Course of actions

A course of action is an action taken either to prevent an attack or to respond to an attack that is in progress. Course of actions apply for STIX 2.x.

Course of actions describes technical or automated responses (applying patches, reconfiguring firewalls). It can also describe higher-level actions like employee training or policy changes.

For example, a course of action to mitigate a vulnerability could describe applying the patch that fixes it.

• Define a course of action
  Define a course of action to prevent an attack or to respond to an attack that is in progress.

Related concepts

• Attack modes and methods
• Indicators of compromise
• Observables
• Attack patterns
• Campaigns
• Identities
• Infrastructure
• Intrusion set
• Locations
• Malware
• Malware analysis
• Observed data
• Threat actors
• Threat groupings
• Marking definitions
• Threat notes
• Threat opinions
• Threat reports
• Sightings
• Tools
• Vulnerabilities
• Relationships
• STIX Visualizer