slug: armosec
provider: ARMO
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 5
edges:
- tag: Vulnerabilities
  spec_file: armosec-vulnerabilities-api-openapi.yml
  capability_id: BC-620.40
  capability_id_l1: BC-620
  capability_name: Vulnerability Management
  confidence: 0.95
  evidence: POST /vulnerability/scan  issueVulnerabilityScan  Issue a vulnerability scan; GET /vulnerability/exception  listVulnerabilityExceptions
  reason: Operations issue vulnerability scans, roll up severity, list top vulnerabilities by image/component,
    and manage exceptions — textbook vulnerability scanning and remediation tracking under Cybersecurity
    Management.
- tag: Runtime
  spec_file: armosec-runtime-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.85
  evidence: GET /runtime/incidents  listRuntimeIncidents; POST /runtime/incidents/{incidentGUID}/resolve  resolveRuntimeIncident;
    GET /runtime/incidents/severity
  reason: Runtime security incident detection, alerting, severity triage and resolution plus network/seccomp
    policy generation — this is SOC-style threat detection and response, not ITSM incident management,
    because the incidents are runtime security detections from a CADR product.
- tag: Security Risks
  spec_file: armosec-security-risks-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.75
  evidence: GET /security/risks  listSecurityRisks; GET /security/risks/severities  getSecurityRiskSeverities;
    GET /attack/chains  getAttackChains
  reason: Enumeration and severity triage of security risks and attack chains across the cloud-native
    estate — clearly Cybersecurity Management. Left at L1 because the evidence straddles vulnerability
    findings and threat exposure analysis without naming either sub-capability.
- tag: Posture
  spec_file: armosec-posture-api-openapi.yml
  capability_id: BC-620.10
  capability_id_l1: BC-620
  capability_name: Security Strategy & Governance Management
  confidence: 0.72
  evidence: POST /posture/frameworks  getPostureFrameworks  Get posture scan summary per framework; POST
    /posture/controls  getPostureControls  Get posture control results; POST /posture/exception  createPostureException
  reason: Security posture management against compliance frameworks with control results and control exceptions
    — security frameworks/GRC, i.e. Security Strategy & Governance Management. Some ambiguity with Regulatory
    Compliance Management, but the controls are technical security controls on Kubernetes/IaC resources,
    so the cybersecurity L2 is the better fit.
- tag: Registry
  spec_file: armosec-registry-api-openapi.yml
  capability_id: BC-620.40
  capability_id_l1: BC-620
  capability_name: Vulnerability Management
  confidence: 0.72
  evidence: POST /registry/scan  issueRegistryScan  Issue a registry scan or set scheduler
  reason: Triggers and schedules container image registry scanning; vendor describes 'vulnerability and
    image scanning'. That is Vulnerability Management. Confidence moderated because the three operations
    only configure the scan cron job rather than expose findings.