Lion Cipher Lab
Build an OpenC2 command-and-response pipeline from scratch (offline)
- Threat Intel Analyst
- Advanced
- ~90 min
- Free · no account required
Why it matters
The slow part of incident response is almost never the decision -- it is the plumbing. A SOC analyst who already knows 'block that IP at the edge firewall and quarantine that host' still burns minutes translating that intent into whatever bespoke API each of five products happens to speak, and writes that translation glue five more times for the next five products. OpenC2 is OASIS's answer to that: one standardized language for the RESPONSE half of defense, so a detection produced by tool A can command a mitigation enforced by tool B without either vendor having heard of the other. The…
What you'll learn
- Modelling the OpenC2 Command shape {action, target, args?, actuator?, command_id?} and the Response shape {status, status_text?, results?} with HTTP-like status codes (200, 400, 404, 500, 501, 503)
- Implementing a Consumer for the canonical SLPF (Stateless Packet Filtering) Actuator Profile: enforcing which action/target pairs are valid (deny/allow on ipv4_connection and ipv4_net, delete on rule_number, query on features)
- Writing a Producer that emits well-formed commands and a dispatcher that returns 200 for a valid pair, 501 Not Implemented for an unsupported action or action/target pair, and 400 Bad Request for a malformed target
- Implementing the `query features` discovery handshake so a Producer can learn a Consumer's versions, profiles and supported pairs before commanding it
- Reproducing named failure modes as measured Responses, not assertions: an unsupported deny domain_name (501), a two-key malformed target (400), an insert_rule id collision (400), a duplicate command_id replay, and a response_requested:none that applies the rule but returns no body
- Being honest about the transport boundary: OpenC2 messages ride a transfer (HTTPS/MQTT) with content-type application/openc2+json;version=1.0 -- you are modelling the message layer offline, not the wire
- Knowing WHEN to reach for OpenC2 (vendor-neutral machine-to-machine response across a multi-tool estate) versus a single-vendor SOAR playbook or a raw firewall API, and how OpenC2 contrasts with STIX/TAXII (describe the threat vs command the response)
Steps in this lab
- What OpenC2 is, and the question this pipeline answers
- Set up: one folder, one file, no installs
- Model the OpenC2 message shape: the verb suite and the Response
- The SLPF Actuator Profile: which action/target pairs are legal
- The Producer: emit a well-formed command
- The Consumer: routing, replay detection, and the dispatch pipeline
- Run it: eight commands, and the named failure modes
- The judgment: when OpenC2 earns its place, and when it does not
- OpenC2 vs STIX/TAXII, and why you must never ship this Consumer