Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

typos + fixed spelling error in the documentation. #9

Merged
merged 2 commits into from
Mar 6, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .gitlab-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ unit-test-job: # This job runs in the test stage.
- when: always


docker-build: # This job will build the soar-ca docker image on merge request
docker-build: # This job will build the soarca docker image on merge request
image: docker
services:
- docker:dind
Expand Down
10 changes: 5 additions & 5 deletions doc/soarca.md
Original file line number Diff line number Diff line change
@@ -1,25 +1,25 @@
# SOAR-CA
# SOARCA
The TNO Cyber ORCA.

![soarca](img/SOARCA.png)

## Goals of SOARCA
SOAR-CA or SOARCA stands for Security Orchestration Automation and Response CAcao. Which means it is a soar tool designed to work with OASIS CACAO. SOAR-CA also supports STIX.
SOARCA stands for Security Orchestration Automation and Response CAcao. Which means it is a soar tool designed to work with OASIS CACAO. SOARCA also supports STIX.


## Design decisions
To allow for fast execution and type safe development SOAR-CA is developed in `GOLANG`. The application application can be deployed in `Docker`. Further dependencies are `MQTT` for the module system and `go-gin` for the REST API.
To allow for fast execution and type safe development SOARCA is developed in `GOLANG`. The application application can be deployed in `Docker`. Further dependencies are `MQTT` for the module system and `go-gin` for the REST API.


## Example use case
As a starting example for SOAR-CA is ingesting a STIX2 message with an malicious URL. In turn this will trigger a playbook which will produce several Coarse of Action which can be executed by the operator/ be automatically executed.
As a starting example for SOARCA is ingesting a STIX2 message with an malicious URL. In turn this will trigger a playbook which will produce several Coarse of Action which can be executed by the operator/ be automatically executed.

