slug: chaitin provider: Chaitin Tech generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 41 edges: - tag: log/attack spec_file: chaitin-log-attack-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: GET /open/records get attack logs reason: Retrieval of attack detection records from a WAF/API-security product is threat detection and response telemetry, not generic logging. - tag: ueba/log/{ueba_category}/list spec_file: chaitin-ueba-log-ueba-category-list-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: POST /ueba/log/{ueba_category}/list — UEBA事件列表 reason: Lists UEBA security events by category for a security vendor's platform — behavioural anomaly/threat event surfacing, i.e. SOC/SIEM threat detection and response, not HR or general log management. - tag: ueba/staff/{staff_id}/eventlist spec_file: chaitin-ueba-staff-staff-id-eventlist-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: POST /ueba/staff/{staff_id}/eventlist — UEBA用户页事件列表 reason: Per-user list of UEBA security events on a cybersecurity platform — user behaviour anomaly detection, part of threat detection and response. - tag: vulnerability spec_file: chaitin-vulnerability-api-openapi.yml capability_id: BC-620.40 capability_id_l1: BC-620 capability_name: Vulnerability Management confidence: 0.85 evidence: GET /api/VulnerabilityDetailStatistics, GET /api/VulnerabilityStatistics, PUT /api/VulnerabilityAPI reason: Operations manage and report on vulnerabilities on a security platform, matching Vulnerability Management (scanning, remediation tracking). - tag: account spec_file: chaitin-account-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST /api/LoginAPI; PUT /api/ChangePasswordWithoutLoginAPI; PUT /api/ChangeUserCredentialAPI; GET /api/DownloadUserCertAPI reason: The surface performs authentication, credential/password change, certificate-based login and logout for platform users, i.e. identity and access management. Not compressed to 0.95 because much of this is product-internal auth plumbing rather than an enterprise IAM service. - tag: dashboard spec_file: chaitin-dashboard-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.8 evidence: GET /api/AssetDashboardDetectEventsAPI ... GET /api/AssetDashboardRiskVulnerableAPI ... GET /api/AssetDashboardSensitiveDataAPI ... GET /api/HomeDashBoardOwaspAPI reason: Dashboard read APIs aggregate detected security events, vulnerable/risky APIs, sensitive-data exposure and OWASP categories for the API-security product — clearly cybersecurity posture reporting. Spans detection and vulnerability views, so L1 only. - tag: log/rule spec_file: chaitin-log-rule-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: GET /open/records/rule get black or white rule attack logs reason: Attack logs generated by blacklist/whitelist rules in the WAF are security detection events; same threat-detection surface as the attack log tag. - tag: ueba/staff/list spec_file: chaitin-ueba-staff-list-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: POST /ueba/staff/list — UEBA用户页员工列表 reason: Despite 'staff', this lists monitored users on the UEBA (user behaviour analytics) page of a security platform — insider-threat/behaviour monitoring subjects, not HR employee records. - tag: ueba/staff/{staff_id}/score spec_file: chaitin-ueba-staff-staff-id-score-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: POST /ueba/staff/{staff_id}/score — UEBA用户页用户总分 reason: Returns a user's aggregate UEBA risk score in a security product — insider-threat/anomaly risk scoring under threat detection and response, not employee performance scoring. - tag: ueba/{ueba_id} spec_file: chaitin-ueba-ueba-id-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: POST /ueba/{ueba_id} UEBA修改事件策略 (modify UEBA event policy) reason: Editing UEBA detection event policies is configuration of behavioural threat-detection rules within the security platform. - tag: ueba/{ueba_id}/action/remove spec_file: chaitin-ueba-ueba-id-action-remove-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: POST /ueba/{ueba_id}/action/remove UEBA删除事件策略 (delete UEBA event policy) reason: Deletion of UEBA behavioural detection policies — lifecycle of threat-detection rules. - tag: ueba/{ueba_id}/detail spec_file: chaitin-ueba-ueba-id-detail-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: POST /ueba/{ueba_id}/detail UEBA事件策略详情 (UEBA event policy detail) reason: Reads detail of a UEBA behavioural detection policy; part of threat detection rule management. - tag: risk spec_file: chaitin-risk-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.72 evidence: GET /api/RiskEventAPI, GET /api/RiskEventGroupAPI, POST /api/EventWhiteListAPI, PUT /api/EnableDisableRiskStrategyAPI reason: 'Security risk-event detection surface of a cybersecurity product: risk events, event grouping/statistics, whitelisting and detection-strategy toggles. This is security threat detection and response, not enterprise risk management.' - tag: policy spec_file: chaitin-policy-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /api/PolicyRuleAPI, PUT /api/PolicyRulePriorityAPI, POST /api/PolicyRuleSiteBindingAPI, GET /api/SkynetModuleAPI reason: Creation and ordering of protection policy rules and binding them to protected sites, plus detection module (Skynet) toggles, on a WAF product — i.e. configuration of security controls. Cybersecurity Management at L1; no single L2 clearly fits technical rule enforcement. - tag: policy/externaldevice/dbc780f7-4099-48e2-8db4-5fe000c2022a spec_file: chaitin-policy-externaldevice-dbc780f7-4099-48e2-8db4-5fe000c2022a-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/externaldevice/... 