slug: saas-alerts
provider: SaaS Alerts
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 2
edges:
- tag: Events
  spec_file: saas-alerts-events-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.9
  evidence: GET /reports/events listSecurityEvents List Security Events; schema SecurityEvent; 'querying
    of security events, alerts, and user behavior data detected across monitored SaaS applications'
  reason: Operations retrieve and query detected security events across monitored SaaS estates — clearly
    threat detection and response (SOC/SIEM-style) tooling.
- tag: Reports
  spec_file: saas-alerts-reports-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.8
  evidence: GET /reports/alerts listAlerts List Security Alerts; schema SecurityAlert, MonitoredUser
  reason: Despite the generic 'Reports' tag, the operations surface security alerts and the monitored
    user/customer scope behind them — threat detection and response. Slight ambiguity because customer/user
    listings are partly tenant inventory.