slug: dragos
provider: Dragos
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 2
edges:
- tag: Indicators
  spec_file: dragos-indicators-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.85
  evidence: '''API access to the WorldView Reports and Indicators''; GET /api/v1/indicators.stix2 ''Returns
    a paginated stix2 bundle of indicators'''
  reason: Distribution of indicators of compromise in STIX2 for consumption by detection tooling — threat
    intelligence feeding threat detection and response.
- tag: Products
  spec_file: dragos-products-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.72
  evidence: '"Returns the STIX2.0 JSON bundle for the indicators related to a given serial" / "API access
    to the WorldView Reports and Indicators"'
  reason: The 'Products' tag exposes WorldView threat-intelligence reports and indicators of compromise
    (CSV/STIX2 bundles). Consuming IOCs and threat reports serves threat detection and response operations;
    it is not a commercial product catalogue despite the tag name. Confidence held at moderate because
    the surface is read-only intel distribution rather than detection tooling itself.