (*Playbook) Sign

func (p *Playbook) Sign(method string, key interface{}, sig *signature.Signature) error

Sign - This method will sign a playbook object. It takes in a signing method like "RS256", a key, and a CACAO signature object.

func (*Playbook) Valid

func (p *Playbook) Valid(debug bool) (bool, int, []string)

Valid - This method will verify that the object is correct. It will return a boolean, an integer that tracks the number of problems found, and a slice of strings that contain the detailed results, whether good or bad. If debug is enabled, then resultDetails will contain entries for successful checks not just failures.

type ProcessingSummary

type ProcessingSummary struct {
	ManualPlaybook     bool `json:"manual_playbook,omitempty"`
	ExternalPlaybooks  bool `json:"external_playbooks,omitempty"`
	ParallelProcessing bool `json:"parallel_processing,omitempty"`
	IfLogic            bool `json:"if_logic,omitempty"`
	WhileLogic         bool `json:"while_logic,omitempty"`
	SwitchLogic        bool `json:"switch_logic,omitempty"`
	TemporalLogic      bool `json:"temporal_logic,omitempty"`
	DataMarkings       bool `json:"data_markings,omitempty"`
	Extensions         bool `json:"extensions,omitempty"`
}

ProcessingSummary - This type defines a list of playbook processing features