[ { "capability_id": "ai.assistant.classify", "stable_id": "OSCO-CAP-1013", "name": "Classify Assistant", "description": "Perform classify operation on assistant in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.assistant.classify" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "assistant state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.assistant.classify", "type": "safe_execute", "description": "Safely verify ai.assistant.classify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.assistant.classify", "type": "declared", "state": "declared", "description": "Discover declared support for ai.assistant.classify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-3001", "external_name": "Ai Assistant Classify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.assistant.explain", "stable_id": "OSCO-CAP-1015", "name": "Explain Assistant", "description": "Perform explain operation on assistant in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.assistant.explain" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "assistant state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.assistant.explain", "type": "safe_execute", "description": "Safely verify ai.assistant.explain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.assistant.explain", "type": "declared", "state": "declared", "description": "Discover declared support for ai.assistant.explain" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-3003", "external_name": "Ai Assistant Explain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.assistant.reason", "stable_id": "OSCO-CAP-1011", "name": "Reason Assistant", "description": "Perform reason operation on assistant in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.assistant.reason" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "assistant state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.assistant.reason", "type": "safe_execute", "description": "Safely verify ai.assistant.reason with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.assistant.reason", "type": "declared", "state": "declared", "description": "Discover declared support for ai.assistant.reason" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2999", "external_name": "Ai Assistant Reason", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.assistant.suggest", "stable_id": "OSCO-CAP-1012", "name": "Suggest Assistant", "description": "Perform suggest operation on assistant in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.assistant.suggest" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "assistant state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.assistant.suggest", "type": "safe_execute", "description": "Safely verify ai.assistant.suggest with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.assistant.suggest", "type": "declared", "state": "declared", "description": "Discover declared support for ai.assistant.suggest" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-3000", "external_name": "Ai Assistant Suggest", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.assistant.summarize", "stable_id": "OSCO-CAP-1014", "name": "Summarize Assistant", "description": "Perform summarize operation on assistant in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.assistant.summarize" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "assistant state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.assistant.summarize", "type": "safe_execute", "description": "Safely verify ai.assistant.summarize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.assistant.summarize", "type": "declared", "state": "declared", "description": "Discover declared support for ai.assistant.summarize" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-3002", "external_name": "Ai Assistant Summarize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.classification.classify", "stable_id": "OSCO-CAP-1008", "name": "Classify Classification", "description": "Perform classify operation on classification in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.classification.classify" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "classification state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.classification.classify", "type": "safe_execute", "description": "Safely verify ai.classification.classify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.classification.classify", "type": "declared", "state": "declared", "description": "Discover declared support for ai.classification.classify" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2996", "external_name": "Ai Classification Classify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.classification.explain", "stable_id": "OSCO-CAP-1010", "name": "Explain Classification", "description": "Perform explain operation on classification in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.classification.explain" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "classification state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.classification.explain", "type": "safe_execute", "description": "Safely verify ai.classification.explain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.classification.explain", "type": "declared", "state": "declared", "description": "Discover declared support for ai.classification.explain" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2998", "external_name": "Ai Classification Explain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.classification.reason", "stable_id": "OSCO-CAP-1006", "name": "Reason Classification", "description": "Perform reason operation on classification in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.classification.reason" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "classification state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.classification.reason", "type": "safe_execute", "description": "Safely verify ai.classification.reason with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.classification.reason", "type": "declared", "state": "declared", "description": "Discover declared support for ai.classification.reason" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2994", "external_name": "Ai Classification Reason", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.classification.suggest", "stable_id": "OSCO-CAP-1007", "name": "Suggest Classification", "description": "Perform suggest operation on classification in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.classification.suggest" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "classification state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.classification.suggest", "type": "safe_execute", "description": "Safely verify ai.classification.suggest with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.classification.suggest", "type": "declared", "state": "declared", "description": "Discover declared support for ai.classification.suggest" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2995", "external_name": "Ai Classification Suggest", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.classification.summarize", "stable_id": "OSCO-CAP-1009", "name": "Summarize Classification", "description": "Perform summarize operation on classification in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.classification.summarize" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "classification state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.classification.summarize", "type": "safe_execute", "description": "Safely verify ai.classification.summarize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.classification.summarize", "type": "declared", "state": "declared", "description": "Discover declared support for ai.classification.summarize" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2997", "external_name": "Ai Classification Summarize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.reasoning.classify", "stable_id": "OSCO-CAP-0998", "name": "Classify Reasoning", "description": "Perform classify operation on reasoning in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.reasoning.classify" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "reasoning state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.reasoning.classify", "type": "safe_execute", "description": "Safely verify ai.reasoning.classify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.reasoning.classify", "type": "declared", "state": "declared", "description": "Discover declared support for ai.reasoning.classify" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2986", "external_name": "Ai Reasoning Classify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.reasoning.explain", "stable_id": "OSCO-CAP-1000", "name": "Explain Reasoning", "description": "Perform explain operation on reasoning in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.reasoning.explain" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "reasoning state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.reasoning.explain", "type": "safe_execute", "description": "Safely verify ai.reasoning.explain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.reasoning.explain", "type": "declared", "state": "declared", "description": "Discover declared support for ai.reasoning.explain" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2988", "external_name": "Ai Reasoning Explain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.reasoning.reason", "stable_id": "OSCO-CAP-0996", "name": "Reason Reasoning", "description": "Perform reason operation on reasoning in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.reasoning.reason" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "reasoning state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.reasoning.reason", "type": "safe_execute", "description": "Safely verify ai.reasoning.reason with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.reasoning.reason", "type": "declared", "state": "declared", "description": "Discover declared support for ai.reasoning.reason" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2984", "external_name": "Ai Reasoning Reason", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.reasoning.suggest", "stable_id": "OSCO-CAP-0997", "name": "Suggest Reasoning", "description": "Perform suggest operation on reasoning in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.reasoning.suggest" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "reasoning state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.reasoning.suggest", "type": "safe_execute", "description": "Safely verify ai.reasoning.suggest with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.reasoning.suggest", "type": "declared", "state": "declared", "description": "Discover declared support for ai.reasoning.suggest" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2985", "external_name": "Ai Reasoning Suggest", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.reasoning.summarize", "stable_id": "OSCO-CAP-0999", "name": "Summarize Reasoning", "description": "Perform summarize operation on reasoning in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.reasoning.summarize" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "reasoning state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.reasoning.summarize", "type": "safe_execute", "description": "Safely verify ai.reasoning.summarize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.reasoning.summarize", "type": "declared", "state": "declared", "description": "Discover declared support for ai.reasoning.summarize" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2987", "external_name": "Ai Reasoning Summarize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.recommendation.classify", "stable_id": "OSCO-CAP-1003", "name": "Classify Recommendation", "description": "Perform classify operation on recommendation in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.recommendation.classify" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "recommendation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.recommendation.classify", "type": "safe_execute", "description": "Safely verify ai.recommendation.classify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.recommendation.classify", "type": "declared", "state": "declared", "description": "Discover declared support for ai.recommendation.classify" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2991", "external_name": "Ai Recommendation Classify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.recommendation.explain", "stable_id": "OSCO-CAP-1005", "name": "Explain Recommendation", "description": "Perform explain operation on recommendation in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.recommendation.explain" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "recommendation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.recommendation.explain", "type": "safe_execute", "description": "Safely verify ai.recommendation.explain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.recommendation.explain", "type": "declared", "state": "declared", "description": "Discover declared support for ai.recommendation.explain" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2993", "external_name": "Ai Recommendation Explain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.recommendation.reason", "stable_id": "OSCO-CAP-1001", "name": "Reason Recommendation", "description": "Perform reason operation on recommendation in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.recommendation.reason" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "recommendation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.recommendation.reason", "type": "safe_execute", "description": "Safely verify ai.recommendation.reason with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.recommendation.reason", "type": "declared", "state": "declared", "description": "Discover declared support for ai.recommendation.reason" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2989", "external_name": "Ai Recommendation Reason", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.recommendation.suggest", "stable_id": "OSCO-CAP-1002", "name": "Suggest Recommendation", "description": "Perform suggest operation on recommendation in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.recommendation.suggest" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "recommendation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.recommendation.suggest", "type": "safe_execute", "description": "Safely verify ai.recommendation.suggest with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.recommendation.suggest", "type": "declared", "state": "declared", "description": "Discover declared support for ai.recommendation.suggest" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2990", "external_name": "Ai Recommendation Suggest", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "ai.recommendation.summarize", "stable_id": "OSCO-CAP-1004", "name": "Summarize Recommendation", "description": "Perform summarize operation on recommendation in the ai domain.", "category": "ai", "domain": "ai", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "ai.recommendation.summarize" ], "preconditions": [ "provider exposes ai capability surface" ], "postconditions": [ "recommendation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.ai.recommendation.summarize", "type": "safe_execute", "description": "Safely verify ai.recommendation.summarize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.ai.recommendation.summarize", "type": "declared", "state": "declared", "description": "Discover declared support for ai.recommendation.summarize" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2992", "external_name": "Ai Recommendation Summarize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.endpoint.create", "stable_id": "OSCO-CAP-0821", "name": "Create Endpoint", "description": "Perform create operation on endpoint in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.endpoint.create" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.endpoint.create", "type": "safe_execute", "description": "Safely verify api.endpoint.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.endpoint.create", "type": "declared", "state": "declared", "description": "Discover declared support for api.endpoint.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2809", "external_name": "Api Endpoint Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.endpoint.delete", "stable_id": "OSCO-CAP-0824", "name": "Delete Endpoint", "description": "Perform delete operation on endpoint in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.endpoint.delete" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.endpoint.delete", "type": "safe_execute", "description": "Safely verify api.endpoint.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.endpoint.delete", "type": "declared", "state": "declared", "description": "Discover declared support for api.endpoint.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2812", "external_name": "Api Endpoint Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.endpoint.read", "stable_id": "OSCO-CAP-0822", "name": "Read Endpoint", "description": "Perform read operation on endpoint in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.endpoint.read" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.endpoint.read", "type": "safe_execute", "description": "Safely verify api.endpoint.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.endpoint.read", "type": "declared", "state": "declared", "description": "Discover declared support for api.endpoint.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2810", "external_name": "Api Endpoint Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.endpoint.rotate", "stable_id": "OSCO-CAP-0825", "name": "Rotate Endpoint", "description": "Perform rotate operation on endpoint in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.endpoint.rotate" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.endpoint.rotate", "type": "safe_execute", "description": "Safely verify api.endpoint.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.endpoint.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for api.endpoint.rotate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2813", "external_name": "Api Endpoint Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.endpoint.update", "stable_id": "OSCO-CAP-0823", "name": "Update Endpoint", "description": "Perform update operation on endpoint in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.endpoint.update" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.endpoint.update", "type": "safe_execute", "description": "Safely verify api.endpoint.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.endpoint.update", "type": "declared", "state": "declared", "description": "Discover declared support for api.endpoint.update" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2811", "external_name": "Api Endpoint Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.quota.create", "stable_id": "OSCO-CAP-0831", "name": "Create Quota", "description": "Perform create operation on quota in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.quota.create" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "quota state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.quota.create", "type": "safe_execute", "description": "Safely verify api.quota.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.quota.create", "type": "declared", "state": "declared", "description": "Discover declared support for api.quota.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2819", "external_name": "Api Quota Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.quota.delete", "stable_id": "OSCO-CAP-0834", "name": "Delete Quota", "description": "Perform delete operation on quota in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.quota.delete" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "quota state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.quota.delete", "type": "safe_execute", "description": "Safely verify api.quota.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.quota.delete", "type": "declared", "state": "declared", "description": "Discover declared support for api.quota.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2822", "external_name": "Api Quota Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.quota.read", "stable_id": "OSCO-CAP-0832", "name": "Read Quota", "description": "Perform read operation on quota in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.quota.read" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "quota state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.quota.read", "type": "safe_execute", "description": "Safely verify api.quota.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.quota.read", "type": "declared", "state": "declared", "description": "Discover declared support for api.quota.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2820", "external_name": "Api Quota Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.quota.rotate", "stable_id": "OSCO-CAP-0835", "name": "Rotate Quota", "description": "Perform rotate operation on quota in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.quota.rotate" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "quota state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.quota.rotate", "type": "safe_execute", "description": "Safely verify api.quota.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.quota.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for api.quota.rotate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2823", "external_name": "Api Quota Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.quota.update", "stable_id": "OSCO-CAP-0833", "name": "Update Quota", "description": "Perform update operation on quota in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.quota.update" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "quota state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.quota.update", "type": "safe_execute", "description": "Safely verify api.quota.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.quota.update", "type": "declared", "state": "declared", "description": "Discover declared support for api.quota.update" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2821", "external_name": "Api Quota Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.scope.create", "stable_id": "OSCO-CAP-0826", "name": "Create Scope", "description": "Perform create operation on scope in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.scope.create" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "scope state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.scope.create", "type": "safe_execute", "description": "Safely verify api.scope.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.scope.create", "type": "declared", "state": "declared", "description": "Discover declared support for api.scope.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2814", "external_name": "Api Scope Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.scope.delete", "stable_id": "OSCO-CAP-0829", "name": "Delete Scope", "description": "Perform delete operation on scope in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.scope.delete" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "scope state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.scope.delete", "type": "safe_execute", "description": "Safely verify api.scope.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.scope.delete", "type": "declared", "state": "declared", "description": "Discover declared support for api.scope.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2817", "external_name": "Api Scope Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.scope.read", "stable_id": "OSCO-CAP-0827", "name": "Read Scope", "description": "Perform read operation on scope in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.scope.read" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "scope state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.scope.read", "type": "safe_execute", "description": "Safely verify api.scope.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.scope.read", "type": "declared", "state": "declared", "description": "Discover declared support for api.scope.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2815", "external_name": "Api Scope Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.scope.rotate", "stable_id": "OSCO-CAP-0830", "name": "Rotate Scope", "description": "Perform rotate operation on scope in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.scope.rotate" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "scope state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.scope.rotate", "type": "safe_execute", "description": "Safely verify api.scope.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.scope.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for api.scope.rotate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2818", "external_name": "Api Scope Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.scope.update", "stable_id": "OSCO-CAP-0828", "name": "Update Scope", "description": "Perform update operation on scope in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.scope.update" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "scope state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.scope.update", "type": "safe_execute", "description": "Safely verify api.scope.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.scope.update", "type": "declared", "state": "declared", "description": "Discover declared support for api.scope.update" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2816", "external_name": "Api Scope Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.token.create", "stable_id": "OSCO-CAP-0816", "name": "Create Token", "description": "Perform create operation on token in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.token.create" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.token.create", "type": "safe_execute", "description": "Safely verify api.token.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.token.create", "type": "declared", "state": "declared", "description": "Discover declared support for api.token.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2804", "external_name": "Api Token Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.token.delete", "stable_id": "OSCO-CAP-0819", "name": "Delete Token", "description": "Perform delete operation on token in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.token.delete" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.token.delete", "type": "safe_execute", "description": "Safely verify api.token.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.token.delete", "type": "declared", "state": "declared", "description": "Discover declared support for api.token.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2807", "external_name": "Api Token Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.token.read", "stable_id": "OSCO-CAP-0817", "name": "Read Token", "description": "Perform read operation on token in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.token.read" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.token.read", "type": "safe_execute", "description": "Safely verify api.token.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.token.read", "type": "declared", "state": "declared", "description": "Discover declared support for api.token.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2805", "external_name": "Api Token Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.token.rotate", "stable_id": "OSCO-CAP-0820", "name": "Rotate Token", "description": "Perform rotate operation on token in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.token.rotate" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.token.rotate", "type": "safe_execute", "description": "Safely verify api.token.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.token.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for api.token.rotate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2808", "external_name": "Api Token Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "api.token.update", "stable_id": "OSCO-CAP-0818", "name": "Update Token", "description": "Perform update operation on token in the api domain.", "category": "automation", "domain": "api", "platforms": [ "cloud", "saas", "cross_platform" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "api.token.update" ], "preconditions": [ "provider exposes api capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.api.token.update", "type": "safe_execute", "description": "Safely verify api.token.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.api.token.update", "type": "declared", "state": "declared", "description": "Discover declared support for api.token.update" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2806", "external_name": "Api Token Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.event.disable", "stable_id": "OSCO-CAP-0837", "name": "Disable Event", "description": "Perform disable operation on event in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.event.disable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.event.disable", "type": "safe_execute", "description": "Safely verify audit.event.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.event.disable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.event.disable" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2825", "external_name": "Audit Event Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.event.enable", "stable_id": "OSCO-CAP-0836", "name": "Enable Event", "description": "Perform enable operation on event in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.event.enable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.event.enable", "type": "safe_execute", "description": "Safely verify audit.event.