Course of actions

A course of action is an action taken either to prevent an attack or to respond to an attack that is in progress. Course of actions apply for STIX 2.x.

Course of actions describes technical or automated responses (applying patches, reconfiguring firewalls). It can also describe higher-level actions like employee training or policy changes.

For example, a course of action to mitigate a vulnerability could describe applying the patch that fixes it.

• Define a course of action
  Define a course of action to prevent an attack or to respond to an attack that is in progress.

Parent Topic:IoC Repository

Related topics

Attack modes and methods

Indicators of compromise

Observables

Attack patterns

Campaigns

Identities

Infrastructure

Intrusion set

Locations

Malware

Malware analysis

Observed data

Threat actors

Threat groupings

Marking definitions

Threat notes

Threat opinions

Threat reports

Sightings

Tools

Vulnerabilities

Relationships

STIX Visualizer