slug: cybelangel
provider: CybelAngel
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 5
edges:
- tag: Threat Intelligence
  spec_file: cybelangel-threat-intelligence-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.8
  evidence: GET /v1/threat-intelligence/claimed-attacks  Get claimed attacks; schemas ClaimedAttackDTO,
    ClaimedAttackCategory, ClaimedAttackNetwork
  reason: The surface delivers cyber threat intelligence on claimed attacks (e.g. ransomware claims) consumed
    for detection and response, which realises Threat Detection & Response Management.
- tag: stix
  spec_file: cybelangel-stix-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.8
  evidence: GET /v1/stix/alerts  Search alerts in STIX 2.1 format; schemas StixAlertsResponse, AlertCategory,
    AlertStatus
  reason: Exposes security exposure alerts in the STIX threat-intel interchange format for ingestion into
    SOC/SIEM tooling — Threat Detection & Response Management. Not financial-crime alerting.
- tag: Alerts
  spec_file: cybelangel-alerts-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.78
  evidence: GET /v1/alerts/{alert_id}/leak-credentials  Get leak alert credentials; GET /v1/alerts/{alert_id}/codeshare-findings  Get
    codeshare alert findings
  reason: Alerts here are external-threat detections (leaked credentials, code-share findings, DNS/impersonation
    screenshots) with customer assessment fields — i.e. security threat detection and triage, not business
    alerting. Mapped to Threat Detection & Response.
- tag: Incident Reports
  spec_file: cybelangel-incident-reports-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.75
  evidence: POST /v1/reports/remediation-request  Create a Remediation Request; PUT /v1/reports/{report-id}/status  Update
    status of a report; schema ReportIncidentType
  reason: Security incident report lifecycle — retrieval, status updates, analyst comments and remediation
    requests for detected external exposures. Fits incident detection and response within Cybersecurity
    Management.
- tag: ADM Inventory
  spec_file: cybelangel-adm-inventory-api-openapi.yml
  capability_id: BC-620.40
  capability_id_l1: BC-620
  capability_name: Vulnerability Management
  confidence: 0.7
  evidence: GET /v1/inventory/assets/threats  Get inventory threats with asset info; schemas OpenPortDTO,
    SubDomainTakeoverThreatDataDTO, TLSCertificateThreatDataDTO
  reason: External attack-surface asset inventory with discovered exposures (open ports, TLS certificate
    issues, subdomain takeover) and status workflow on those threats — this is cybersecurity exposure/vulnerability
    discovery and remediation tracking. Some ambiguity between Vulnerability Management and Threat Detection,
    hence 0.7.