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.event.enable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.event.enable" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2824", "external_name": "Audit Event Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.event.export", "stable_id": "OSCO-CAP-0839", "name": "Export Event", "description": "Perform export operation on event in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.event.export" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.event.export", "type": "safe_execute", "description": "Safely verify audit.event.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.event.export", "type": "declared", "state": "declared", "description": "Discover declared support for audit.event.export" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2827", "external_name": "Audit Event Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.event.query", "stable_id": "OSCO-CAP-0838", "name": "Query Event", "description": "Perform query operation on event in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.event.query" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.event.query", "type": "safe_execute", "description": "Safely verify audit.event.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.event.query", "type": "declared", "state": "declared", "description": "Discover declared support for audit.event.query" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2826", "external_name": "Audit Event Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.event.verify", "stable_id": "OSCO-CAP-0840", "name": "Verify Event", "description": "Perform verify operation on event in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.event.verify" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.event.verify", "type": "safe_execute", "description": "Safely verify audit.event.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.event.verify", "type": "declared", "state": "declared", "description": "Discover declared support for audit.event.verify" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2828", "external_name": "Audit Event Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.policy.disable", "stable_id": "OSCO-CAP-0847", "name": "Disable Policy", "description": "Perform disable operation on policy in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.policy.disable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.policy.disable", "type": "safe_execute", "description": "Safely verify audit.policy.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.policy.disable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.policy.disable" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2835", "external_name": "Audit Policy Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.policy.enable", "stable_id": "OSCO-CAP-0846", "name": "Enable Policy", "description": "Perform enable operation on policy in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.policy.enable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.policy.enable", "type": "safe_execute", "description": "Safely verify audit.policy.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.policy.enable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.policy.enable" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2834", "external_name": "Audit Policy Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.policy.export", "stable_id": "OSCO-CAP-0849", "name": "Export Policy", "description": "Perform export operation on policy in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.policy.export" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.policy.export", "type": "safe_execute", "description": "Safely verify audit.policy.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.policy.export", "type": "declared", "state": "declared", "description": "Discover declared support for audit.policy.export" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2837", "external_name": "Audit Policy Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.policy.query", "stable_id": "OSCO-CAP-0848", "name": "Query Policy", "description": "Perform query operation on policy in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.policy.query" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.policy.query", "type": "safe_execute", "description": "Safely verify audit.policy.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.policy.query", "type": "declared", "state": "declared", "description": "Discover declared support for audit.policy.query" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2836", "external_name": "Audit Policy Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.policy.verify", "stable_id": "OSCO-CAP-0850", "name": "Verify Policy", "description": "Perform verify operation on policy in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.policy.verify" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.policy.verify", "type": "safe_execute", "description": "Safely verify audit.policy.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.policy.verify", "type": "declared", "state": "declared", "description": "Discover declared support for audit.policy.verify" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2838", "external_name": "Audit Policy Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.retention.disable", "stable_id": "OSCO-CAP-0852", "name": "Disable Retention", "description": "Perform disable operation on retention in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.retention.disable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.retention.disable", "type": "safe_execute", "description": "Safely verify audit.retention.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.retention.disable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.retention.disable" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2840", "external_name": "Audit Retention Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.retention.enable", "stable_id": "OSCO-CAP-0851", "name": "Enable Retention", "description": "Perform enable operation on retention in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.retention.enable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.retention.enable", "type": "safe_execute", "description": "Safely verify audit.retention.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.retention.enable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.retention.enable" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2839", "external_name": "Audit Retention Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.retention.export", "stable_id": "OSCO-CAP-0854", "name": "Export Retention", "description": "Perform export operation on retention in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.retention.export" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.retention.export", "type": "safe_execute", "description": "Safely verify audit.retention.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.retention.export", "type": "declared", "state": "declared", "description": "Discover declared support for audit.retention.export" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2842", "external_name": "Audit Retention Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.retention.query", "stable_id": "OSCO-CAP-0853", "name": "Query Retention", "description": "Perform query operation on retention in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.retention.query" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.retention.query", "type": "safe_execute", "description": "Safely verify audit.retention.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.retention.query", "type": "declared", "state": "declared", "description": "Discover declared support for audit.retention.query" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2841", "external_name": "Audit Retention Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.retention.verify", "stable_id": "OSCO-CAP-0855", "name": "Verify Retention", "description": "Perform verify operation on retention in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.retention.verify" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.retention.verify", "type": "safe_execute", "description": "Safely verify audit.retention.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.retention.verify", "type": "declared", "state": "declared", "description": "Discover declared support for audit.retention.verify" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2843", "external_name": "Audit Retention Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.trail.disable", "stable_id": "OSCO-CAP-0842", "name": "Disable Trail", "description": "Perform disable operation on trail in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.trail.disable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "trail state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.trail.disable", "type": "safe_execute", "description": "Safely verify audit.trail.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.trail.disable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.trail.disable" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2830", "external_name": "Audit Trail Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.trail.enable", "stable_id": "OSCO-CAP-0841", "name": "Enable Trail", "description": "Perform enable operation on trail in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.trail.enable" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "trail state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.trail.enable", "type": "safe_execute", "description": "Safely verify audit.trail.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.trail.enable", "type": "declared", "state": "declared", "description": "Discover declared support for audit.trail.enable" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2829", "external_name": "Audit Trail Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.trail.export", "stable_id": "OSCO-CAP-0844", "name": "Export Trail", "description": "Perform export operation on trail in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.trail.export" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "trail state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.trail.export", "type": "safe_execute", "description": "Safely verify audit.trail.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.trail.export", "type": "declared", "state": "declared", "description": "Discover declared support for audit.trail.export" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2832", "external_name": "Audit Trail Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.trail.query", "stable_id": "OSCO-CAP-0843", "name": "Query Trail", "description": "Perform query operation on trail in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.trail.query" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "trail state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.trail.query", "type": "safe_execute", "description": "Safely verify audit.trail.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.trail.query", "type": "declared", "state": "declared", "description": "Discover declared support for audit.trail.query" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2831", "external_name": "Audit Trail Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "audit.trail.verify", "stable_id": "OSCO-CAP-0845", "name": "Verify Trail", "description": "Perform verify operation on trail in the audit domain.", "category": "telemetry", "domain": "audit", "platforms": [ "cloud", "saas", "windows", "linux", "macos" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.linux", "provider.macos", "provider.microsoft365", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "audit.trail.verify" ], "preconditions": [ "provider exposes audit capability surface" ], "postconditions": [ "trail state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.audit.trail.verify", "type": "safe_execute", "description": "Safely verify audit.trail.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.audit.trail.verify", "type": "declared", "state": "declared", "description": "Discover declared support for audit.trail.verify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2833", "external_name": "Audit Trail Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.challenge.enforce", "stable_id": "OSCO-CAP-0352", "name": "Enforce Challenge", "description": "Perform enforce operation on challenge in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.challenge.enforce" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "challenge state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.challenge.enforce", "type": "safe_execute", "description": "Safely verify authentication.challenge.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.challenge.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.challenge.enforce" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2340", "external_name": "Authentication Challenge Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.challenge.refresh", "stable_id": "OSCO-CAP-0350", "name": "Refresh Challenge", "description": "Perform refresh operation on challenge in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.challenge.refresh" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "challenge state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.challenge.refresh", "type": "safe_execute", "description": "Safely verify authentication.challenge.refresh with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.challenge.refresh", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.challenge.refresh" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2338", "external_name": "Authentication Challenge Refresh", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.challenge.request", "stable_id": "OSCO-CAP-0348", "name": "Request Challenge", "description": "Perform request operation on challenge in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.challenge.request" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "challenge state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.challenge.request", "type": "safe_execute", "description": "Safely verify authentication.challenge.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.challenge.request", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.challenge.request" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2336", "external_name": "Authentication Challenge Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.challenge.revoke", "stable_id": "OSCO-CAP-0351", "name": "Revoke Challenge", "description": "Perform revoke operation on challenge in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.challenge.revoke" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "challenge state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.challenge.revoke", "type": "safe_execute", "description": "Safely verify authentication.challenge.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.challenge.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.challenge.revoke" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2339", "external_name": "Authentication Challenge Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.challenge.validate", "stable_id": "OSCO-CAP-0349", "name": "Validate Challenge", "description": "Perform validate operation on challenge in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.challenge.validate" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "challenge state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.challenge.validate", "type": "safe_execute", "description": "Safely verify authentication.challenge.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.challenge.validate", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.challenge.validate" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2337", "external_name": "Authentication Challenge Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.factor.enforce", "stable_id": "OSCO-CAP-0357", "name": "Enforce Factor", "description": "Perform enforce operation on factor in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.factor.enforce" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "factor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.factor.enforce", "type": "safe_execute", "description": "Safely verify authentication.factor.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.factor.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.factor.enforce" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2345", "external_name": "Authentication Factor Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.factor.refresh", "stable_id": "OSCO-CAP-0355", "name": "Refresh Factor", "description": "Perform refresh operation on factor in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.factor.refresh" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "factor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.factor.refresh", "type": "safe_execute", "description": "Safely verify authentication.factor.refresh with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.factor.refresh", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.factor.refresh" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2343", "external_name": "Authentication Factor Refresh", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.factor.request", "stable_id": "OSCO-CAP-0353", "name": "Request Factor", "description": "Perform request operation on factor in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.factor.request" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "factor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.factor.request", "type": "safe_execute", "description": "Safely verify authentication.factor.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.factor.request", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.factor.request" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2341", "external_name": "Authentication Factor Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.factor.revoke", "stable_id": "OSCO-CAP-0356", "name": "Revoke Factor", "description": "Perform revoke operation on factor in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.factor.revoke" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "factor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.factor.revoke", "type": "safe_execute", "description": "Safely verify authentication.factor.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.factor.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.factor.revoke" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2344", "external_name": "Authentication Factor Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.factor.validate", "stable_id": "OSCO-CAP-0354", "name": "Validate Factor", "description": "Perform validate operation on factor in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.factor.validate" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "factor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.factor.validate", "type": "safe_execute", "description": "Safely verify authentication.factor.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.factor.validate", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.factor.validate" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2342", "external_name": "Authentication Factor Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.session.enforce", "stable_id": "OSCO-CAP-0347", "name": "Enforce Session", "description": "Perform enforce operation on session in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.session.enforce" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.session.enforce", "type": "safe_execute", "description": "Safely verify authentication.session.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.session.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.session.enforce" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2335", "external_name": "Authentication Session Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.session.refresh", "stable_id": "OSCO-CAP-0345", "name": "Refresh Session", "description": "Perform refresh operation on session in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.session.refresh" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.session.refresh", "type": "safe_execute", "description": "Safely verify authentication.session.refresh with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.session.refresh", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.session.refresh" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2333", "external_name": "Authentication Session Refresh", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.session.request", "stable_id": "OSCO-CAP-0343", "name": "Request Session", "description": "Perform request operation on session in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.session.request" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.session.request", "type": "safe_execute", "description": "Safely verify authentication.session.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.session.request", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.session.request" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2331", "external_name": "Authentication Session Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.session.revoke", "stable_id": "OSCO-CAP-0346", "name": "Revoke Session", "description": "Perform revoke operation on session in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.session.revoke" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.session.revoke", "type": "safe_execute", "description": "Safely verify authentication.session.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.session.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.session.revoke" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2334", "external_name": "Authentication Session Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.session.validate", "stable_id": "OSCO-CAP-0344", "name": "Validate Session", "description": "Perform validate operation on session in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.session.validate" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.session.validate", "type": "safe_execute", "description": "Safely verify authentication.session.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.session.validate", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.session.validate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2332", "external_name": "Authentication Session Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.token.enforce", "stable_id": "OSCO-CAP-0362", "name": "Enforce Token", "description": "Perform enforce operation on token in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.token.enforce" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.token.enforce", "type": "safe_execute", "description": "Safely verify authentication.token.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.token.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.token.enforce" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2350", "external_name": "Authentication Token Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.token.refresh", "stable_id": "OSCO-CAP-0360", "name": "Refresh Token", "description": "Perform refresh operation on token in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.token.refresh" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.token.refresh", "type": "safe_execute", "description": "Safely verify authentication.token.refresh with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.token.refresh", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.token.refresh" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2348", "external_name": "Authentication Token Refresh", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.token.request", "stable_id": "OSCO-CAP-0358", "name": "Request Token", "description": "Perform request operation on token in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.token.request" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.token.request", "type": "safe_execute", "description": "Safely verify authentication.token.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.token.request", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.token.request" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2346", "external_name": "Authentication Token Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.token.revoke", "stable_id": "OSCO-CAP-0361", "name": "Revoke Token", "description": "Perform revoke operation on token in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.token.revoke" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.token.revoke", "type": "safe_execute", "description": "Safely verify authentication.token.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.token.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.token.revoke" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2349", "external_name": "Authentication Token Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authentication.token.validate", "stable_id": "OSCO-CAP-0359", "name": "Validate Token", "description": "Perform validate operation on token in the authentication domain.", "category": "identity", "domain": "authentication", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authentication.token.validate" ], "preconditions": [ "provider exposes authentication capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authentication.token.validate", "type": "safe_execute", "description": "Safely verify authentication.token.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authentication.token.validate", "type": "declared", "state": "declared", "description": "Discover declared support for authentication.token.validate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2347", "external_name": "Authentication Token Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.binding.attach", "stable_id": "OSCO-CAP-0380", "name": "Attach Binding", "description": "Perform attach operation on binding in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.binding.attach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.binding.attach", "type": "safe_execute", "description": "Safely verify authorization.binding.attach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.binding.attach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.binding.attach" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2368", "external_name": "Authorization Binding Attach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.binding.detach", "stable_id": "OSCO-CAP-0381", "name": "Detach Binding", "description": "Perform detach operation on binding in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.binding.detach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.binding.detach", "type": "safe_execute", "description": "Safely verify authorization.binding.detach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.binding.detach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.binding.detach" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2369", "external_name": "Authorization Binding Detach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.binding.evaluate", "stable_id": "OSCO-CAP-0382", "name": "Evaluate Binding", "description": "Perform evaluate operation on binding in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.binding.evaluate" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.binding.evaluate", "type": "safe_execute", "description": "Safely verify authorization.binding.evaluate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.binding.evaluate", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.binding.evaluate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2370", "external_name": "Authorization Binding Evaluate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.binding.grant", "stable_id": "OSCO-CAP-0378", "name": "Grant Binding", "description": "Perform grant operation on binding in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.binding.grant" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.binding.grant", "type": "safe_execute", "description": "Safely verify authorization.binding.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.binding.grant", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.binding.grant" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2366", "external_name": "Authorization Binding Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.binding.revoke", "stable_id": "OSCO-CAP-0379", "name": "Revoke Binding", "description": "Perform revoke operation on binding in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.binding.revoke" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.binding.revoke", "type": "safe_execute", "description": "Safely verify authorization.binding.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.binding.