OpenC2 Architecture Specification

Cyber attacks are increasingly sophisticated, less expensive to execute, dynamic and automated. The provision of cyber defense via statically configured products operating in isolation is untenable. Standardized interfaces, protocols and data models will facilitate the integration of the functional blocks within a system and between systems. Open Command and Control (OpenC2) is a concise and extensible language to enable machine-to-machine communications for purposes of command and control of cyber defense components, subsystems and/or systems in a manner that is agnostic of the underlying products, technologies, transport mechanisms or other aspects of the implementation. The Architecture Specification describes the abstract architecture of OpenC2 to define a common understanding of the messages and interactions for all bindings and serializations.

Open Command and Control (OpenC2) Language Specification

The Language Specification is an overarching OpenC2 document, which defines the basic conventions of the language, the set of available actions, and the base set of targets to which actions can be applied. This specification provides the semantics for the essential elements of the language, the structure for commands and responses, and the schema that defines the proper syntax for the language elements that represents the command or response.

Specification for JSON Abstract Data Notation (JADN)

JSON Abstract Data Notation (JADN) is a UML-based information modeling language that defines data structure independently of data format. Information models are used to define and generate physical data models, validate information instances, and enable lossless translation across data formats. A JADN specification consists of two parts: type definitions that comprise the information model, and serialization rules that define how information instances are represented as data. The information model is itself an information instance that can be serialized and transferred between applications. The model is documented using a compact and expressive interface definition language, property tables, or entity relationship diagrams, easing integration with existing design processes and architecture tools.

OpenC2 Actuator Profile for Stateless Packet Filtering (SLPF)

OpenC2 Actuator Profiles specify the subset of the OpenC2 language relevant in the context of specific actuator functions. This actuator profile specifies the set of actions, targets, specifiers, and command arguments that integrates Stateless Packet Filtering functionality with the OpenC2 command set.

OpenC2 Actuator Profile for Packet Filtering (PF)

OpenC2 Actuator Profiles specify the subset of the OpenC2 language relevant in the context of specific actuator functions. Packet filtering is a cyber defense mechanism that denies or allows traffic based on static or dynamic properties of the traffic, such as address, port, protocol, etc. This profile defines the Actions, Targets, Specifiers and Options that are consistent with the Version 1.0 of the OpenC2 Language Specification in the context of packet filtering (PF).

OpenC2 Actuator Profile for Threat Hunting (TH)

OpenC2 Actuator Profiles specify the subset of the OpenC2 language relevant in the context of specific actuator functions. This specification defines an actuator profile to automate management of cyber threat hunting activities using OpenC2. Threat hunting is the process of proactively and iteratively searching through networks and on endpoints to detect and isolate cyber observables that may indicate threats that evade existing security solutions. This actuator profile defines the OpenC2 Actions, Targets, Arguments, and Specifiers along with conformance clauses to enable the operation of OpenC2 Producers and Consumers in the context of cyber threat hunting. It covers the identification and invocation of stored hunting processes (e.g., “hunt flows”), passing of hunt parameters, and the expected type(s) and format(s) of information returned by hunting processes.

Specification for Transfer of OpenC2 Messages via MQTT

OpenC2 transfer specifications utilize existing protocols and standards to implement OpenC2 in specific environments. Message Queuing Telemetry Transport (MQTT) is a widely-used publish / subscribe (pub/sub) transfer protocol. This specification describes the use of MQTT Version 5.0 as a transfer mechanism for OpenC2 messages.

Specification for Transfer of OpenC2 Messages via HTTPS

OpenC2 transfer specifications utilize existing protocols and standards to implement OpenC2 in specific environments. This specification describes the use of HTTP over TLS as a transfer mechanism for OpenC2 messages.

Information Modeling With JADN

Information models (IMs) are used to define and generate physical data models, validate information instances, and enable lossless translation across data formats. JSON Abstract Data Notation (JADN) is a UML-based information modeling language that defines data structure independently of data format. This Committee Note describes the use of IMs, explains how to construct IMs using JADN, and contrasts IMs with other modeling approaches, such as Entity-Relationship models for databases, and knowledge models / ontologies.

OpenC2 Actuator Profile Development Process Version 1.0

OpenC2 Actuator Profiles (APs) specify the subset of the OpenC2 language relevant in the context of specific actuator functions. A profile refines the meaning of language elements used to perform the actuator function, and often defines additional elements that are relevant and/or unique to that function. This Committee Note describes the TC’s process for using the JSON Abstract Data Notation (JADN) information modeling language in the development of APs, resulting in a rigorous schema for an AP properly integrated with the base OpenC2 language.

Explanation of History Table Details