管控策略极速模式更新 reason: Updates a peripheral/external-device control policy (外设管控策略) — an endpoint security control configuration in Chaitin's security management platform. Cybersecurity Management at L1; not clearly identity/access or vulnerability, so no L2. - tag: policy/externaldevice/entitywhitelist/list spec_file: chaitin-policy-externaldevice-entitywhitelist-list-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/externaldevice/entitywhitelist/list 外设管控实体白名单 reason: Lists the whitelist entities for external-device control policy — a security enforcement control list. Maps to Cybersecurity Management at L1 only; the surface is policy configuration rather than a specific named sub-capability. - tag: policy/externaldevice/list spec_file: chaitin-policy-externaldevice-list-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/externaldevice/list 外设管控策略列表 reason: Lists peripheral-device control policies, an endpoint security control surface in a cybersecurity product. L1 Cybersecurity Management; no L2 asserted. - tag: policy/phishing_protection/create spec_file: chaitin-policy-phishing-protection-create-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/phishing_protection/create 钓鱼防护策略创建 reason: Creates anti-phishing protection policies for a cybersecurity product — a security control/threat-prevention policy, hence Cybersecurity Management; evidence does not clearly single out governance vs threat response sub-capability. - tag: policy/phishing_protection/list spec_file: chaitin-policy-phishing-protection-list-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/phishing_protection/list 钓鱼防护策略列表 reason: Lists phishing-protection policies in Chaitin's security management platform; clearly cybersecurity control policy administration, sub-capability left null. - tag: policy/realtime_monitor/{policy_id}/action spec_file: chaitin-policy-realtime-monitor-policy-id-action-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/realtime_monitor/{policy_id}/action 实时监控修改策略状态 reason: Enabling/disabling a real-time monitoring security policy in Chaitin's host/endpoint security management console — a cybersecurity control configuration surface. L1 Cybersecurity Management is supportable; the single CRUD-style operation is too thin to pin a sub-capability (threat detection vs. security governance). - tag: policy/software/processwhitelist spec_file: chaitin-policy-software-processwhitelist-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/software/processwhitelist 日志中心软件管控快捷加白 reason: Adds a process to the software-control whitelist from the log centre — application/process allow-listing, a host security control. L1 Cybersecurity Management fits; it sits between threat response and security architecture, so no L2 asserted. - tag: policy/webpost_control/list spec_file: chaitin-policy-webpost-control-list-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/webpost_control/list 网页管控策略列表 (web control policy list) reason: Lists security control policies in Chaitin's APISec/WAF management plane. This is security policy administration, mapping to Cybersecurity Management; no L2 is a clean fit since it is control-policy configuration rather than IAM, vulnerability or SOC work. - tag: policy/webpost_control/{policy_id}/action spec_file: chaitin-policy-webpost-control-policy-id-action-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/webpost_control/{policy_id}/action 网页管控启用状态更新 (enable/disable state update) reason: Enables or disables a web-control security policy; runtime security control governance in a WAF/API-security product. - tag: policy/webpost_control/{policy_id}/detail spec_file: chaitin-policy-webpost-control-policy-id-detail-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/webpost_control/{policy_id}/detail 网页管控策略详情 reason: Retrieves a security control policy definition; Cybersecurity Management (security policy/control administration). - tag: policy/webpost_control/{policy_id}/remove spec_file: chaitin-policy-webpost-control-policy-id-remove-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/webpost_control/{policy_id}/remove 网页管控策略删除 reason: Deletes a web-control security policy; lifecycle management of enforcement policies in a cybersecurity product. - tag: policy/webpost_control/{policy_id}/update spec_file: chaitin-policy-webpost-control-policy-id-update-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /policy/webpost_control/{policy_id}/update 网页管控策略更新 reason: Updates a web-content control security policy; security control configuration under Cybersecurity Management. - tag: report/dashboard/chart/query spec_file: chaitin-report-dashboard-chart-query-api-openapi.yml capability_id: BC-610.50 capability_id_l1: BC-610 capability_name: Analytics & BI Management confidence: 0.7 evidence: POST /report/dashboard/chart/query 图表数据查询 (chart data query) reason: Operation queries data for a dashboard chart — reporting/BI delivery