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.binding.revoke" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2367", "external_name": "Authorization Binding Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.permission.attach", "stable_id": "OSCO-CAP-0375", "name": "Attach Permission", "description": "Perform attach operation on permission in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.permission.attach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.permission.attach", "type": "safe_execute", "description": "Safely verify authorization.permission.attach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.permission.attach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.permission.attach" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2363", "external_name": "Authorization Permission Attach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.permission.detach", "stable_id": "OSCO-CAP-0376", "name": "Detach Permission", "description": "Perform detach operation on permission in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.permission.detach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.permission.detach", "type": "safe_execute", "description": "Safely verify authorization.permission.detach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.permission.detach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.permission.detach" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2364", "external_name": "Authorization Permission Detach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.permission.evaluate", "stable_id": "OSCO-CAP-0377", "name": "Evaluate Permission", "description": "Perform evaluate operation on permission in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.permission.evaluate" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.permission.evaluate", "type": "safe_execute", "description": "Safely verify authorization.permission.evaluate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.permission.evaluate", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.permission.evaluate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2365", "external_name": "Authorization Permission Evaluate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.permission.grant", "stable_id": "OSCO-CAP-0373", "name": "Grant Permission", "description": "Perform grant operation on permission in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.permission.grant" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.permission.grant", "type": "safe_execute", "description": "Safely verify authorization.permission.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.permission.grant", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.permission.grant" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2361", "external_name": "Authorization Permission Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.permission.revoke", "stable_id": "OSCO-CAP-0374", "name": "Revoke Permission", "description": "Perform revoke operation on permission in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.permission.revoke" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.permission.revoke", "type": "safe_execute", "description": "Safely verify authorization.permission.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.permission.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.permission.revoke" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2362", "external_name": "Authorization Permission Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.policy.attach", "stable_id": "OSCO-CAP-0370", "name": "Attach Policy", "description": "Perform attach operation on policy in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.policy.attach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.policy.attach", "type": "safe_execute", "description": "Safely verify authorization.policy.attach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.policy.attach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.policy.attach" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2358", "external_name": "Authorization Policy Attach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.policy.detach", "stable_id": "OSCO-CAP-0371", "name": "Detach Policy", "description": "Perform detach operation on policy in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.policy.detach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.policy.detach", "type": "safe_execute", "description": "Safely verify authorization.policy.detach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.policy.detach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.policy.detach" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2359", "external_name": "Authorization Policy Detach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.policy.evaluate", "stable_id": "OSCO-CAP-0372", "name": "Evaluate Policy", "description": "Perform evaluate operation on policy in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.policy.evaluate" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.policy.evaluate", "type": "safe_execute", "description": "Safely verify authorization.policy.evaluate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.policy.evaluate", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.policy.evaluate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2360", "external_name": "Authorization Policy Evaluate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.policy.grant", "stable_id": "OSCO-CAP-0368", "name": "Grant Policy", "description": "Perform grant operation on policy in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.policy.grant" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.policy.grant", "type": "safe_execute", "description": "Safely verify authorization.policy.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.policy.grant", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.policy.grant" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2356", "external_name": "Authorization Policy Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.policy.revoke", "stable_id": "OSCO-CAP-0369", "name": "Revoke Policy", "description": "Perform revoke operation on policy in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.policy.revoke" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.policy.revoke", "type": "safe_execute", "description": "Safely verify authorization.policy.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.policy.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.policy.revoke" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2357", "external_name": "Authorization Policy Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.role.attach", "stable_id": "OSCO-CAP-0365", "name": "Attach Role", "description": "Perform attach operation on role in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.role.attach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.role.attach", "type": "safe_execute", "description": "Safely verify authorization.role.attach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.role.attach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.role.attach" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2353", "external_name": "Authorization Role Attach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.role.detach", "stable_id": "OSCO-CAP-0366", "name": "Detach Role", "description": "Perform detach operation on role in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.role.detach" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.role.detach", "type": "safe_execute", "description": "Safely verify authorization.role.detach with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.role.detach", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.role.detach" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2354", "external_name": "Authorization Role Detach", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.role.evaluate", "stable_id": "OSCO-CAP-0367", "name": "Evaluate Role", "description": "Perform evaluate operation on role in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.role.evaluate" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.role.evaluate", "type": "safe_execute", "description": "Safely verify authorization.role.evaluate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.role.evaluate", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.role.evaluate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2355", "external_name": "Authorization Role Evaluate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.role.grant", "stable_id": "OSCO-CAP-0363", "name": "Grant Role", "description": "Perform grant operation on role in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.role.grant" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.role.grant", "type": "safe_execute", "description": "Safely verify authorization.role.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.role.grant", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.role.grant" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2351", "external_name": "Authorization Role Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "authorization.role.revoke", "stable_id": "OSCO-CAP-0364", "name": "Revoke Role", "description": "Perform revoke operation on role in the authorization domain.", "category": "identity", "domain": "authorization", "platforms": [ "identity", "cloud", "saas", "database" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.okta", "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "authorization.role.revoke" ], "preconditions": [ "provider exposes authorization capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.authorization.role.revoke", "type": "safe_execute", "description": "Safely verify authorization.role.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.authorization.role.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for authorization.role.revoke" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2352", "external_name": "Authorization Role Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.orchestration.monitor", "stable_id": "OSCO-CAP-0994", "name": "Monitor Orchestration", "description": "Perform monitor operation on orchestration in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.orchestration.monitor" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "orchestration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.orchestration.monitor", "type": "safe_execute", "description": "Safely verify automation.orchestration.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.orchestration.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for automation.orchestration.monitor" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2982", "external_name": "Automation Orchestration Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.orchestration.orchestrate", "stable_id": "OSCO-CAP-0991", "name": "Orchestrate Orchestration", "description": "Perform orchestrate operation on orchestration in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.orchestration.orchestrate" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "orchestration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.orchestration.orchestrate", "type": "safe_execute", "description": "Safely verify automation.orchestration.orchestrate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.orchestration.orchestrate", "type": "declared", "state": "declared", "description": "Discover declared support for automation.orchestration.orchestrate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2979", "external_name": "Automation Orchestration Orchestrate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.orchestration.rollback", "stable_id": "OSCO-CAP-0995", "name": "Rollback Orchestration", "description": "Perform rollback operation on orchestration in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.orchestration.rollback" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "orchestration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.orchestration.rollback", "type": "safe_execute", "description": "Safely verify automation.orchestration.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.orchestration.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for automation.orchestration.rollback" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2983", "external_name": "Automation Orchestration Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.orchestration.schedule", "stable_id": "OSCO-CAP-0993", "name": "Schedule Orchestration", "description": "Perform schedule operation on orchestration in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.orchestration.schedule" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "orchestration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.orchestration.schedule", "type": "safe_execute", "description": "Safely verify automation.orchestration.schedule with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.orchestration.schedule", "type": "declared", "state": "declared", "description": "Discover declared support for automation.orchestration.schedule" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2981", "external_name": "Automation Orchestration Schedule", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.orchestration.trigger", "stable_id": "OSCO-CAP-0992", "name": "Trigger Orchestration", "description": "Perform trigger operation on orchestration in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.orchestration.trigger" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "orchestration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.orchestration.trigger", "type": "safe_execute", "description": "Safely verify automation.orchestration.trigger with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.orchestration.trigger", "type": "declared", "state": "declared", "description": "Discover declared support for automation.orchestration.trigger" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2980", "external_name": "Automation Orchestration Trigger", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.playbook.monitor", "stable_id": "OSCO-CAP-0984", "name": "Monitor Playbook", "description": "Perform monitor operation on playbook in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.playbook.monitor" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "playbook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.playbook.monitor", "type": "safe_execute", "description": "Safely verify automation.playbook.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.playbook.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for automation.playbook.monitor" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2972", "external_name": "Automation Playbook Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.playbook.orchestrate", "stable_id": "OSCO-CAP-0981", "name": "Orchestrate Playbook", "description": "Perform orchestrate operation on playbook in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.playbook.orchestrate" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "playbook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.playbook.orchestrate", "type": "safe_execute", "description": "Safely verify automation.playbook.orchestrate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.playbook.orchestrate", "type": "declared", "state": "declared", "description": "Discover declared support for automation.playbook.orchestrate" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2969", "external_name": "Automation Playbook Orchestrate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.playbook.rollback", "stable_id": "OSCO-CAP-0985", "name": "Rollback Playbook", "description": "Perform rollback operation on playbook in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.playbook.rollback" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "playbook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.playbook.rollback", "type": "safe_execute", "description": "Safely verify automation.playbook.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.playbook.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for automation.playbook.rollback" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2973", "external_name": "Automation Playbook Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.playbook.schedule", "stable_id": "OSCO-CAP-0983", "name": "Schedule Playbook", "description": "Perform schedule operation on playbook in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.playbook.schedule" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "playbook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.playbook.schedule", "type": "safe_execute", "description": "Safely verify automation.playbook.schedule with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.playbook.schedule", "type": "declared", "state": "declared", "description": "Discover declared support for automation.playbook.schedule" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2971", "external_name": "Automation Playbook Schedule", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.playbook.trigger", "stable_id": "OSCO-CAP-0982", "name": "Trigger Playbook", "description": "Perform trigger operation on playbook in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.playbook.trigger" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "playbook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.playbook.trigger", "type": "safe_execute", "description": "Safely verify automation.playbook.trigger with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.playbook.trigger", "type": "declared", "state": "declared", "description": "Discover declared support for automation.playbook.trigger" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2970", "external_name": "Automation Playbook Trigger", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.task.monitor", "stable_id": "OSCO-CAP-0989", "name": "Monitor Task", "description": "Perform monitor operation on task in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.task.monitor" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.task.monitor", "type": "safe_execute", "description": "Safely verify automation.task.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.task.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for automation.task.monitor" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2977", "external_name": "Automation Task Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.task.orchestrate", "stable_id": "OSCO-CAP-0986", "name": "Orchestrate Task", "description": "Perform orchestrate operation on task in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.task.orchestrate" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.task.orchestrate", "type": "safe_execute", "description": "Safely verify automation.task.orchestrate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.task.orchestrate", "type": "declared", "state": "declared", "description": "Discover declared support for automation.task.orchestrate" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2974", "external_name": "Automation Task Orchestrate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.task.rollback", "stable_id": "OSCO-CAP-0990", "name": "Rollback Task", "description": "Perform rollback operation on task in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.task.rollback" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.task.rollback", "type": "safe_execute", "description": "Safely verify automation.task.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.task.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for automation.task.rollback" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2978", "external_name": "Automation Task Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.task.schedule", "stable_id": "OSCO-CAP-0988", "name": "Schedule Task", "description": "Perform schedule operation on task in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.task.schedule" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.task.schedule", "type": "safe_execute", "description": "Safely verify automation.task.schedule with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.task.schedule", "type": "declared", "state": "declared", "description": "Discover declared support for automation.task.schedule" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2976", "external_name": "Automation Task Schedule", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.task.trigger", "stable_id": "OSCO-CAP-0987", "name": "Trigger Task", "description": "Perform trigger operation on task in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.task.trigger" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.task.trigger", "type": "safe_execute", "description": "Safely verify automation.task.trigger with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.task.trigger", "type": "declared", "state": "declared", "description": "Discover declared support for automation.task.trigger" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2975", "external_name": "Automation Task Trigger", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.workflow.monitor", "stable_id": "OSCO-CAP-0979", "name": "Monitor Workflow", "description": "Perform monitor operation on workflow in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.workflow.monitor" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "workflow state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.workflow.monitor", "type": "safe_execute", "description": "Safely verify automation.workflow.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.workflow.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for automation.workflow.monitor" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2967", "external_name": "Automation Workflow Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.workflow.orchestrate", "stable_id": "OSCO-CAP-0976", "name": "Orchestrate Workflow", "description": "Perform orchestrate operation on workflow in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.workflow.orchestrate" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "workflow state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.workflow.orchestrate", "type": "safe_execute", "description": "Safely verify automation.workflow.orchestrate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.workflow.orchestrate", "type": "declared", "state": "declared", "description": "Discover declared support for automation.workflow.orchestrate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2964", "external_name": "Automation Workflow Orchestrate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.workflow.rollback", "stable_id": "OSCO-CAP-0980", "name": "Rollback Workflow", "description": "Perform rollback operation on workflow in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.workflow.rollback" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "workflow state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.workflow.rollback", "type": "safe_execute", "description": "Safely verify automation.workflow.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.workflow.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for automation.workflow.rollback" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2968", "external_name": "Automation Workflow Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.workflow.schedule", "stable_id": "OSCO-CAP-0978", "name": "Schedule Workflow", "description": "Perform schedule operation on workflow in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.workflow.schedule" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "workflow state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.workflow.schedule", "type": "safe_execute", "description": "Safely verify automation.workflow.schedule with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.workflow.schedule", "type": "declared", "state": "declared", "description": "Discover declared support for automation.workflow.schedule" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2966", "external_name": "Automation Workflow Schedule", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "automation.workflow.trigger", "stable_id": "OSCO-CAP-0977", "name": "Trigger Workflow", "description": "Perform trigger operation on workflow in the automation domain.", "category": "automation", "domain": "automation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "automation.workflow.trigger" ], "preconditions": [ "provider exposes automation capability surface" ], "postconditions": [ "workflow state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.automation.workflow.trigger", "type": "safe_execute", "description": "Safely verify automation.workflow.trigger with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.automation.workflow.trigger", "type": "declared", "state": "declared", "description": "Discover declared support for automation.workflow.trigger" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2965", "external_name": "Automation Workflow Trigger", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.cookie.delete", "stable_id": "OSCO-CAP-0220", "name": "Delete Cookie", "description": "Perform delete operation on cookie in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.cookie.delete" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "cookie state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.cookie.delete", "type": "safe_execute", "description": "Safely verify browser.cookie.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.cookie.delete", "type": "declared", "state": "declared", "description": "Discover declared support for browser.cookie.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2208", "external_name": "Browser Cookie Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.cookie.export", "stable_id": "OSCO-CAP-0221", "name": "Export Cookie", "description": "Perform export operation on cookie in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.cookie.export" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "cookie state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.cookie.export", "type": "safe_execute", "description": "Safely verify browser.cookie.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.cookie.export", "type": "declared", "state": "declared", "description": "Discover declared support for browser.cookie.export" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2209", "external_name": "Browser Cookie Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.cookie.import", "stable_id": "OSCO-CAP-0222", "name": "Import Cookie", "description": "Perform import operation on cookie in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.cookie.import" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "cookie state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.cookie.import", "type": "safe_execute", "description": "Safely verify browser.cookie.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.cookie.import", "type": "declared", "state": "declared", "description": "Discover declared support for browser.cookie.import" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2210", "external_name": "Browser Cookie Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.cookie.read", "stable_id": "OSCO-CAP-0008", "name": "Read Browser Cookie Store", "description": "Read browser cookie records from storage.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "status": "stable", "confidence": 0.86, "safety": "caution", "mappings": [ { "framework": "mitre_attack", "external_id": "T1539", "external_name": "Steal Web Session Cookie", "confidence": 0.9 } ] }, { "capability_id": "browser.cookie.write", "stable_id": "OSCO-CAP-0219", "name": "Write Cookie", "description": "Perform write operation on cookie in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.cookie.write" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "cookie state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.cookie.write", "type": "safe_execute", "description": "Safely verify browser.cookie.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.cookie.write", "type": "declared", "state": "declared", "description": "Discover declared support for browser.cookie.write" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2207", "external_name": "Browser Cookie Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.extension.delete", "stable_id": "OSCO-CAP-0235", "name": "Delete Extension", "description": "Perform delete operation on extension in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.extension.delete" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.extension.delete", "type": "safe_execute", "description": "Safely verify browser.extension.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.extension.delete", "type": "declared", "state": "declared", "description": "Discover declared support for browser.extension.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2223", "external_name": "Browser Extension Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.extension.export", "stable_id": "OSCO-CAP-0236", "name": "Export Extension", "description": "Perform export operation on extension in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.extension.export" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.extension.export", "type": "safe_execute", "description": "Safely verify browser.extension.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.extension.export", "type": "declared", "state": "declared", "description": "Discover declared support for browser.extension.export" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2224", "external_name": "Browser Extension Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.extension.import", "stable_id": "OSCO-CAP-0237", "name": "Import Extension", "description": "Perform import operation on extension in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.extension.import" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.extension.import", "type": "safe_execute", "description": "Safely verify browser.extension.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.extension.import", "type": "declared", "state": "declared", "description": "Discover declared support for browser.extension.import" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2225", "external_name": "Browser Extension Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.extension.read", "stable_id": "OSCO-CAP-0233", "name": "Read Extension", "description": "Perform read operation on extension in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.extension.read" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.extension.read", "type": "safe_execute", "description": "Safely verify browser.extension.