The main focus is to show the working of the API for:Workflows, CoAs and STIX endpoint in combination with the module system.

```plantuml
@startuml
usecase event
(SOAR-CA) as soar
(SOARCA) as soar

event --> soar : ingest STIX
soar -> (virustotal module) : lookup url
Expand Down
8 changes: 4 additions & 4 deletions docs/content/en/docs/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,15 +33,15 @@ SOARCA currently supports the following transport mechanisms:
<div class="works-well-with">
{{< cardpane >}}
{{% card header="OpenC2 - Native" %}}
[![OpenC2](/images/logos-external/openc2.svg)](/docs/soarca-extentions/native-capabilities/#openc2-capability)
[![OpenC2](./images/logos-external/openc2.svg)](/docs/soarca-extentions/native-capabilities/#openc2-capability)
{{% /card %}}

{{% card header="HTTP - Native" %}}
[![Http](/images/logos-external/http.svg)](/docs/soarca-extentions/native-capabilities/#http-api-capability)
[![Http](./images/logos-external/http.svg)](/docs/soarca-extentions/native-capabilities/#http-api-capability)
{{% /card %}}

{{% card header="SSH - Native" %}}
[![Ssh](/images/logos-external/ssh.svg)](/docs/soarca-extentions/native-capabilities/#ssh-capability)
[![Ssh](./images/logos-external/ssh.svg)](/docs/soarca-extentions/native-capabilities/#ssh-capability)
{{% /card %}}
{{< /cardpane >}}
</div>
Expand All @@ -53,6 +53,6 @@ SOARCA currently supports the following transport mechanisms:

## Where do I start?

{{% alert title="primary" color="primary" %}}
{{% alert title="Follow our getting started!" color="primary" %}}
Following our [Getting started](/docs/getting-started/) guide will help you setup SOARCA and configure the SOAR for your internal security tooling. For more custom requirement
{{% /alert %}}
5 changes: 1 addition & 4 deletions docs/content/en/docs/about/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ description:

## About COSSAS

SOARCA finds its home within the Community for Open Source Security Automation Software (COSSAS). [COSSAS](https://cossas-project.org/') offers a continuously expanding base of novel software components for cyber security automation that SOC, CERT and CTI professionals can deploy and trial in their own operational environments. COSSAS is part of the TNO.
SOARCA finds its home within the Community for Open Source Security Automation Software (COSSAS). [COSSAS](https://cossas-project.org/') offers a continuously expanding base of novel software components for cyber security automation that SOC, CERT and CTI professionals can deploy and trial in their own operational environments. COSSAS is an initiative of the TNO.

## About TNO

Expand All @@ -15,6 +15,3 @@ SOARCA is an project initiated and support by [TNO](https://tno.nl), the Netherl

## Developers




6 changes: 3 additions & 3 deletions docs/content/en/docs/concepts/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,16 +41,16 @@ Both inside and outside of TNO there is a strong need for interoperable workflow

SOAR functionality is relevant not only for automation in incident response handling, but also attack & defense simulations, cyber ranges, digital twinning and other (TNO research) topics that have a strong dependence on the orchestration of complex workflows.

### Current state of Soarca
### Current state of SOARCA

At present, SOARCA is in an Alpha release phase and is intended for Proof of Concepts (PoCs) and research purposes, serving as a platform for demonstrations. The objective of the SOARCA team is to evolve SOARCA into a more mature SOAR orchestration tool suitable for operational environments. For potential applications of SOARCA, please refer to the ‘Use-Cases’ section of our documentation.

### Why making Soarca open-source?

- SOARCA has been publicly funded and should therefore ideally be made publicly available.
- The target audience of SOC, CERT/CSIRT and CTI teams has a very strong affinity with open-source solutions and embraces them to a great extent. (see also the success of MISP, OpenCTI, The-Hive, ...)
- Open-source software provides a low barrier for partner organisations to collaborate with TNO and contribute to further development.
- Open Source software and tooling can easily be brought in as background into projects and partnerships such as HEU, EDF, TKI projects and others. The use of open-source tooling is explicitly encouraged by the European Commission.
- Open-source software provides a low barrier for partner organisations to collaborate and contribute.
- Open Source software and tooling can easily be brought in as background into projects and partnerships such as HEU, EDF, or National funded projects and others. The use of open-source tooling is explicitly encouraged by the European Commission.


## Core Concepts
Expand Down
14 changes: 7 additions & 7 deletions docs/content/en/docs/core-components/api-design.md
Original file line number Diff line number Diff line change
Expand Up @@ -145,10 +145,10 @@ When the caller does not have valid authentication 401/unauthorized will be retu
----

### /playbook
The playbook endpoinst are used to create playbooks in SOAR-CA, new playbook can be added, current ones edited and deleted.
The playbook endpoinst are used to create playbooks in SOARCA, new playbook can be added, current ones edited and deleted.

#### GET `/playbook`
Get all playbook id's that are currently stored in SOAR-CA.
Get all playbook id's that are currently stored in SOARCA.

##### Call payload
None
Expand All @@ -172,7 +172,7 @@ None
General error

#### GET `/playbook/meta`
Get all playbook id's that are currently stored in SOAR-CA.
Get all playbook id's that are currently stored in SOARCA.

##### Call payload
None
Expand Down Expand Up @@ -204,7 +204,7 @@ General error


#### POST `/playbook`
Create a new playbook that and store it in SOAR-CA. The format is
Create a new playbook that and store it in SOARCA. The format is


##### Payload
Expand Down Expand Up @@ -405,7 +405,7 @@ enum workflowType {
The status endpoints are used to get various statuses.

#### GET `/status`
Call this endpoint to see if SOAR-CA is up and ready. This call has no payload body.
Call this endpoint to see if SOARCA is up and ready. This call has no payload body.

##### Call payload
None
Expand Down Expand Up @@ -551,7 +551,7 @@ None
```plantuml
@startuml
participant "SWAGGER" as gui
control "SOAR-CA API" as api
control "SOARCA API" as api
control "controller" as controller
control "Executor" as exe
control "SSH-module" as ssh
Expand All @@ -573,7 +573,7 @@ api <-- controller: results
```plantuml
@startuml
participant "SWAGGER" as gui
control "SOAR-CA API" as api
control "SOARCA API" as api
control "controller" as controller
database "Mongo" as db
control "Executor" as exe
Expand Down
8 changes: 4 additions & 4 deletions docs/content/en/docs/core-components/database.md
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ database Database as db
controller -> playbook : get(id)
playbook -> db : read(playbookId)
note right
When the create fails a error will be thrown
When the create fails an error will be thrown
end note
playbook <-- db : "playbook JSON"
controller <-- playbook: "CacaoPlaybook Object"
Expand All @@ -69,7 +69,7 @@ database Database as db
controller -> playbook : set(CacaoPlaybook Object)
playbook -> db : create(playbook JSON)
note right
When the create fails a error will be thrown
When the create fails an error will be thrown
end note
```

Expand All @@ -82,7 +82,7 @@ database Database as db
controller -> playbook : update(CacaoPlaybook Object)
playbook -> db : update(playbook id,playbook JSON)
note right
When the create fails a error will be thrown
When the create fails an error will be thrown
end note
playbook <-- db : true
controller <-- playbook: true
Expand All @@ -98,7 +98,7 @@ database Database as db
controller -> playbook : remove(playbook id)
playbook -> db : remove(playbook id)
note right
When the create fails a error will be thrown
When the create fails an error will be thrown
end note
```

Expand Down
4 changes: 2 additions & 2 deletions docs/content/en/docs/core-components/executer.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,8 @@ package "Executor" {
}

package "Fins" {
component "Virus Total" as virustotal
component "E-Sender" as email
component "VirusTotal" as virustotal
component "E-mail Sender" as email
}

parser -- Executor
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ The overview on this page is aimed to guid you through the SOARCA architecture a
## Components

Components of SOARCA are displayed in the component diagram.
- Green is implemented,
- orange has limited functionality,
- red is not started but will be added in future releases.
- Green is implemented
- Orange has limited functionality
- Red is not started, but will be added in future releases

```plantuml
@startuml
Expand Down Expand Up @@ -67,7 +67,7 @@ core::executor --> core::modules::ssh

## Classes

This diagram consists of the class structure used by SOAR-CA
This diagram consists of the class structure used by SOARCA

```plantuml
@startuml
Expand Down