# Cybersecurity Playbook Sharing with STIX 2.1

arXiv: https://arxiv.org/abs/2203.04136 · HTML: https://mlsanity.com/paper/2203.04136/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Jan 2022.

## Built on by (most cited first, 2 of 2)

- [On the use of neurosymbolic AI for defending against cyber attacks](https://mlsanity.com/paper/2408.04996/) (2024)
- [From Legacy to Standard: LLM-Assisted Transformation of Cybersecurity Playbooks into CACAO Format](https://mlsanity.com/paper/2508.03342/) (2025)

## Abstract (arXiv)

Understanding that interoperable security playbooks will become a fundamental component of defenders' arsenal to decrease attack detection and response times, it is time to consider their position in structured sharing efforts. This report documents the process of extending Structured Threat Information eXpression (STIX) version 2.1, using the available extension definition mechanism, to enable sharing security playbooks, including Collaborative Automated Course of Action Operations (CACAO) playbooks.