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.extension.read", "type": "declared", "state": "declared", "description": "Discover declared support for browser.extension.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2221", "external_name": "Browser Extension Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.extension.write", "stable_id": "OSCO-CAP-0234", "name": "Write Extension", "description": "Perform write operation on extension in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.extension.write" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.extension.write", "type": "safe_execute", "description": "Safely verify browser.extension.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.extension.write", "type": "declared", "state": "declared", "description": "Discover declared support for browser.extension.write" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2222", "external_name": "Browser Extension Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.history.delete", "stable_id": "OSCO-CAP-0230", "name": "Delete History", "description": "Perform delete operation on history in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.history.delete" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "history state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.history.delete", "type": "safe_execute", "description": "Safely verify browser.history.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.history.delete", "type": "declared", "state": "declared", "description": "Discover declared support for browser.history.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2218", "external_name": "Browser History Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.history.export", "stable_id": "OSCO-CAP-0231", "name": "Export History", "description": "Perform export operation on history in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.history.export" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "history state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.history.export", "type": "safe_execute", "description": "Safely verify browser.history.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.history.export", "type": "declared", "state": "declared", "description": "Discover declared support for browser.history.export" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2219", "external_name": "Browser History Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.history.import", "stable_id": "OSCO-CAP-0232", "name": "Import History", "description": "Perform import operation on history in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.history.import" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "history state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.history.import", "type": "safe_execute", "description": "Safely verify browser.history.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.history.import", "type": "declared", "state": "declared", "description": "Discover declared support for browser.history.import" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2220", "external_name": "Browser History Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.history.read", "stable_id": "OSCO-CAP-0228", "name": "Read History", "description": "Perform read operation on history in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.history.read" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "history state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.history.read", "type": "safe_execute", "description": "Safely verify browser.history.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.history.read", "type": "declared", "state": "declared", "description": "Discover declared support for browser.history.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2216", "external_name": "Browser History Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.history.write", "stable_id": "OSCO-CAP-0229", "name": "Write History", "description": "Perform write operation on history in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.history.write" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "history state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.history.write", "type": "safe_execute", "description": "Safely verify browser.history.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.history.write", "type": "declared", "state": "declared", "description": "Discover declared support for browser.history.write" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2217", "external_name": "Browser History Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.session.delete", "stable_id": "OSCO-CAP-0225", "name": "Delete Session", "description": "Perform delete operation on session in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.session.delete" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.session.delete", "type": "safe_execute", "description": "Safely verify browser.session.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.session.delete", "type": "declared", "state": "declared", "description": "Discover declared support for browser.session.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2213", "external_name": "Browser Session Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.session.export", "stable_id": "OSCO-CAP-0226", "name": "Export Session", "description": "Perform export operation on session in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.session.export" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.session.export", "type": "safe_execute", "description": "Safely verify browser.session.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.session.export", "type": "declared", "state": "declared", "description": "Discover declared support for browser.session.export" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2214", "external_name": "Browser Session Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.session.import", "stable_id": "OSCO-CAP-0227", "name": "Import Session", "description": "Perform import operation on session in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.session.import" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.session.import", "type": "safe_execute", "description": "Safely verify browser.session.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.session.import", "type": "declared", "state": "declared", "description": "Discover declared support for browser.session.import" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2215", "external_name": "Browser Session Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.session.read", "stable_id": "OSCO-CAP-0223", "name": "Read Session", "description": "Perform read operation on session in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.session.read" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.session.read", "type": "safe_execute", "description": "Safely verify browser.session.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.session.read", "type": "declared", "state": "declared", "description": "Discover declared support for browser.session.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2211", "external_name": "Browser Session Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.session.write", "stable_id": "OSCO-CAP-0224", "name": "Write Session", "description": "Perform write operation on session in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.session.write" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.session.write", "type": "safe_execute", "description": "Safely verify browser.session.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.session.write", "type": "declared", "state": "declared", "description": "Discover declared support for browser.session.write" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2212", "external_name": "Browser Session Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.storage.delete", "stable_id": "OSCO-CAP-0240", "name": "Delete Storage", "description": "Perform delete operation on storage in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.storage.delete" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "storage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.storage.delete", "type": "safe_execute", "description": "Safely verify browser.storage.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.storage.delete", "type": "declared", "state": "declared", "description": "Discover declared support for browser.storage.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2228", "external_name": "Browser Storage Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.storage.export", "stable_id": "OSCO-CAP-0241", "name": "Export Storage", "description": "Perform export operation on storage in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.storage.export" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "storage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.storage.export", "type": "safe_execute", "description": "Safely verify browser.storage.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.storage.export", "type": "declared", "state": "declared", "description": "Discover declared support for browser.storage.export" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2229", "external_name": "Browser Storage Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.storage.import", "stable_id": "OSCO-CAP-0242", "name": "Import Storage", "description": "Perform import operation on storage in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.storage.import" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "storage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.storage.import", "type": "safe_execute", "description": "Safely verify browser.storage.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.storage.import", "type": "declared", "state": "declared", "description": "Discover declared support for browser.storage.import" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2230", "external_name": "Browser Storage Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.storage.read", "stable_id": "OSCO-CAP-0238", "name": "Read Storage", "description": "Perform read operation on storage in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.storage.read" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "storage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.storage.read", "type": "safe_execute", "description": "Safely verify browser.storage.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.storage.read", "type": "declared", "state": "declared", "description": "Discover declared support for browser.storage.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2226", "external_name": "Browser Storage Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "browser.storage.write", "stable_id": "OSCO-CAP-0239", "name": "Write Storage", "description": "Perform write operation on storage in the browser domain.", "category": "browser", "domain": "browser", "platforms": [ "browser", "windows", "linux", "macos" ], "providers": [ "provider.chrome", "provider.firefox" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "browser.storage.write" ], "preconditions": [ "provider exposes browser capability surface" ], "postconditions": [ "storage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.browser.storage.write", "type": "safe_execute", "description": "Safely verify browser.storage.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.browser.storage.write", "type": "declared", "state": "declared", "description": "Discover declared support for browser.storage.write" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2227", "external_name": "Browser Storage Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.certificate.create", "stable_id": "OSCO-CAP-0243", "name": "Create Certificate", "description": "Perform create operation on certificate in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.certificate.create" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "certificate state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.certificate.create", "type": "safe_execute", "description": "Safely verify certificate.certificate.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.certificate.create", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.certificate.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2231", "external_name": "Certificate Certificate Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.certificate.delete", "stable_id": "OSCO-CAP-0247", "name": "Delete Certificate", "description": "Perform delete operation on certificate in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.certificate.delete" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "certificate state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.certificate.delete", "type": "safe_execute", "description": "Safely verify certificate.certificate.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.certificate.delete", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.certificate.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2235", "external_name": "Certificate Certificate Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.certificate.import", "stable_id": "OSCO-CAP-0245", "name": "Import Certificate", "description": "Perform import operation on certificate in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.certificate.import" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "certificate state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.certificate.import", "type": "safe_execute", "description": "Safely verify certificate.certificate.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.certificate.import", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.certificate.import" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2233", "external_name": "Certificate Certificate Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.certificate.read", "stable_id": "OSCO-CAP-0244", "name": "Read Certificate", "description": "Perform read operation on certificate in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.certificate.read" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "certificate state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.certificate.read", "type": "safe_execute", "description": "Safely verify certificate.certificate.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.certificate.read", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.certificate.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2232", "external_name": "Certificate Certificate Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.certificate.revoke", "stable_id": "OSCO-CAP-0246", "name": "Revoke Certificate", "description": "Perform revoke operation on certificate in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.certificate.revoke" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "certificate state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.certificate.revoke", "type": "safe_execute", "description": "Safely verify certificate.certificate.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.certificate.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.certificate.revoke" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2234", "external_name": "Certificate Certificate Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.private_key.create", "stable_id": "OSCO-CAP-0253", "name": "Create Private Key", "description": "Perform create operation on private key in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.private_key.create" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "private key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.private_key.create", "type": "safe_execute", "description": "Safely verify certificate.private_key.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.private_key.create", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.private_key.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2241", "external_name": "Certificate Private Key Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.private_key.delete", "stable_id": "OSCO-CAP-0257", "name": "Delete Private Key", "description": "Perform delete operation on private key in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.private_key.delete" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "private key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.private_key.delete", "type": "safe_execute", "description": "Safely verify certificate.private_key.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.private_key.delete", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.private_key.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2245", "external_name": "Certificate Private Key Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.private_key.import", "stable_id": "OSCO-CAP-0255", "name": "Import Private Key", "description": "Perform import operation on private key in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.private_key.import" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "private key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.private_key.import", "type": "safe_execute", "description": "Safely verify certificate.private_key.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.private_key.import", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.private_key.import" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2243", "external_name": "Certificate Private Key Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.private_key.read", "stable_id": "OSCO-CAP-0254", "name": "Read Private Key", "description": "Perform read operation on private key in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.private_key.read" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "private key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.private_key.read", "type": "safe_execute", "description": "Safely verify certificate.private_key.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.private_key.read", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.private_key.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2242", "external_name": "Certificate Private Key Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.private_key.revoke", "stable_id": "OSCO-CAP-0256", "name": "Revoke Private Key", "description": "Perform revoke operation on private key in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.private_key.revoke" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "private key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.private_key.revoke", "type": "safe_execute", "description": "Safely verify certificate.private_key.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.private_key.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.private_key.revoke" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2244", "external_name": "Certificate Private Key Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.store.create", "stable_id": "OSCO-CAP-0248", "name": "Create Store", "description": "Perform create operation on store in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.store.create" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "store state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.store.create", "type": "safe_execute", "description": "Safely verify certificate.store.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.store.create", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.store.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2236", "external_name": "Certificate Store Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.store.delete", "stable_id": "OSCO-CAP-0252", "name": "Delete Store", "description": "Perform delete operation on store in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.store.delete" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "store state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.store.delete", "type": "safe_execute", "description": "Safely verify certificate.store.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.store.delete", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.store.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2240", "external_name": "Certificate Store Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.store.import", "stable_id": "OSCO-CAP-0250", "name": "Import Store", "description": "Perform import operation on store in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.store.import" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "store state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.store.import", "type": "safe_execute", "description": "Safely verify certificate.store.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.store.import", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.store.import" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2238", "external_name": "Certificate Store Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.store.read", "stable_id": "OSCO-CAP-0249", "name": "Read Store", "description": "Perform read operation on store in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.store.read" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "store state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.store.read", "type": "safe_execute", "description": "Safely verify certificate.store.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.store.read", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.store.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2237", "external_name": "Certificate Store Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.store.revoke", "stable_id": "OSCO-CAP-0251", "name": "Revoke Store", "description": "Perform revoke operation on store in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.store.revoke" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "store state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.store.revoke", "type": "safe_execute", "description": "Safely verify certificate.store.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.store.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.store.revoke" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2239", "external_name": "Certificate Store Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.trust_anchor.create", "stable_id": "OSCO-CAP-0258", "name": "Create Trust Anchor", "description": "Perform create operation on trust anchor in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.trust_anchor.create" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "trust anchor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.trust_anchor.create", "type": "safe_execute", "description": "Safely verify certificate.trust_anchor.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.trust_anchor.create", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.trust_anchor.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2246", "external_name": "Certificate Trust Anchor Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.trust_anchor.delete", "stable_id": "OSCO-CAP-0262", "name": "Delete Trust Anchor", "description": "Perform delete operation on trust anchor in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.trust_anchor.delete" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "trust anchor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.trust_anchor.delete", "type": "safe_execute", "description": "Safely verify certificate.trust_anchor.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.trust_anchor.delete", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.trust_anchor.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2250", "external_name": "Certificate Trust Anchor Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.trust_anchor.import", "stable_id": "OSCO-CAP-0260", "name": "Import Trust Anchor", "description": "Perform import operation on trust anchor in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.trust_anchor.import" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "trust anchor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.trust_anchor.import", "type": "safe_execute", "description": "Safely verify certificate.trust_anchor.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.trust_anchor.import", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.trust_anchor.import" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2248", "external_name": "Certificate Trust Anchor Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.trust_anchor.read", "stable_id": "OSCO-CAP-0259", "name": "Read Trust Anchor", "description": "Perform read operation on trust anchor in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.trust_anchor.read" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "trust anchor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.trust_anchor.read", "type": "safe_execute", "description": "Safely verify certificate.trust_anchor.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.trust_anchor.read", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.trust_anchor.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2247", "external_name": "Certificate Trust Anchor Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "certificate.trust_anchor.revoke", "stable_id": "OSCO-CAP-0261", "name": "Revoke Trust Anchor", "description": "Perform revoke operation on trust anchor in the certificate domain.", "category": "identity", "domain": "certificate", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "certificate.trust_anchor.revoke" ], "preconditions": [ "provider exposes certificate capability surface" ], "postconditions": [ "trust anchor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.certificate.trust_anchor.revoke", "type": "safe_execute", "description": "Safely verify certificate.trust_anchor.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.certificate.trust_anchor.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for certificate.trust_anchor.revoke" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2249", "external_name": "Certificate Trust Anchor Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.bucket.create", "stable_id": "OSCO-CAP-0673", "name": "Create Bucket", "description": "Perform create operation on bucket in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.bucket.create" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "bucket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.bucket.create", "type": "safe_execute", "description": "Safely verify cloud.bucket.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.bucket.create", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.bucket.create" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2661", "external_name": "Cloud Bucket Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.bucket.delete", "stable_id": "OSCO-CAP-0676", "name": "Delete Bucket", "description": "Perform delete operation on bucket in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.bucket.delete" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "bucket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.bucket.delete", "type": "safe_execute", "description": "Safely verify cloud.bucket.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.bucket.delete", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.bucket.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2664", "external_name": "Cloud Bucket Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.bucket.read", "stable_id": "OSCO-CAP-0674", "name": "Read Bucket", "description": "Perform read operation on bucket in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.bucket.read" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "bucket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.bucket.read", "type": "safe_execute", "description": "Safely verify cloud.bucket.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.bucket.read", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.bucket.read" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2662", "external_name": "Cloud Bucket Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.bucket.tag", "stable_id": "OSCO-CAP-0677", "name": "Tag Bucket", "description": "Perform tag operation on bucket in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.bucket.tag" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "bucket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.bucket.tag", "type": "safe_execute", "description": "Safely verify cloud.bucket.tag with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.bucket.tag", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.bucket.tag" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2665", "external_name": "Cloud Bucket Tag", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.bucket.update", "stable_id": "OSCO-CAP-0675", "name": "Update Bucket", "description": "Perform update operation on bucket in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.bucket.update" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "bucket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.bucket.update", "type": "safe_execute", "description": "Safely verify cloud.bucket.