surface, mapped to Analytics & BI Management rather than any security-specific capability since the operation itself is generic dashboard charting. - tag: report/dashboard/create spec_file: chaitin-report-dashboard-create-api-openapi.yml capability_id: BC-610.50 capability_id_l1: BC-610 capability_name: Analytics & BI Management confidence: 0.7 evidence: POST /report/dashboard/create 仪表盘创建 reason: Creates dashboards — reporting and BI delivery capability; no evidence of security-control operations in this tag. - tag: report/dashboard/list spec_file: chaitin-report-dashboard-list-api-openapi.yml capability_id: BC-610.50 capability_id_l1: BC-610 capability_name: Analytics & BI Management confidence: 0.7 evidence: POST /report/dashboard/list 仪表盘列表 reason: Lists dashboards in the reporting module — Analytics & BI Management. - tag: rule spec_file: chaitin-rule-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: GET /open/policy list customized rule; PUT /open/policy/switch enable/disable customized rule reason: CRUD over customised protection policies/rules of a web application firewall. Clearly cybersecurity control management; ambiguous between security policy governance and detection-rule tuning, so no L2 asserted. - tag: system/accesscontrol/realtimepolicy/modify spec_file: chaitin-system-accesscontrol-realtimepolicy-modify-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /system/accesscontrol/realtimepolicy/modify 即时策略（修改） reason: Modifies immediate/real-time access-control policies within the accesscontrol module of a security appliance — access policy administration, mapping to Identity & Access Management. - tag: system/accesscontrol/realtimepolicy/retrieve spec_file: chaitin-system-accesscontrol-realtimepolicy-retrieve-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /system/accesscontrol/realtimepolicy/retrieve 即时策略（query） reason: Queries real-time access-control policies in the accesscontrol module — administration of access policy, i.e. Identity & Access Management, not a business-domain capability. - tag: ueba/index/aggcount spec_file: chaitin-ueba-index-aggcount-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/index/aggcount UEBA首页聚合统计 reason: Aggregate statistics for the UEBA console home page — reporting over security behaviour-analytics events, i.e. part of the threat detection surface. Confidence moderated because the operation is a dashboard statistic. - tag: ueba/index/count spec_file: chaitin-ueba-index-count-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/index/count UEBA首页事件统计 reason: Counts of UEBA security events for the console overview; belongs to security threat detection/monitoring rather than any general analytics capability. - tag: ueba/log/action/bulkdestroy spec_file: chaitin-ueba-log-action-bulkdestroy-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/log/action/bulkdestroy UEBA事件批量删除 reason: Bulk deletion of UEBA security events; although a CRUD action, the object is a security detection event, placing it in threat detection and response operations. - tag: ueba/log/{ueba_category}/download spec_file: chaitin-ueba-log-ueba-category-download-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/log/{ueba_category}/download — UEBA事件导出 reason: Export of UEBA (user & entity behaviour analytics) security event logs within a cybersecurity vendor's platform; sits in SOC/SIEM-style threat detection. Confidence tempered because the operation itself is an export function. - tag: ueba/staff/{staff_id}/calendar spec_file: chaitin-ueba-staff-staff-id-calendar-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/staff/{staff_id}/calendar — UEBA用户页日历图 reason: Calendar heatmap of a monitored user's UEBA activity/anomaly events — behavioural threat monitoring visualisation, not scheduling or HR calendaring. - tag: ueba/staff/{staff_id}/radar spec_file: chaitin-ueba-staff-staff-id-radar-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/staff/{staff_id}/radar — UEBA用户页雷达图 reason: Radar chart of a monitored user's UEBA behaviour dimensions — analytics view within security behaviour monitoring, not performance appraisal. - tag: ueba/test/{event_id} spec_file: chaitin-ueba-test-event-id-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /ueba/test/{event_id} 测试事件结果 (UEBA test event result) reason: Retrieves results of a UEBA behavioural-detection event test — security threat detection surface, not a business-domain object. - tag: whitelist/file/{fw_id}/detail spec_file: chaitin-whitelist-file-fw-id-detail-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /whitelist/file/{fw_id}/detail 文件白名单详情 — file whitelist detail in Chaitin's security (APISec/host security) product reason: Operation retrieves detail of a file allowlist entry used by a security enforcement product; this is configuration of a security control, so Cybersecurity Management at L1. No single L2 is clearly named (policy/governance vs detection tuning), so L2 abstained. - tag: whitelist/network spec_file: chaitin-whitelist-network-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /whitelist/network 创建白名单HTTP reason: Creates an HTTP network allowlist rule in a WAF/security platform — configuration of security enforcement controls, hence Cybersecurity Management. Sub-capability not determinable.