A Course of Action is a specific measure that could be taken in regard to a threat. The measure may be corrective or preventative to address exploit targets, or responsive to counter or mitigate the potential impacts of Incidents. (Reference: STIX Version 2.1)
Adding a Course of Action
To add a new Course of Action, follow these steps:
1. Navigate to Intelligence and choose Course of Action from the drop-down menu.
2. Next, click on +Create New.
3. Add a Name for the Course of Action. This could be action your organization took to safeguard the network asset. Then, add a Description detailing what was done. When you are finished, click the plus sign (+) icon on the right side of the page.
4. The newly added Course of Action will display.
5. You will have the option to add Relationships and External References to the object.
6. To add a new Relationship, click on +Add.
7. A new window will display for adding a new relationship, you will see the following:
Source will display the current object which is the name of the object.
You can select from the Relationship type drop-down menu the type of relationship the object has to the Target.
Depending on the Relationship type you select, a Target can be an Identity Object or another Intelligence Object. To add a target, type its name in the Target field.
NOTE: A Target must already be in the system for it to appear in the field.
Depending on the object, you can the swap the Source and Target names by clicking on Swap & Target.
Under Description you can add details about the Relationship shared with the object you are creating. Click Add when you are done.
8. Newly added relationships will be listed under Relationships.
9. You can also add already existing External References to an Indicator Object.
Click on +Add.
A new window will display with a drop-down list of External References you can select from. Choose the name of the External Reference you want then click Add.
NOTE: You can add one or more External References to an object.
10. Newly added references will be listed under **External References**.
10. Finally, add Notes or Opinions. See: Adding Notes to Objects, Adding Opinions to Objects
Related Content