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.bucket.update", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.bucket.update" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2663", "external_name": "Cloud Bucket Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.iam.role.create", "stable_id": "OSCO-CAP-0004", "name": "Create IAM Role", "description": "Create a cloud IAM role.", "category": "cloud", "domain": "identity", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "status": "stable", "confidence": 0.93, "safety": "caution", "required_privileges": [ "iam.role.create" ], "produced_telemetry": [ { "telemetry_id": "tm.cloudtrail.createrole", "source": "cloudtrail", "event_type": "CreateRole", "description": "AWS CloudTrail CreateRole event" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "T1098", "external_name": "Account Manipulation", "confidence": 0.82 }, { "framework": "ecs", "external_id": "iam", "external_name": "Identity and Access", "confidence": 0.77 } ] }, { "capability_id": "cloud.instance.create", "stable_id": "OSCO-CAP-0668", "name": "Create Instance", "description": "Perform create operation on instance in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.instance.create" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.instance.create", "type": "safe_execute", "description": "Safely verify cloud.instance.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.instance.create", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.instance.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2656", "external_name": "Cloud Instance Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.instance.delete", "stable_id": "OSCO-CAP-0671", "name": "Delete Instance", "description": "Perform delete operation on instance in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.instance.delete" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.instance.delete", "type": "safe_execute", "description": "Safely verify cloud.instance.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.instance.delete", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.instance.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2659", "external_name": "Cloud Instance Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.instance.read", "stable_id": "OSCO-CAP-0669", "name": "Read Instance", "description": "Perform read operation on instance in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.instance.read" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.instance.read", "type": "safe_execute", "description": "Safely verify cloud.instance.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.instance.read", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.instance.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2657", "external_name": "Cloud Instance Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.instance.tag", "stable_id": "OSCO-CAP-0672", "name": "Tag Instance", "description": "Perform tag operation on instance in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.instance.tag" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.instance.tag", "type": "safe_execute", "description": "Safely verify cloud.instance.tag with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.instance.tag", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.instance.tag" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2660", "external_name": "Cloud Instance Tag", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.instance.update", "stable_id": "OSCO-CAP-0670", "name": "Update Instance", "description": "Perform update operation on instance in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.instance.update" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.instance.update", "type": "safe_execute", "description": "Safely verify cloud.instance.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.instance.update", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.instance.update" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2658", "external_name": "Cloud Instance Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.policy.create", "stable_id": "OSCO-CAP-0678", "name": "Create Policy", "description": "Perform create operation on policy in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.policy.create" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.policy.create", "type": "safe_execute", "description": "Safely verify cloud.policy.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.policy.create", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.policy.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2666", "external_name": "Cloud Policy Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.policy.delete", "stable_id": "OSCO-CAP-0681", "name": "Delete Policy", "description": "Perform delete operation on policy in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.policy.delete" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.policy.delete", "type": "safe_execute", "description": "Safely verify cloud.policy.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.policy.delete", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.policy.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2669", "external_name": "Cloud Policy Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.policy.read", "stable_id": "OSCO-CAP-0679", "name": "Read Policy", "description": "Perform read operation on policy in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.policy.read" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.policy.read", "type": "safe_execute", "description": "Safely verify cloud.policy.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.policy.read", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.policy.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2667", "external_name": "Cloud Policy Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.policy.tag", "stable_id": "OSCO-CAP-0682", "name": "Tag Policy", "description": "Perform tag operation on policy in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.policy.tag" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.policy.tag", "type": "safe_execute", "description": "Safely verify cloud.policy.tag with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.policy.tag", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.policy.tag" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2670", "external_name": "Cloud Policy Tag", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.policy.update", "stable_id": "OSCO-CAP-0680", "name": "Update Policy", "description": "Perform update operation on policy in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.policy.update" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.policy.update", "type": "safe_execute", "description": "Safely verify cloud.policy.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.policy.update", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.policy.update" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2668", "external_name": "Cloud Policy Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.resource.create", "stable_id": "OSCO-CAP-0663", "name": "Create Resource", "description": "Perform create operation on resource in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.resource.create" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "resource state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.resource.create", "type": "safe_execute", "description": "Safely verify cloud.resource.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.resource.create", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.resource.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2651", "external_name": "Cloud Resource Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.resource.delete", "stable_id": "OSCO-CAP-0666", "name": "Delete Resource", "description": "Perform delete operation on resource in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.resource.delete" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "resource state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.resource.delete", "type": "safe_execute", "description": "Safely verify cloud.resource.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.resource.delete", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.resource.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2654", "external_name": "Cloud Resource Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.resource.read", "stable_id": "OSCO-CAP-0664", "name": "Read Resource", "description": "Perform read operation on resource in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.resource.read" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "resource state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.resource.read", "type": "safe_execute", "description": "Safely verify cloud.resource.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.resource.read", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.resource.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2652", "external_name": "Cloud Resource Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.resource.tag", "stable_id": "OSCO-CAP-0667", "name": "Tag Resource", "description": "Perform tag operation on resource in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.resource.tag" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "resource state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.resource.tag", "type": "safe_execute", "description": "Safely verify cloud.resource.tag with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.resource.tag", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.resource.tag" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2655", "external_name": "Cloud Resource Tag", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "cloud.resource.update", "stable_id": "OSCO-CAP-0665", "name": "Update Resource", "description": "Perform update operation on resource in the cloud domain.", "category": "cloud", "domain": "cloud", "platforms": [ "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "cloud.resource.update" ], "preconditions": [ "provider exposes cloud capability surface" ], "postconditions": [ "resource state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.cloud.resource.update", "type": "safe_execute", "description": "Safely verify cloud.resource.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.cloud.resource.update", "type": "declared", "state": "declared", "description": "Discover declared support for cloud.resource.update" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2653", "external_name": "Cloud Resource Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.channel.audit", "stable_id": "OSCO-CAP-0776", "name": "Audit Channel", "description": "Perform audit operation on channel in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.channel.audit" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.channel.audit", "type": "safe_execute", "description": "Safely verify collaboration.channel.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.channel.audit", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.channel.audit" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2764", "external_name": "Collaboration Channel Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.channel.create", "stable_id": "OSCO-CAP-0772", "name": "Create Channel", "description": "Perform create operation on channel in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.channel.create" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.channel.create", "type": "safe_execute", "description": "Safely verify collaboration.channel.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.channel.create", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.channel.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2760", "external_name": "Collaboration Channel Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.channel.delete", "stable_id": "OSCO-CAP-0775", "name": "Delete Channel", "description": "Perform delete operation on channel in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.channel.delete" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.channel.delete", "type": "safe_execute", "description": "Safely verify collaboration.channel.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.channel.delete", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.channel.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2763", "external_name": "Collaboration Channel Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.channel.read", "stable_id": "OSCO-CAP-0773", "name": "Read Channel", "description": "Perform read operation on channel in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.channel.read" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.channel.read", "type": "safe_execute", "description": "Safely verify collaboration.channel.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.channel.read", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.channel.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2761", "external_name": "Collaboration Channel Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.channel.update", "stable_id": "OSCO-CAP-0774", "name": "Update Channel", "description": "Perform update operation on channel in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.channel.update" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.channel.update", "type": "safe_execute", "description": "Safely verify collaboration.channel.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.channel.update", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.channel.update" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2762", "external_name": "Collaboration Channel Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.membership.audit", "stable_id": "OSCO-CAP-0781", "name": "Audit Membership", "description": "Perform audit operation on membership in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.membership.audit" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "membership state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.membership.audit", "type": "safe_execute", "description": "Safely verify collaboration.membership.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.membership.audit", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.membership.audit" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2769", "external_name": "Collaboration Membership Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.membership.create", "stable_id": "OSCO-CAP-0777", "name": "Create Membership", "description": "Perform create operation on membership in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.membership.create" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "membership state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.membership.create", "type": "safe_execute", "description": "Safely verify collaboration.membership.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.membership.create", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.membership.create" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2765", "external_name": "Collaboration Membership Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.membership.delete", "stable_id": "OSCO-CAP-0780", "name": "Delete Membership", "description": "Perform delete operation on membership in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.membership.delete" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "membership state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.membership.delete", "type": "safe_execute", "description": "Safely verify collaboration.membership.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.membership.delete", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.membership.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2768", "external_name": "Collaboration Membership Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.membership.read", "stable_id": "OSCO-CAP-0778", "name": "Read Membership", "description": "Perform read operation on membership in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.membership.read" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "membership state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.membership.read", "type": "safe_execute", "description": "Safely verify collaboration.membership.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.membership.read", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.membership.read" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2766", "external_name": "Collaboration Membership Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.membership.update", "stable_id": "OSCO-CAP-0779", "name": "Update Membership", "description": "Perform update operation on membership in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.membership.update" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "membership state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.membership.update", "type": "safe_execute", "description": "Safely verify collaboration.membership.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.membership.update", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.membership.update" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2767", "external_name": "Collaboration Membership Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.sharing.audit", "stable_id": "OSCO-CAP-0786", "name": "Audit Sharing", "description": "Perform audit operation on sharing in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.sharing.audit" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "sharing state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.sharing.audit", "type": "safe_execute", "description": "Safely verify collaboration.sharing.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.sharing.audit", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.sharing.audit" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2774", "external_name": "Collaboration Sharing Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.sharing.create", "stable_id": "OSCO-CAP-0782", "name": "Create Sharing", "description": "Perform create operation on sharing in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.sharing.create" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "sharing state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.sharing.create", "type": "safe_execute", "description": "Safely verify collaboration.sharing.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.sharing.create", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.sharing.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2770", "external_name": "Collaboration Sharing Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.sharing.delete", "stable_id": "OSCO-CAP-0785", "name": "Delete Sharing", "description": "Perform delete operation on sharing in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.sharing.delete" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "sharing state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.sharing.delete", "type": "safe_execute", "description": "Safely verify collaboration.sharing.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.sharing.delete", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.sharing.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2773", "external_name": "Collaboration Sharing Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.sharing.read", "stable_id": "OSCO-CAP-0783", "name": "Read Sharing", "description": "Perform read operation on sharing in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.sharing.read" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "sharing state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.sharing.read", "type": "safe_execute", "description": "Safely verify collaboration.sharing.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.sharing.read", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.sharing.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2771", "external_name": "Collaboration Sharing Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.sharing.update", "stable_id": "OSCO-CAP-0784", "name": "Update Sharing", "description": "Perform update operation on sharing in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.sharing.update" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "sharing state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.sharing.update", "type": "safe_execute", "description": "Safely verify collaboration.sharing.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.sharing.update", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.sharing.update" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2772", "external_name": "Collaboration Sharing Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.workspace.audit", "stable_id": "OSCO-CAP-0771", "name": "Audit Workspace", "description": "Perform audit operation on workspace in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.workspace.audit" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "workspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.workspace.audit", "type": "safe_execute", "description": "Safely verify collaboration.workspace.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.workspace.audit", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.workspace.audit" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2759", "external_name": "Collaboration Workspace Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.workspace.create", "stable_id": "OSCO-CAP-0767", "name": "Create Workspace", "description": "Perform create operation on workspace in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.workspace.create" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "workspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.workspace.create", "type": "safe_execute", "description": "Safely verify collaboration.workspace.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.workspace.create", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.workspace.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2755", "external_name": "Collaboration Workspace Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.workspace.delete", "stable_id": "OSCO-CAP-0770", "name": "Delete Workspace", "description": "Perform delete operation on workspace in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.workspace.delete" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "workspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.workspace.delete", "type": "safe_execute", "description": "Safely verify collaboration.workspace.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.workspace.delete", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.workspace.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2758", "external_name": "Collaboration Workspace Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.workspace.read", "stable_id": "OSCO-CAP-0768", "name": "Read Workspace", "description": "Perform read operation on workspace in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.workspace.read" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "workspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.workspace.read", "type": "safe_execute", "description": "Safely verify collaboration.workspace.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.workspace.read", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.workspace.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2756", "external_name": "Collaboration Workspace Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collaboration.workspace.update", "stable_id": "OSCO-CAP-0769", "name": "Update Workspace", "description": "Perform update operation on workspace in the collaboration domain.", "category": "saas", "domain": "collaboration", "platforms": [ "saas" ], "providers": [ "provider.github", "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "collaboration.workspace.update" ], "preconditions": [ "provider exposes collaboration capability surface" ], "postconditions": [ "workspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collaboration.workspace.update", "type": "safe_execute", "description": "Safely verify collaboration.workspace.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collaboration.workspace.update", "type": "declared", "state": "declared", "description": "Discover declared support for collaboration.workspace.update" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2757", "external_name": "Collaboration Workspace Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.artifact.collect", "stable_id": "OSCO-CAP-0916", "name": "Collect Artifact", "description": "Perform collect operation on artifact in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.artifact.collect" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "artifact state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.artifact.collect", "type": "safe_execute", "description": "Safely verify collection.artifact.collect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.artifact.collect", "type": "declared", "state": "declared", "description": "Discover declared support for collection.artifact.collect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2904", "external_name": "Collection Artifact Collect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.artifact.enrich", "stable_id": "OSCO-CAP-0918", "name": "Enrich Artifact", "description": "Perform enrich operation on artifact in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.artifact.enrich" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "artifact state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.artifact.enrich", "type": "safe_execute", "description": "Safely verify collection.artifact.enrich with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.artifact.enrich", "type": "declared", "state": "declared", "description": "Discover declared support for collection.artifact.enrich" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2906", "external_name": "Collection Artifact Enrich", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.artifact.export", "stable_id": "OSCO-CAP-0920", "name": "Export Artifact", "description": "Perform export operation on artifact in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.artifact.export" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "artifact state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.artifact.export", "type": "safe_execute", "description": "Safely verify collection.artifact.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.artifact.export", "type": "declared", "state": "declared", "description": "Discover declared support for collection.artifact.export" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2908", "external_name": "Collection Artifact Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.artifact.normalize", "stable_id": "OSCO-CAP-0917", "name": "Normalize Artifact", "description": "Perform normalize operation on artifact in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.artifact.normalize" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "artifact state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.artifact.normalize", "type": "safe_execute", "description": "Safely verify collection.artifact.normalize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.artifact.normalize", "type": "declared", "state": "declared", "description": "Discover declared support for collection.artifact.normalize" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2905", "external_name": "Collection Artifact Normalize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.artifact.store", "stable_id": "OSCO-CAP-0919", "name": "Store Artifact", "description": "Perform store operation on artifact in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.artifact.store" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "artifact state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.artifact.store", "type": "safe_execute", "description": "Safely verify collection.artifact.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.artifact.store", "type": "declared", "state": "declared", "description": "Discover declared support for collection.artifact.store" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2907", "external_name": "Collection Artifact Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.evidence.collect", "stable_id": "OSCO-CAP-0921", "name": "Collect Evidence", "description": "Perform collect operation on evidence in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.evidence.collect" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "evidence state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.evidence.collect", "type": "safe_execute", "description": "Safely verify collection.evidence.collect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.evidence.collect", "type": "declared", "state": "declared", "description": "Discover declared support for collection.evidence.collect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2909", "external_name": "Collection Evidence Collect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.evidence.enrich", "stable_id": "OSCO-CAP-0923", "name": "Enrich Evidence", "description": "Perform enrich operation on evidence in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.evidence.enrich" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "evidence state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.evidence.enrich", "type": "safe_execute", "description": "Safely verify collection.evidence.enrich with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.evidence.enrich", "type": "declared", "state": "declared", "description": "Discover declared support for collection.evidence.enrich" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2911", "external_name": "Collection Evidence Enrich", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.evidence.export", "stable_id": "OSCO-CAP-0925", "name": "Export Evidence", "description": "Perform export operation on evidence in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.evidence.export" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "evidence state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.evidence.export", "type": "safe_execute", "description": "Safely verify collection.evidence.