Cybersecurity Management › Threat Detection & Response Management
Threat Detection & Response Management
BC-620.30
Level 2
Cross-Industry
7 providers
69 API surfaces
5 rated strong or better
SOC, SIEM, incident response.
Threat Detection & Response Management (BC-620.30) is a level-2 business capability under Cybersecurity Management in the Cross-Industry model. The catalog holds 69 API surface(s) from 7 provider(s) that can perform some part of it, 5 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.
Where this capability definition comes from.
This capability is part of a published business-architecture model that API Evangelist
did not author. It is redistributed here under
CC-BY-4.0.
Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0
Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented.
Source repository · NOTICE and third-party framework attributions
Sub-capabilities
Security Monitoring and SIEM Operations BC-620.30.10
SIEM, SOAR, and security telemetry monitoring.
no catalog coverage
Threat Hunting BC-620.30.20
Proactive hypothesis-driven threat hunting.
no catalog coverage
Cyber Threat Intelligence BC-620.30.30
Collection, analysis, and dissemination of cyber threat intelligence.
no catalog coverage
Cyber Incident Response BC-620.30.40
Detection, containment, eradication, and recovery from cyber incidents.
no catalog coverage
Digital Forensics BC-620.30.50
Forensic acquisition and analysis in support of incidents and litigation.
no catalog coverage
Providers that reach this capability
Ordered by rating band. Reach means a provider publishes an API surface that can perform
some part of this capability — it is not a claim that any particular
organisation has deployed it.
Exemplar
1
Complete, well-documented, and agent-ready
Strong
4
Solid coverage with minor gaps
Developing
1
Usable, with meaningful gaps to close
Thin
1
Limited public surface area
This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature.
This page shows
which providers and tags reach Threat Detection & Response Management. The underlying
tag → capability edges — each with the quoted fragment of the provider's own
OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate
it passed — are available through the API, along with company-level capability maps.
Only edges at confidence ≥ 0.7 with evidence found verbatim in
the source contract are published at all.
See plans →
·
How the edges are graded →