Unified Incident Monitoring and Response in Softwarized Networks with OpenC2

Security operations in software-defined and virtualized networks often require coordinating heterogeneous tools for monitoring, evidence collection, and response. However, these tools expose different configuration models, APIs, and execution semantics, which complicates automation and incident response workflows. This paper presents an OpenC2-based orchestration layer that extends command-level cyber-defense coordination beyond classical enforcement actions. We introduce three actuator profiles for network-flow monitoring, file/log collection, and constrained remote command execution, and implement them using nProbe, Packetbeat, Filebeat, and Linux-based actuators. The resulting prototype provides a uniform command interface for activating monitoring functions, collecting operational evidence, and executing controlled response actions. We validate the approach through schema-conformance tests, positive and negative command cases, safety checks, and latency measurements in representative orchestration workflows.