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.evidence.export", "type": "declared", "state": "declared", "description": "Discover declared support for collection.evidence.export" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2913", "external_name": "Collection Evidence Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.evidence.normalize", "stable_id": "OSCO-CAP-0922", "name": "Normalize Evidence", "description": "Perform normalize operation on evidence in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.evidence.normalize" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "evidence state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.evidence.normalize", "type": "safe_execute", "description": "Safely verify collection.evidence.normalize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.evidence.normalize", "type": "declared", "state": "declared", "description": "Discover declared support for collection.evidence.normalize" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2910", "external_name": "Collection Evidence Normalize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.evidence.store", "stable_id": "OSCO-CAP-0924", "name": "Store Evidence", "description": "Perform store operation on evidence in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.evidence.store" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "evidence state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.evidence.store", "type": "safe_execute", "description": "Safely verify collection.evidence.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.evidence.store", "type": "declared", "state": "declared", "description": "Discover declared support for collection.evidence.store" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2912", "external_name": "Collection Evidence Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.persistence.evidence.collect", "stable_id": "OSCO-CAP-0010", "name": "Collect Persistence Evidence", "description": "Collect persistence evidence artifacts across providers.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform" ], "providers": [ "provider.windows", "provider.linux", "provider.macos", "provider.aws", "provider.kubernetes" ], "status": "stable", "confidence": 0.89, "safety": "safe", "child_capabilities": [ "registry.key.set", "windows.task.create" ], "mappings": [ { "framework": "velociraptor", "external_id": "Windows.Registry.RunKeys", "external_name": "Registry Run Keys Artifact", "relation": "maps_to", "confidence": 0.9 }, { "framework": "osquery", "external_id": "startup_items", "external_name": "Startup Items Table", "relation": "maps_to", "confidence": 0.83 } ] }, { "capability_id": "collection.snapshot.collect", "stable_id": "OSCO-CAP-0931", "name": "Collect Snapshot", "description": "Perform collect operation on snapshot in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.snapshot.collect" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.snapshot.collect", "type": "safe_execute", "description": "Safely verify collection.snapshot.collect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.snapshot.collect", "type": "declared", "state": "declared", "description": "Discover declared support for collection.snapshot.collect" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2919", "external_name": "Collection Snapshot Collect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.snapshot.enrich", "stable_id": "OSCO-CAP-0933", "name": "Enrich Snapshot", "description": "Perform enrich operation on snapshot in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.snapshot.enrich" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.snapshot.enrich", "type": "safe_execute", "description": "Safely verify collection.snapshot.enrich with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.snapshot.enrich", "type": "declared", "state": "declared", "description": "Discover declared support for collection.snapshot.enrich" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2921", "external_name": "Collection Snapshot Enrich", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.snapshot.export", "stable_id": "OSCO-CAP-0935", "name": "Export Snapshot", "description": "Perform export operation on snapshot in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.snapshot.export" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.snapshot.export", "type": "safe_execute", "description": "Safely verify collection.snapshot.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.snapshot.export", "type": "declared", "state": "declared", "description": "Discover declared support for collection.snapshot.export" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2923", "external_name": "Collection Snapshot Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.snapshot.normalize", "stable_id": "OSCO-CAP-0932", "name": "Normalize Snapshot", "description": "Perform normalize operation on snapshot in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.snapshot.normalize" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.snapshot.normalize", "type": "safe_execute", "description": "Safely verify collection.snapshot.normalize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.snapshot.normalize", "type": "declared", "state": "declared", "description": "Discover declared support for collection.snapshot.normalize" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2920", "external_name": "Collection Snapshot Normalize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.snapshot.store", "stable_id": "OSCO-CAP-0934", "name": "Store Snapshot", "description": "Perform store operation on snapshot in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.snapshot.store" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.snapshot.store", "type": "safe_execute", "description": "Safely verify collection.snapshot.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.snapshot.store", "type": "declared", "state": "declared", "description": "Discover declared support for collection.snapshot.store" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2922", "external_name": "Collection Snapshot Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.timeline.collect", "stable_id": "OSCO-CAP-0926", "name": "Collect Timeline", "description": "Perform collect operation on timeline in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.timeline.collect" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "timeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.timeline.collect", "type": "safe_execute", "description": "Safely verify collection.timeline.collect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.timeline.collect", "type": "declared", "state": "declared", "description": "Discover declared support for collection.timeline.collect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2914", "external_name": "Collection Timeline Collect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.timeline.enrich", "stable_id": "OSCO-CAP-0928", "name": "Enrich Timeline", "description": "Perform enrich operation on timeline in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.timeline.enrich" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "timeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.timeline.enrich", "type": "safe_execute", "description": "Safely verify collection.timeline.enrich with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.timeline.enrich", "type": "declared", "state": "declared", "description": "Discover declared support for collection.timeline.enrich" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2916", "external_name": "Collection Timeline Enrich", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.timeline.export", "stable_id": "OSCO-CAP-0930", "name": "Export Timeline", "description": "Perform export operation on timeline in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.timeline.export" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "timeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.timeline.export", "type": "safe_execute", "description": "Safely verify collection.timeline.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.timeline.export", "type": "declared", "state": "declared", "description": "Discover declared support for collection.timeline.export" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2918", "external_name": "Collection Timeline Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.timeline.normalize", "stable_id": "OSCO-CAP-0927", "name": "Normalize Timeline", "description": "Perform normalize operation on timeline in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.timeline.normalize" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "timeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.timeline.normalize", "type": "safe_execute", "description": "Safely verify collection.timeline.normalize with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.timeline.normalize", "type": "declared", "state": "declared", "description": "Discover declared support for collection.timeline.normalize" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2915", "external_name": "Collection Timeline Normalize", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "collection.timeline.store", "stable_id": "OSCO-CAP-0929", "name": "Store Timeline", "description": "Perform store operation on timeline in the collection domain.", "category": "collection", "domain": "collection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "collection.timeline.store" ], "preconditions": [ "provider exposes collection capability surface" ], "postconditions": [ "timeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.collection.timeline.store", "type": "safe_execute", "description": "Safely verify collection.timeline.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.collection.timeline.store", "type": "declared", "state": "declared", "description": "Discover declared support for collection.timeline.store" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2917", "external_name": "Collection Timeline Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.activation.activate", "stable_id": "OSCO-CAP-0599", "name": "Activate Activation", "description": "Perform activate operation on activation in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.activation.activate" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "activation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.activation.activate", "type": "safe_execute", "description": "Safely verify com.activation.activate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.activation.activate", "type": "declared", "state": "declared", "description": "Discover declared support for com.activation.activate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2587", "external_name": "Com Activation Activate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.activation.modify", "stable_id": "OSCO-CAP-0601", "name": "Modify Activation", "description": "Perform modify operation on activation in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.activation.modify" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "activation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.activation.modify", "type": "safe_execute", "description": "Safely verify com.activation.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.activation.modify", "type": "declared", "state": "declared", "description": "Discover declared support for com.activation.modify" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2589", "external_name": "Com Activation Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.activation.query", "stable_id": "OSCO-CAP-0600", "name": "Query Activation", "description": "Perform query operation on activation in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.activation.query" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "activation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.activation.query", "type": "safe_execute", "description": "Safely verify com.activation.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.activation.query", "type": "declared", "state": "declared", "description": "Discover declared support for com.activation.query" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2588", "external_name": "Com Activation Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.activation.register", "stable_id": "OSCO-CAP-0598", "name": "Register Activation", "description": "Perform register operation on activation in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.activation.register" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "activation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.activation.register", "type": "safe_execute", "description": "Safely verify com.activation.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.activation.register", "type": "declared", "state": "declared", "description": "Discover declared support for com.activation.register" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2586", "external_name": "Com Activation Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.activation.remove", "stable_id": "OSCO-CAP-0602", "name": "Remove Activation", "description": "Perform remove operation on activation in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.activation.remove" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "activation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.activation.remove", "type": "safe_execute", "description": "Safely verify com.activation.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.activation.remove", "type": "declared", "state": "declared", "description": "Discover declared support for com.activation.remove" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2590", "external_name": "Com Activation Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.class.activate", "stable_id": "OSCO-CAP-0589", "name": "Activate Class", "description": "Perform activate operation on class in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.class.activate" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.class.activate", "type": "safe_execute", "description": "Safely verify com.class.activate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.class.activate", "type": "declared", "state": "declared", "description": "Discover declared support for com.class.activate" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2577", "external_name": "Com Class Activate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.class.modify", "stable_id": "OSCO-CAP-0591", "name": "Modify Class", "description": "Perform modify operation on class in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.class.modify" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.class.modify", "type": "safe_execute", "description": "Safely verify com.class.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.class.modify", "type": "declared", "state": "declared", "description": "Discover declared support for com.class.modify" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2579", "external_name": "Com Class Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.class.query", "stable_id": "OSCO-CAP-0590", "name": "Query Class", "description": "Perform query operation on class in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.class.query" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.class.query", "type": "safe_execute", "description": "Safely verify com.class.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.class.query", "type": "declared", "state": "declared", "description": "Discover declared support for com.class.query" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2578", "external_name": "Com Class Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.class.register", "stable_id": "OSCO-CAP-0588", "name": "Register Class", "description": "Perform register operation on class in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.class.register" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.class.register", "type": "safe_execute", "description": "Safely verify com.class.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.class.register", "type": "declared", "state": "declared", "description": "Discover declared support for com.class.register" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2576", "external_name": "Com Class Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.class.remove", "stable_id": "OSCO-CAP-0592", "name": "Remove Class", "description": "Perform remove operation on class in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.class.remove" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.class.remove", "type": "safe_execute", "description": "Safely verify com.class.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.class.remove", "type": "declared", "state": "declared", "description": "Discover declared support for com.class.remove" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2580", "external_name": "Com Class Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.object.activate", "stable_id": "OSCO-CAP-0584", "name": "Activate Object", "description": "Perform activate operation on object in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.object.activate" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "object state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.object.activate", "type": "safe_execute", "description": "Safely verify com.object.activate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.object.activate", "type": "declared", "state": "declared", "description": "Discover declared support for com.object.activate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2572", "external_name": "Com Object Activate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.object.modify", "stable_id": "OSCO-CAP-0586", "name": "Modify Object", "description": "Perform modify operation on object in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.object.modify" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "object state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.object.modify", "type": "safe_execute", "description": "Safely verify com.object.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.object.modify", "type": "declared", "state": "declared", "description": "Discover declared support for com.object.modify" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2574", "external_name": "Com Object Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.object.query", "stable_id": "OSCO-CAP-0585", "name": "Query Object", "description": "Perform query operation on object in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.object.query" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "object state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.object.query", "type": "safe_execute", "description": "Safely verify com.object.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.object.query", "type": "declared", "state": "declared", "description": "Discover declared support for com.object.query" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2573", "external_name": "Com Object Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.object.register", "stable_id": "OSCO-CAP-0583", "name": "Register Object", "description": "Perform register operation on object in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.object.register" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "object state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.object.register", "type": "safe_execute", "description": "Safely verify com.object.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.object.register", "type": "declared", "state": "declared", "description": "Discover declared support for com.object.register" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2571", "external_name": "Com Object Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.object.remove", "stable_id": "OSCO-CAP-0587", "name": "Remove Object", "description": "Perform remove operation on object in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.object.remove" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "object state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.object.remove", "type": "safe_execute", "description": "Safely verify com.object.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.object.remove", "type": "declared", "state": "declared", "description": "Discover declared support for com.object.remove" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2575", "external_name": "Com Object Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.registration.activate", "stable_id": "OSCO-CAP-0594", "name": "Activate Registration", "description": "Perform activate operation on registration in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.registration.activate" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "registration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.registration.activate", "type": "safe_execute", "description": "Safely verify com.registration.activate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.registration.activate", "type": "declared", "state": "declared", "description": "Discover declared support for com.registration.activate" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2582", "external_name": "Com Registration Activate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.registration.modify", "stable_id": "OSCO-CAP-0596", "name": "Modify Registration", "description": "Perform modify operation on registration in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.registration.modify" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "registration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.registration.modify", "type": "safe_execute", "description": "Safely verify com.registration.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.registration.modify", "type": "declared", "state": "declared", "description": "Discover declared support for com.registration.modify" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2584", "external_name": "Com Registration Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.registration.query", "stable_id": "OSCO-CAP-0595", "name": "Query Registration", "description": "Perform query operation on registration in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.registration.query" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "registration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.registration.query", "type": "safe_execute", "description": "Safely verify com.registration.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.registration.query", "type": "declared", "state": "declared", "description": "Discover declared support for com.registration.query" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2583", "external_name": "Com Registration Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.registration.register", "stable_id": "OSCO-CAP-0593", "name": "Register Registration", "description": "Perform register operation on registration in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.registration.register" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "registration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.registration.register", "type": "safe_execute", "description": "Safely verify com.registration.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.registration.register", "type": "declared", "state": "declared", "description": "Discover declared support for com.registration.register" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2581", "external_name": "Com Registration Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "com.registration.remove", "stable_id": "OSCO-CAP-0597", "name": "Remove Registration", "description": "Perform remove operation on registration in the com domain.", "category": "endpoint", "domain": "com", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "com.registration.remove" ], "preconditions": [ "provider exposes com capability surface" ], "postconditions": [ "registration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.com.registration.remove", "type": "safe_execute", "description": "Safely verify com.registration.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.com.registration.remove", "type": "declared", "state": "declared", "description": "Discover declared support for com.registration.remove" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2585", "external_name": "Com Registration Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.container.build", "stable_id": "OSCO-CAP-0688", "name": "Build Container", "description": "Perform build operation on container in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.container.build" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "container state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.container.build", "type": "safe_execute", "description": "Safely verify container.container.build with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.container.build", "type": "declared", "state": "declared", "description": "Discover declared support for container.container.build" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2676", "external_name": "Container Container Build", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.container.delete", "stable_id": "OSCO-CAP-0692", "name": "Delete Container", "description": "Perform delete operation on container in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.container.delete" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "container state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.container.delete", "type": "safe_execute", "description": "Safely verify container.container.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.container.delete", "type": "declared", "state": "declared", "description": "Discover declared support for container.container.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2680", "external_name": "Container Container Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.container.inspect", "stable_id": "OSCO-CAP-0690", "name": "Inspect Container", "description": "Perform inspect operation on container in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.container.inspect" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "container state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.container.inspect", "type": "safe_execute", "description": "Safely verify container.container.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.container.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for container.container.inspect" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2678", "external_name": "Container Container Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.container.run", "stable_id": "OSCO-CAP-0689", "name": "Run Container", "description": "Perform run operation on container in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.container.run" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "container state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.container.run", "type": "safe_execute", "description": "Safely verify container.container.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.container.run", "type": "declared", "state": "declared", "description": "Discover declared support for container.container.run" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2677", "external_name": "Container Container Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.container.stop", "stable_id": "OSCO-CAP-0691", "name": "Stop Container", "description": "Perform stop operation on container in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.container.stop" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "container state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.container.stop", "type": "safe_execute", "description": "Safely verify container.container.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.container.stop", "type": "declared", "state": "declared", "description": "Discover declared support for container.container.stop" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2679", "external_name": "Container Container Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.image.build", "stable_id": "OSCO-CAP-0683", "name": "Build Image", "description": "Perform build operation on image in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.image.build" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "image state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.image.build", "type": "safe_execute", "description": "Safely verify container.image.build with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.image.build", "type": "declared", "state": "declared", "description": "Discover declared support for container.image.build" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2671", "external_name": "Container Image Build", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.image.delete", "stable_id": "OSCO-CAP-0687", "name": "Delete Image", "description": "Perform delete operation on image in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.image.delete" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "image state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.image.delete", "type": "safe_execute", "description": "Safely verify container.image.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.image.delete", "type": "declared", "state": "declared", "description": "Discover declared support for container.image.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2675", "external_name": "Container Image Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.image.inspect", "stable_id": "OSCO-CAP-0685", "name": "Inspect Image", "description": "Perform inspect operation on image in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.image.inspect" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "image state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.image.inspect", "type": "safe_execute", "description": "Safely verify container.image.