This repository includes a mapping table and a reference process that allows converting between STIX 2.1 Course of Action objects that make use of the Security Playbook extension and MISP Security Playbook objects.

A base schema for capturing workflow execution status data - SOAR

This is the workbench for designing and updating the "security-playbook" object template for the MISP project - https://github.com/MISP/misp-objects/blob/main/objects/security-playbook/definition.json

These playbooks serve as drafts and starting points for initial triage. They are not intended to be final, out-of-the-box solutions but should be adapted to fit the specific practices, procedures, and workflows of the Security Operations Center (SOC) using them.