CoCoa: An Ontology for Cybersecurity Operations Centre Analysis Process

A cybersecurity operations centre ontology for analysis (CoCoa) is proposed, which aligns to the NIST cybersecurity framework. CoCoa is a process ontology for the CSOC analysis processes that provides the cybersecurity analysts operational situational awareness of the vital aspects of the CSOC. The process ontology offers a fundamental shift from log collection to the analysis of five overarching threat intelligence and information sources (namely - events and logs, network information, structured digital feed, semi and un-structured feed and threat intelligence), which should allow the CSOC to provide proactive monitoring, detection of inflight, emerging and complex threats that would not have ordinarily been detected through only events and logs. Further, and most importantly, the proposed ontology is then used to identify how cyber incidents can be realised and detected through ontology-based knowledge graph.