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.image.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for container.image.inspect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2673", "external_name": "Container Image Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.image.run", "stable_id": "OSCO-CAP-0684", "name": "Run Image", "description": "Perform run operation on image in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.image.run" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "image state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.image.run", "type": "safe_execute", "description": "Safely verify container.image.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.image.run", "type": "declared", "state": "declared", "description": "Discover declared support for container.image.run" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2672", "external_name": "Container Image Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.image.stop", "stable_id": "OSCO-CAP-0686", "name": "Stop Image", "description": "Perform stop operation on image in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.image.stop" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "image state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.image.stop", "type": "safe_execute", "description": "Safely verify container.image.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.image.stop", "type": "declared", "state": "declared", "description": "Discover declared support for container.image.stop" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2674", "external_name": "Container Image Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.runtime.build", "stable_id": "OSCO-CAP-0693", "name": "Build Runtime", "description": "Perform build operation on runtime in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.runtime.build" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "runtime state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.runtime.build", "type": "safe_execute", "description": "Safely verify container.runtime.build with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.runtime.build", "type": "declared", "state": "declared", "description": "Discover declared support for container.runtime.build" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2681", "external_name": "Container Runtime Build", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.runtime.delete", "stable_id": "OSCO-CAP-0697", "name": "Delete Runtime", "description": "Perform delete operation on runtime in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.runtime.delete" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "runtime state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.runtime.delete", "type": "safe_execute", "description": "Safely verify container.runtime.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.runtime.delete", "type": "declared", "state": "declared", "description": "Discover declared support for container.runtime.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2685", "external_name": "Container Runtime Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.runtime.inspect", "stable_id": "OSCO-CAP-0695", "name": "Inspect Runtime", "description": "Perform inspect operation on runtime in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.runtime.inspect" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "runtime state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.runtime.inspect", "type": "safe_execute", "description": "Safely verify container.runtime.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.runtime.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for container.runtime.inspect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2683", "external_name": "Container Runtime Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.runtime.run", "stable_id": "OSCO-CAP-0694", "name": "Run Runtime", "description": "Perform run operation on runtime in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.runtime.run" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "runtime state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.runtime.run", "type": "safe_execute", "description": "Safely verify container.runtime.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.runtime.run", "type": "declared", "state": "declared", "description": "Discover declared support for container.runtime.run" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2682", "external_name": "Container Runtime Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.runtime.stop", "stable_id": "OSCO-CAP-0696", "name": "Stop Runtime", "description": "Perform stop operation on runtime in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.runtime.stop" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "runtime state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.runtime.stop", "type": "safe_execute", "description": "Safely verify container.runtime.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.runtime.stop", "type": "declared", "state": "declared", "description": "Discover declared support for container.runtime.stop" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2684", "external_name": "Container Runtime Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.volume.build", "stable_id": "OSCO-CAP-0698", "name": "Build Volume", "description": "Perform build operation on volume in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.volume.build" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "volume state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.volume.build", "type": "safe_execute", "description": "Safely verify container.volume.build with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.volume.build", "type": "declared", "state": "declared", "description": "Discover declared support for container.volume.build" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2686", "external_name": "Container Volume Build", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.volume.delete", "stable_id": "OSCO-CAP-0702", "name": "Delete Volume", "description": "Perform delete operation on volume in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.volume.delete" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "volume state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.volume.delete", "type": "safe_execute", "description": "Safely verify container.volume.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.volume.delete", "type": "declared", "state": "declared", "description": "Discover declared support for container.volume.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2690", "external_name": "Container Volume Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.volume.inspect", "stable_id": "OSCO-CAP-0700", "name": "Inspect Volume", "description": "Perform inspect operation on volume in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.volume.inspect" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "volume state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.volume.inspect", "type": "safe_execute", "description": "Safely verify container.volume.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.volume.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for container.volume.inspect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2688", "external_name": "Container Volume Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.volume.run", "stable_id": "OSCO-CAP-0699", "name": "Run Volume", "description": "Perform run operation on volume in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.volume.run" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "volume state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.volume.run", "type": "safe_execute", "description": "Safely verify container.volume.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.volume.run", "type": "declared", "state": "declared", "description": "Discover declared support for container.volume.run" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2687", "external_name": "Container Volume Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "container.volume.stop", "stable_id": "OSCO-CAP-0701", "name": "Stop Volume", "description": "Perform stop operation on volume in the container domain.", "category": "container", "domain": "container", "platforms": [ "container", "cloud" ], "providers": [ "provider.docker", "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "container.volume.stop" ], "preconditions": [ "provider exposes container capability surface" ], "postconditions": [ "volume state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.container.volume.stop", "type": "safe_execute", "description": "Safely verify container.volume.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.container.volume.stop", "type": "declared", "state": "declared", "description": "Discover declared support for container.volume.stop" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2689", "external_name": "Container Volume Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.credential.access", "stable_id": "OSCO-CAP-0199", "name": "Access Credential", "description": "Perform access operation on credential in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.credential.access" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.credential.access", "type": "safe_execute", "description": "Safely verify credential.credential.access with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.credential.access", "type": "declared", "state": "declared", "description": "Discover declared support for credential.credential.access" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2187", "external_name": "Credential Credential Access", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.credential.delete", "stable_id": "OSCO-CAP-0203", "name": "Delete Credential", "description": "Perform delete operation on credential in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.credential.delete" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.credential.delete", "type": "safe_execute", "description": "Safely verify credential.credential.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.credential.delete", "type": "declared", "state": "declared", "description": "Discover declared support for credential.credential.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2191", "external_name": "Credential Credential Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.credential.dump", "stable_id": "OSCO-CAP-0200", "name": "Dump Credential", "description": "Perform dump operation on credential in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.credential.dump" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.credential.dump", "type": "safe_execute", "description": "Safely verify credential.credential.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.credential.dump", "type": "declared", "state": "declared", "description": "Discover declared support for credential.credential.dump" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2188", "external_name": "Credential Credential Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.credential.rotate", "stable_id": "OSCO-CAP-0201", "name": "Rotate Credential", "description": "Perform rotate operation on credential in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.credential.rotate" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.credential.rotate", "type": "safe_execute", "description": "Safely verify credential.credential.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.credential.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for credential.credential.rotate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2189", "external_name": "Credential Credential Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.credential.store", "stable_id": "OSCO-CAP-0202", "name": "Store Credential", "description": "Perform store operation on credential in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.credential.store" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.credential.store", "type": "safe_execute", "description": "Safely verify credential.credential.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.credential.store", "type": "declared", "state": "declared", "description": "Discover declared support for credential.credential.store" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2190", "external_name": "Credential Credential Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.hash.access", "stable_id": "OSCO-CAP-0204", "name": "Access Hash", "description": "Perform access operation on hash in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.hash.access" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "hash state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.hash.access", "type": "safe_execute", "description": "Safely verify credential.hash.access with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.hash.access", "type": "declared", "state": "declared", "description": "Discover declared support for credential.hash.access" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2192", "external_name": "Credential Hash Access", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.hash.delete", "stable_id": "OSCO-CAP-0208", "name": "Delete Hash", "description": "Perform delete operation on hash in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.hash.delete" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "hash state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.hash.delete", "type": "safe_execute", "description": "Safely verify credential.hash.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.hash.delete", "type": "declared", "state": "declared", "description": "Discover declared support for credential.hash.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2196", "external_name": "Credential Hash Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.hash.dump", "stable_id": "OSCO-CAP-0205", "name": "Dump Hash", "description": "Perform dump operation on hash in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.hash.dump" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "hash state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.hash.dump", "type": "safe_execute", "description": "Safely verify credential.hash.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.hash.dump", "type": "declared", "state": "declared", "description": "Discover declared support for credential.hash.dump" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2193", "external_name": "Credential Hash Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.hash.rotate", "stable_id": "OSCO-CAP-0206", "name": "Rotate Hash", "description": "Perform rotate operation on hash in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.hash.rotate" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "hash state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.hash.rotate", "type": "safe_execute", "description": "Safely verify credential.hash.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.hash.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for credential.hash.rotate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2194", "external_name": "Credential Hash Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.hash.store", "stable_id": "OSCO-CAP-0207", "name": "Store Hash", "description": "Perform store operation on hash in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.hash.store" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "hash state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.hash.store", "type": "safe_execute", "description": "Safely verify credential.hash.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.hash.store", "type": "declared", "state": "declared", "description": "Discover declared support for credential.hash.store" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2195", "external_name": "Credential Hash Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.token.access", "stable_id": "OSCO-CAP-0209", "name": "Access Token", "description": "Perform access operation on token in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.token.access" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.token.access", "type": "safe_execute", "description": "Safely verify credential.token.access with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.token.access", "type": "declared", "state": "declared", "description": "Discover declared support for credential.token.access" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2197", "external_name": "Credential Token Access", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.token.delete", "stable_id": "OSCO-CAP-0213", "name": "Delete Token", "description": "Perform delete operation on token in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.token.delete" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.token.delete", "type": "safe_execute", "description": "Safely verify credential.token.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.token.delete", "type": "declared", "state": "declared", "description": "Discover declared support for credential.token.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2201", "external_name": "Credential Token Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.token.dump", "stable_id": "OSCO-CAP-0210", "name": "Dump Token", "description": "Perform dump operation on token in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.token.dump" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.token.dump", "type": "safe_execute", "description": "Safely verify credential.token.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.token.dump", "type": "declared", "state": "declared", "description": "Discover declared support for credential.token.dump" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2198", "external_name": "Credential Token Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.token.rotate", "stable_id": "OSCO-CAP-0211", "name": "Rotate Token", "description": "Perform rotate operation on token in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.token.rotate" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.token.rotate", "type": "safe_execute", "description": "Safely verify credential.token.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.token.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for credential.token.rotate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2199", "external_name": "Credential Token Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.token.store", "stable_id": "OSCO-CAP-0212", "name": "Store Token", "description": "Perform store operation on token in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.token.store" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.token.store", "type": "safe_execute", "description": "Safely verify credential.token.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.token.store", "type": "declared", "state": "declared", "description": "Discover declared support for credential.token.store" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2200", "external_name": "Credential Token Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.vault.access", "stable_id": "OSCO-CAP-0214", "name": "Access Vault", "description": "Perform access operation on vault in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.vault.access" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "vault state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.vault.access", "type": "safe_execute", "description": "Safely verify credential.vault.access with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.vault.access", "type": "declared", "state": "declared", "description": "Discover declared support for credential.vault.access" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2202", "external_name": "Credential Vault Access", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.vault.delete", "stable_id": "OSCO-CAP-0218", "name": "Delete Vault", "description": "Perform delete operation on vault in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.vault.delete" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "vault state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.vault.delete", "type": "safe_execute", "description": "Safely verify credential.vault.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.vault.delete", "type": "declared", "state": "declared", "description": "Discover declared support for credential.vault.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2206", "external_name": "Credential Vault Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.vault.dump", "stable_id": "OSCO-CAP-0215", "name": "Dump Vault", "description": "Perform dump operation on vault in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.vault.dump" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "vault state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.vault.dump", "type": "safe_execute", "description": "Safely verify credential.vault.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.vault.dump", "type": "declared", "state": "declared", "description": "Discover declared support for credential.vault.dump" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2203", "external_name": "Credential Vault Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.vault.rotate", "stable_id": "OSCO-CAP-0216", "name": "Rotate Vault", "description": "Perform rotate operation on vault in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.vault.rotate" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "vault state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.vault.rotate", "type": "safe_execute", "description": "Safely verify credential.vault.rotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.vault.rotate", "type": "declared", "state": "declared", "description": "Discover declared support for credential.vault.rotate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2204", "external_name": "Credential Vault Rotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "credential.vault.store", "stable_id": "OSCO-CAP-0217", "name": "Store Vault", "description": "Perform store operation on vault in the credential domain.", "category": "identity", "domain": "credential", "platforms": [ "windows", "linux", "macos", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.okta", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "credential.vault.store" ], "preconditions": [ "provider exposes credential capability surface" ], "postconditions": [ "vault state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.credential.vault.store", "type": "safe_execute", "description": "Safely verify credential.vault.store with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.credential.vault.store", "type": "declared", "state": "declared", "description": "Discover declared support for credential.vault.store" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2205", "external_name": "Credential Vault Store", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.audit.create", "stable_id": "OSCO-CAP-0810", "name": "Create Audit", "description": "Perform create operation on audit in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.audit.create" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "audit state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.audit.create", "type": "safe_execute", "description": "Safely verify database.audit.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.audit.create", "type": "declared", "state": "declared", "description": "Discover declared support for database.audit.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2798", "external_name": "Database Audit Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.audit.delete", "stable_id": "OSCO-CAP-0813", "name": "Delete Audit", "description": "Perform delete operation on audit in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.audit.delete" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "audit state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.audit.delete", "type": "safe_execute", "description": "Safely verify database.audit.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.audit.delete", "type": "declared", "state": "declared", "description": "Discover declared support for database.audit.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2801", "external_name": "Database Audit Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.audit.grant", "stable_id": "OSCO-CAP-0814", "name": "Grant Audit", "description": "Perform grant operation on audit in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.audit.grant" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "audit state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.audit.grant", "type": "safe_execute", "description": "Safely verify database.audit.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.audit.grant", "type": "declared", "state": "declared", "description": "Discover declared support for database.audit.grant" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2802", "external_name": "Database Audit Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.audit.read", "stable_id": "OSCO-CAP-0811", "name": "Read Audit", "description": "Perform read operation on audit in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.audit.read" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "audit state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.audit.read", "type": "safe_execute", "description": "Safely verify database.audit.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.audit.read", "type": "declared", "state": "declared", "description": "Discover declared support for database.audit.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2799", "external_name": "Database Audit Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.audit.revoke", "stable_id": "OSCO-CAP-0815", "name": "Revoke Audit", "description": "Perform revoke operation on audit in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.audit.revoke" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "audit state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.audit.revoke", "type": "safe_execute", "description": "Safely verify database.audit.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.audit.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for database.audit.revoke" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2803", "external_name": "Database Audit Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.audit.update", "stable_id": "OSCO-CAP-0812", "name": "Update Audit", "description": "Perform update operation on audit in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.audit.update" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "audit state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.audit.update", "type": "safe_execute", "description": "Safely verify database.audit.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.audit.update", "type": "declared", "state": "declared", "description": "Discover declared support for database.audit.update" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2800", "external_name": "Database Audit Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.query.create", "stable_id": "OSCO-CAP-0798", "name": "Create Query", "description": "Perform create operation on query in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.query.create" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.query.create", "type": "safe_execute", "description": "Safely verify database.query.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.query.create", "type": "declared", "state": "declared", "description": "Discover declared support for database.query.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2786", "external_name": "Database Query Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.query.delete", "stable_id": "OSCO-CAP-0801", "name": "Delete Query", "description": "Perform delete operation on query in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.query.delete" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.query.delete", "type": "safe_execute", "description": "Safely verify database.query.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.query.delete", "type": "declared", "state": "declared", "description": "Discover declared support for database.query.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2789", "external_name": "Database Query Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.query.grant", "stable_id": "OSCO-CAP-0802", "name": "Grant Query", "description": "Perform grant operation on query in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.query.grant" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.query.grant", "type": "safe_execute", "description": "Safely verify database.query.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.query.grant", "type": "declared", "state": "declared", "description": "Discover declared support for database.query.grant" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2790", "external_name": "Database Query Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.query.read", "stable_id": "OSCO-CAP-0799", "name": "Read Query", "description": "Perform read operation on query in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.query.read" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.query.read", "type": "safe_execute", "description": "Safely verify database.query.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.query.read", "type": "declared", "state": "declared", "description": "Discover declared support for database.query.