Common registry improves sharing of cybersecurity playbook integrations
CCR: Towards a Common, Quality-Gated CACAO Integrations Registry for European Cybersecurity Automation
Cryptography and Security
Summary
Cybersecurity teams use automated playbooks to respond to incidents, but connecting these playbooks to specific products can be tricky. The authors created a shared registry called CCR that holds detailed descriptions of how to connect playbook steps to different security tools using standard web APIs. They combined automatic extraction of API details with some help from a language model to make this work more accurate and useful. Their evaluation showed the registry contents were high quality and could be reliably used to send commands to actual security products.
What this means in practice
- •For security operations teams: Use a shared, validated registry of API connectors to automate incident response steps across multiple security products.
- •For enterprise software integrators: Build interoperable security automation by referencing a common repository of quality-checked API integration templates.
Authors
Mateusz Zych, Vasileios Mavroeidis, Gudmund Grov
Abstract
Standardised, machine-readable cybersecurity playbooks provide a basis for portable, shareable, and reusable incident-response logic. OASIS CACAO provides a vendor-neutral representation for such playbooks, but not the product-specific integration artefacts needed to invoke external products and services. We introduce the Common CACAO Registry (CCR), an open, provenance-aware registry of CACAO HTTP-API connector envelopes. Each envelope captures an API operation's command, inputs, target, authentication-related information, provenance, validation evidence, and maturity metadata. CCR is \emph{quality-gated}, with acceptance requiring both CACAO v2 schema validity and a mean back-validation score of at least 0.8 against the source OpenAPI operation, while a six-level maturity model records progressively stronger evidence and distinguishes gate acceptance from operational readiness. To seed CCR, we develop a hybrid OpenAPI-to-CACAO pipeline. Deterministic code extracts source-derived interface facts, generates identifiers, wires cross-references, and validates structure, while a constrained LLM provides bounded semantic enrichment, including action naming, authentication interpretation, and CACAO activity annotation. Evaluation across eight security APIs yields 713 CACAO-schema-valid envelopes with a mean back-validation score of 91.5\%, of which 675 produce well-formed, dispatchable HTTP requests in a local harness. Comparison with a deterministic rule-based baseline shows that mechanical API structure is preserved more reliably through rule-based translation, while the LLM contributes bounded semantic enrichment, most notably CACAO activity annotation. Together, these results support CCR as reusable integration infrastructure for CACAO action steps and as an initial foundation for a broader common European registry.