This repository was archived by the owner on Dec 5, 2025. It is now read-only.
This repository was archived by the owner on Dec 5, 2025. It is now read-only.
Add PAP to case to indicate which kind of action is allowed #616
Description
Request Type
Feature Request
Description
PAP (for Permissible Actions Protocol) aims to indicate to analyst the posture to adopt: how much we accept that the attacker detect the current analysis.
As for TLP, PAP is declined in 4 values:
- RED (3): Non-detectable actions only. Recipients may not use PAP:RED information on the network. Only passive actions on logs, that are not detectable from the outside.
- AMBER (2): Passive cross check. Recipients may use PAP:AMBER information for conducting online checks, like using services provided by third parties (e.g. VirusTotal), or set up a monitoring honeypot.
- GREEN (1): Active actions allowed. Recipients may use PAP:GREEN information to ping the target, block incoming/outgoing traffic from/to the target or specifically configure honeypots to interact with the target.
- WHITE (0): No restrictions in using this information.
Tasks
- Add
papattribute to case class - Add
papattribute to case template class - Add corresponding mapping migration
- Update case template UI
- Update case details page
- Update case creation dialog
- Update template of case items in search page
- Update template of case items in flow