slug: microsoft-defender-for-cloud
provider: Microsoft Defender for Cloud
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 3
edges:
- tag: Alerts
  spec_file: microsoft-defender-for-cloud-alerts-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.92
  evidence: POST .../alerts/{alertName}/resolve  alerts_updateSubscriptionLevelStateToResolve  Resolve
    a subscription-level alert
  reason: Operations list, triage, dismiss, resolve and simulate security alerts from a cloud workload
    protection platform — squarely threat detection and response, not generic monitoring or financial-crime
    alerting.
- tag: Assessments
  spec_file: microsoft-defender-for-cloud-assessments-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.8
  evidence: GET /{resourceId}/providers/Microsoft.Security/assessments — "List security assessments for
    a resource scope"
  reason: Operations read security posture assessments of cloud resources, which is cybersecurity control
    assessment; the evidence does not clearly name a single sub-capability (governance vs vulnerability),
    so only the L1 is asserted.
- tag: SecureScores
  spec_file: microsoft-defender-for-cloud-securescores-api-openapi.yml
  capability_id: BC-620.10
  capability_id_l1: BC-620
  capability_name: Security Strategy & Governance Management
  confidence: 0.7
  evidence: '"List secure scores for a subscription"'
  reason: Secure score is an aggregate security posture measure used for security governance and reporting;
    maps to Cybersecurity Management, most plausibly security strategy/governance measurement, though
    the surface is thin.