slug: alienvault
provider: AlienVault
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 1
edges:
- tag: Indicators
  spec_file: alienvault-indicators-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.8
  evidence: GET /api/v1/indicators/{type}/{indicator}/{section} getIndicatorDetails; POST /api/v1/indicators/submit_file
    "Submit a file for analysis"; "indicators of compromise (IOCs) such as malicious IPs, domains, hostnames,
    URLs, file hashes, and CVEs"
  reason: Operations submit and retrieve threat-intelligence indicators of compromise for analysis, which
    is threat intelligence feeding detection and response. Slight ambiguity between threat detection/response
    and vulnerability management keeps this at 0.8.