Skip to content

Commit 5922b25

Browse files
added new blogpost on conditional logic (#152)
1 parent c386480 commit 5922b25

File tree

2 files changed

+28
-0
lines changed

2 files changed

+28
-0
lines changed
Loading
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
date: 2024-05-14
3+
title: "Automating Security Responses: Introducing Conditional Logic Support in SOARCA - Demo"
4+
linkTitle: Introducing Conditional Logic Support in SOARCA - Demo
5+
description: >
6+
7+
author: RabbITCybErSeC, Hidde-Jan Jongsma, MaartendeKruijf
8+
resources:
9+
- src: "**.{png,jpg}"
10+
title: "Image #:counter"
11+
params:
12+
byline: ""
13+
---
14+
Check out our latest demo featuring the (beta) integration of the open-source [CACAO Roaster tool](https://github.com/opencybersecurityalliance/cacao-roaster) available on GitHub, and playbook 'if condition' step support for conditional logic in playbook executions. This enables security operators to create dynamic playbooks that execute appropriate actions based on the outcomes of preceding playbook steps, allowing for precise and efficient responses to security incidents.
15+
16+
Despite the two project being developed by separate teams, the (beta version) integration between CACAO Roaster and SOARCA showcases the advantages of adopting the standardized CACAO V2.0 specification, making security solutions more interoperable.
17+
18+
In the demo, we present a CACAO playbook for the automated mitigation of a malicious webshell. The playbook allows to scan our infrastructure for malicious webshells, promptly taking action by terminating any identified webshell processes and removing associated binaries. Finally, the playbook reports to Slack.
19+
20+
The integration between SOARCA and third-parties can be facilitated through the [playbook API](https://cossas.github.io/SOARCA/docs/soarca-api/), allowing third-parties to execute stored or uploaded playbooks. SOARCA performs all the steps in the workflow. Depending on the necessary actions, SOARCA can execute system reconfigurations over SSH, HTTP, and [OpenC2](https://openc2.org/), with plans for further integrations and extensions in the pipeline.
21+
22+
Notably, the demo highlights recent enhancements to SOARCA's core features, for example the ["if condition feature"](https://github.com/COSSAS/SOARCA/pull/138). This feature, showcased in the demo, enables the execution of conditional logic embedded within playbooks, enhancing flexibility and customization options for security operations. Another [milestone](https://github.com/COSSAS/SOARCA/milestones) for the SOARCA's 1.1 release is the support for while condition execution steps as described [here](https://github.com/COSSAS/SOARCA/issues/143).
23+
24+
Example demo files can be found [here](https://github.com/MaartendeKruijf/soarca-webshell-example).
25+
26+
27+
<iframe src="https://player.vimeo.com/video/946107969?h=0114d86628" width="640" height="360" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen></iframe>
28+
<p><a href="https://vimeo.com/946107969">SOARCA webshell demonstration</a> from <a href="https://vimeo.com/user216437450">COSSAS</a> on <a href="https://vimeo.com">Vimeo</a>.</p>

0 commit comments

Comments
 (0)