slug: tracebit
provider: Tracebit
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 2
edges:
- tag: Alerts
  spec_file: tracebit-alerts-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.85
  evidence: '''List Alerts'' / ''Get Alert Logs'' with schemas Canary, CanaryCredential, Severity, AlertIndicatorInformation,
    AwsPrincipal, OktaPrincipal — vendor ''raises high-fidelity alerts the moment an attacker touches
    one during lateral movement or credential access'''
  reason: These alerts are attacker-detection signals from deception canaries across AWS/Azure/Okta, i.e.
    threat detection and response, not generic monitoring or financial-crime alerting.
- tag: Canary Credentials
  spec_file: tracebit-canary-credentials-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.8
  evidence: '''POST /api/v1/credentials/issue-credentials  IssueCredentials'' and ''Confirm credentials
    deployment'', schemas AwsCanaryCredentials, SshCanaryCredentials, DecoyTokenLabel'
  reason: Issuance and deployment confirmation of decoy (canary) credentials is a cybersecurity detection
    control. Clearly BC-620; ambiguous between threat-detection tooling and security architecture, so
    L1 only.