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2787", "external_name": "Database Query Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.query.revoke", "stable_id": "OSCO-CAP-0803", "name": "Revoke Query", "description": "Perform revoke operation on query in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.query.revoke" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.query.revoke", "type": "safe_execute", "description": "Safely verify database.query.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.query.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for database.query.revoke" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2791", "external_name": "Database Query Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.query.update", "stable_id": "OSCO-CAP-0800", "name": "Update Query", "description": "Perform update operation on query in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.query.update" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.query.update", "type": "safe_execute", "description": "Safely verify database.query.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.query.update", "type": "declared", "state": "declared", "description": "Discover declared support for database.query.update" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2788", "external_name": "Database Query Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.role.create", "stable_id": "OSCO-CAP-0787", "name": "Create Role", "description": "Perform create operation on role in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.role.create" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.role.create", "type": "safe_execute", "description": "Safely verify database.role.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.role.create", "type": "declared", "state": "declared", "description": "Discover declared support for database.role.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2775", "external_name": "Database Role Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.role.delete", "stable_id": "OSCO-CAP-0790", "name": "Delete Role", "description": "Perform delete operation on role in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.role.delete" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.role.delete", "type": "safe_execute", "description": "Safely verify database.role.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.role.delete", "type": "declared", "state": "declared", "description": "Discover declared support for database.role.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2778", "external_name": "Database Role Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.role.grant", "stable_id": "OSCO-CAP-0009", "name": "Grant Database Role", "description": "Grant an authorization role to a principal.", "category": "database", "domain": "authorization", "platforms": [ "database" ], "providers": [ "provider.sql_server", "provider.postgresql" ], "status": "stable", "confidence": 0.87, "safety": "caution", "mappings": [ { "framework": "cwe", "external_id": "CWE-732", "external_name": "Incorrect Permission Assignment", "relation": "related_to", "confidence": 0.5 } ] }, { "capability_id": "database.role.read", "stable_id": "OSCO-CAP-0788", "name": "Read Role", "description": "Perform read operation on role in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.role.read" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.role.read", "type": "safe_execute", "description": "Safely verify database.role.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.role.read", "type": "declared", "state": "declared", "description": "Discover declared support for database.role.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2776", "external_name": "Database Role Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.role.revoke", "stable_id": "OSCO-CAP-0791", "name": "Revoke Role", "description": "Perform revoke operation on role in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.role.revoke" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.role.revoke", "type": "safe_execute", "description": "Safely verify database.role.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.role.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for database.role.revoke" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2779", "external_name": "Database Role Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.role.update", "stable_id": "OSCO-CAP-0789", "name": "Update Role", "description": "Perform update operation on role in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.role.update" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.role.update", "type": "safe_execute", "description": "Safely verify database.role.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.role.update", "type": "declared", "state": "declared", "description": "Discover declared support for database.role.update" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2777", "external_name": "Database Role Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.table.create", "stable_id": "OSCO-CAP-0804", "name": "Create Table", "description": "Perform create operation on table in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.table.create" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "table state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.table.create", "type": "safe_execute", "description": "Safely verify database.table.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.table.create", "type": "declared", "state": "declared", "description": "Discover declared support for database.table.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2792", "external_name": "Database Table Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.table.delete", "stable_id": "OSCO-CAP-0807", "name": "Delete Table", "description": "Perform delete operation on table in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.table.delete" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "table state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.table.delete", "type": "safe_execute", "description": "Safely verify database.table.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.table.delete", "type": "declared", "state": "declared", "description": "Discover declared support for database.table.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2795", "external_name": "Database Table Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.table.grant", "stable_id": "OSCO-CAP-0808", "name": "Grant Table", "description": "Perform grant operation on table in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.table.grant" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "table state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.table.grant", "type": "safe_execute", "description": "Safely verify database.table.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.table.grant", "type": "declared", "state": "declared", "description": "Discover declared support for database.table.grant" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2796", "external_name": "Database Table Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.table.read", "stable_id": "OSCO-CAP-0805", "name": "Read Table", "description": "Perform read operation on table in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.table.read" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "table state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.table.read", "type": "safe_execute", "description": "Safely verify database.table.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.table.read", "type": "declared", "state": "declared", "description": "Discover declared support for database.table.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2793", "external_name": "Database Table Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.table.revoke", "stable_id": "OSCO-CAP-0809", "name": "Revoke Table", "description": "Perform revoke operation on table in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.table.revoke" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "table state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.table.revoke", "type": "safe_execute", "description": "Safely verify database.table.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.table.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for database.table.revoke" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2797", "external_name": "Database Table Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.table.update", "stable_id": "OSCO-CAP-0806", "name": "Update Table", "description": "Perform update operation on table in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.table.update" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "table state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.table.update", "type": "safe_execute", "description": "Safely verify database.table.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.table.update", "type": "declared", "state": "declared", "description": "Discover declared support for database.table.update" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2794", "external_name": "Database Table Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.user.create", "stable_id": "OSCO-CAP-0792", "name": "Create User", "description": "Perform create operation on user in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.user.create" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.user.create", "type": "safe_execute", "description": "Safely verify database.user.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.user.create", "type": "declared", "state": "declared", "description": "Discover declared support for database.user.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2780", "external_name": "Database User Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.user.delete", "stable_id": "OSCO-CAP-0795", "name": "Delete User", "description": "Perform delete operation on user in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.user.delete" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.user.delete", "type": "safe_execute", "description": "Safely verify database.user.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.user.delete", "type": "declared", "state": "declared", "description": "Discover declared support for database.user.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2783", "external_name": "Database User Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.user.grant", "stable_id": "OSCO-CAP-0796", "name": "Grant User", "description": "Perform grant operation on user in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.user.grant" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.user.grant", "type": "safe_execute", "description": "Safely verify database.user.grant with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.user.grant", "type": "declared", "state": "declared", "description": "Discover declared support for database.user.grant" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2784", "external_name": "Database User Grant", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.user.read", "stable_id": "OSCO-CAP-0793", "name": "Read User", "description": "Perform read operation on user in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.user.read" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.user.read", "type": "safe_execute", "description": "Safely verify database.user.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.user.read", "type": "declared", "state": "declared", "description": "Discover declared support for database.user.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2781", "external_name": "Database User Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.user.revoke", "stable_id": "OSCO-CAP-0797", "name": "Revoke User", "description": "Perform revoke operation on user in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.user.revoke" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.user.revoke", "type": "safe_execute", "description": "Safely verify database.user.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.user.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for database.user.revoke" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2785", "external_name": "Database User Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "database.user.update", "stable_id": "OSCO-CAP-0794", "name": "Update User", "description": "Perform update operation on user in the database domain.", "category": "database", "domain": "database", "platforms": [ "database", "cloud" ], "providers": [ "provider.postgresql", "provider.sql_server" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "database.user.update" ], "preconditions": [ "provider exposes database capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.database.user.update", "type": "safe_execute", "description": "Safely verify database.user.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.database.user.update", "type": "declared", "state": "declared", "description": "Discover declared support for database.user.update" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2782", "external_name": "Database User Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.analytic.create", "stable_id": "OSCO-CAP-0886", "name": "Create Analytic", "description": "Perform create operation on analytic in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.analytic.create" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "analytic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.analytic.create", "type": "safe_execute", "description": "Safely verify detection.analytic.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.analytic.create", "type": "declared", "state": "declared", "description": "Discover declared support for detection.analytic.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2874", "external_name": "Detection Analytic Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.analytic.deploy", "stable_id": "OSCO-CAP-0888", "name": "Deploy Analytic", "description": "Perform deploy operation on analytic in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.analytic.deploy" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "analytic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.analytic.deploy", "type": "safe_execute", "description": "Safely verify detection.analytic.deploy with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.analytic.deploy", "type": "declared", "state": "declared", "description": "Discover declared support for detection.analytic.deploy" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2876", "external_name": "Detection Analytic Deploy", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.analytic.retire", "stable_id": "OSCO-CAP-0890", "name": "Retire Analytic", "description": "Perform retire operation on analytic in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.analytic.retire" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "analytic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.analytic.retire", "type": "safe_execute", "description": "Safely verify detection.analytic.retire with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.analytic.retire", "type": "declared", "state": "declared", "description": "Discover declared support for detection.analytic.retire" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2878", "external_name": "Detection Analytic Retire", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.analytic.test", "stable_id": "OSCO-CAP-0887", "name": "Test Analytic", "description": "Perform test operation on analytic in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.analytic.test" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "analytic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.analytic.test", "type": "safe_execute", "description": "Safely verify detection.analytic.test with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.analytic.test", "type": "declared", "state": "declared", "description": "Discover declared support for detection.analytic.test" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2875", "external_name": "Detection Analytic Test", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.analytic.tune", "stable_id": "OSCO-CAP-0889", "name": "Tune Analytic", "description": "Perform tune operation on analytic in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.analytic.tune" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "analytic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.analytic.tune", "type": "safe_execute", "description": "Safely verify detection.analytic.tune with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.analytic.tune", "type": "declared", "state": "declared", "description": "Discover declared support for detection.analytic.tune" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2877", "external_name": "Detection Analytic Tune", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.baseline.create", "stable_id": "OSCO-CAP-0891", "name": "Create Baseline", "description": "Perform create operation on baseline in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.baseline.create" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "baseline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.baseline.create", "type": "safe_execute", "description": "Safely verify detection.baseline.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.baseline.create", "type": "declared", "state": "declared", "description": "Discover declared support for detection.baseline.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2879", "external_name": "Detection Baseline Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.baseline.deploy", "stable_id": "OSCO-CAP-0893", "name": "Deploy Baseline", "description": "Perform deploy operation on baseline in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.baseline.deploy" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "baseline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.baseline.deploy", "type": "safe_execute", "description": "Safely verify detection.baseline.deploy with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.baseline.deploy", "type": "declared", "state": "declared", "description": "Discover declared support for detection.baseline.deploy" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2881", "external_name": "Detection Baseline Deploy", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.baseline.retire", "stable_id": "OSCO-CAP-0895", "name": "Retire Baseline", "description": "Perform retire operation on baseline in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.baseline.retire" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "baseline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.baseline.retire", "type": "safe_execute", "description": "Safely verify detection.baseline.retire with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.baseline.retire", "type": "declared", "state": "declared", "description": "Discover declared support for detection.baseline.retire" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2883", "external_name": "Detection Baseline Retire", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.baseline.test", "stable_id": "OSCO-CAP-0892", "name": "Test Baseline", "description": "Perform test operation on baseline in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.baseline.test" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "baseline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.baseline.test", "type": "safe_execute", "description": "Safely verify detection.baseline.test with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.baseline.test", "type": "declared", "state": "declared", "description": "Discover declared support for detection.baseline.test" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2880", "external_name": "Detection Baseline Test", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.baseline.tune", "stable_id": "OSCO-CAP-0894", "name": "Tune Baseline", "description": "Perform tune operation on baseline in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.baseline.tune" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "baseline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.baseline.tune", "type": "safe_execute", "description": "Safely verify detection.baseline.tune with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.baseline.tune", "type": "declared", "state": "declared", "description": "Discover declared support for detection.baseline.tune" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2882", "external_name": "Detection Baseline Tune", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.query.create", "stable_id": "OSCO-CAP-0881", "name": "Create Query", "description": "Perform create operation on query in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.query.create" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.query.create", "type": "safe_execute", "description": "Safely verify detection.query.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.query.create", "type": "declared", "state": "declared", "description": "Discover declared support for detection.query.create" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2869", "external_name": "Detection Query Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.query.deploy", "stable_id": "OSCO-CAP-0883", "name": "Deploy Query", "description": "Perform deploy operation on query in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.query.deploy" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.query.deploy", "type": "safe_execute", "description": "Safely verify detection.query.deploy with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.query.deploy", "type": "declared", "state": "declared", "description": "Discover declared support for detection.query.deploy" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2871", "external_name": "Detection Query Deploy", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.query.retire", "stable_id": "OSCO-CAP-0885", "name": "Retire Query", "description": "Perform retire operation on query in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.query.retire" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.query.retire", "type": "safe_execute", "description": "Safely verify detection.query.retire with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.query.retire", "type": "declared", "state": "declared", "description": "Discover declared support for detection.query.retire" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2873", "external_name": "Detection Query Retire", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.query.test", "stable_id": "OSCO-CAP-0882", "name": "Test Query", "description": "Perform test operation on query in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.query.test" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.query.test", "type": "safe_execute", "description": "Safely verify detection.query.test with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.query.test", "type": "declared", "state": "declared", "description": "Discover declared support for detection.query.test" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2870", "external_name": "Detection Query Test", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.query.tune", "stable_id": "OSCO-CAP-0884", "name": "Tune Query", "description": "Perform tune operation on query in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.query.tune" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.query.tune", "type": "safe_execute", "description": "Safely verify detection.query.tune with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.query.tune", "type": "declared", "state": "declared", "description": "Discover declared support for detection.query.tune" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2872", "external_name": "Detection Query Tune", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.registry.persistence.detect", "stable_id": "OSCO-CAP-0011", "name": "Detect Registry Persistence", "description": "Detect suspicious registry persistence modifications.", "category": "detection", "domain": "detection", "platforms": [ "windows", "cross_platform" ], "providers": [ "provider.windows" ], "status": "stable", "confidence": 0.91, "safety": "safe", "consumed_telemetry": [ "tm.sysmon.13" ], "mappings": [ { "framework": "sigma", "external_id": "win_registry_persistence", "external_name": "Windows Registry Persistence", "relation": "maps_to", "confidence": 0.92 }, { "framework": "mitre_attack", "external_id": "T1547.001", "external_name": "Registry Run Keys / Startup Folder", "relation": "detects", "confidence": 0.93 } ] }, { "capability_id": "detection.rule.create", "stable_id": "OSCO-CAP-0876", "name": "Create Rule", "description": "Perform create operation on rule in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.rule.create" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.rule.create", "type": "safe_execute", "description": "Safely verify detection.rule.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.rule.create", "type": "declared", "state": "declared", "description": "Discover declared support for detection.rule.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2864", "external_name": "Detection Rule Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.rule.deploy", "stable_id": "OSCO-CAP-0878", "name": "Deploy Rule", "description": "Perform deploy operation on rule in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.rule.deploy" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.rule.deploy", "type": "safe_execute", "description": "Safely verify detection.rule.deploy with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.rule.deploy", "type": "declared", "state": "declared", "description": "Discover declared support for detection.rule.deploy" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2866", "external_name": "Detection Rule Deploy", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.rule.retire", "stable_id": "OSCO-CAP-0880", "name": "Retire Rule", "description": "Perform retire operation on rule in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.rule.retire" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.rule.retire", "type": "safe_execute", "description": "Safely verify detection.rule.retire with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.rule.retire", "type": "declared", "state": "declared", "description": "Discover declared support for detection.rule.retire" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2868", "external_name": "Detection Rule Retire", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.rule.test", "stable_id": "OSCO-CAP-0877", "name": "Test Rule", "description": "Perform test operation on rule in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.rule.test" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.rule.test", "type": "safe_execute", "description": "Safely verify detection.rule.test with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.rule.test", "type": "declared", "state": "declared", "description": "Discover declared support for detection.rule.test" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2865", "external_name": "Detection Rule Test", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "detection.rule.tune", "stable_id": "OSCO-CAP-0879", "name": "Tune Rule", "description": "Perform tune operation on rule in the detection domain.", "category": "detection", "domain": "detection", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "detection.rule.tune" ], "preconditions": [ "provider exposes detection capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.detection.rule.tune", "type": "safe_execute", "description": "Safely verify detection.rule.tune with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.detection.rule.tune", "type": "declared", "state": "declared", "description": "Discover declared support for detection.rule.tune" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2867", "external_name": "Detection Rule Tune", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.query.create", "stable_id": "OSCO-CAP-0479", "name": "Create Query", "description": "Perform create operation on query in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.query.create" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.query.create", "type": "safe_execute", "description": "Safely verify dns.query.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.query.create", "type": "declared", "state": "declared", "description": "Discover declared support for dns.query.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2467", "external_name": "Dns Query Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.query.delete", "stable_id": "OSCO-CAP-0481", "name": "Delete Query", "description": "Perform delete operation on query in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.query.delete" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.query.delete", "type": "safe_execute", "description": "Safely verify dns.query.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.query.delete", "type": "declared", "state": "declared", "description": "Discover declared support for dns.query.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2469", "external_name": "Dns Query Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.query.monitor", "stable_id": "OSCO-CAP-0482", "name": "Monitor Query", "description": "Perform monitor operation on query in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.query.monitor" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.query.monitor", "type": "safe_execute", "description": "Safely verify dns.query.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.query.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for dns.query.monitor" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2470", "external_name": "Dns Query Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.query.query", "stable_id": "OSCO-CAP-0478", "name": "Query Query", "description": "Perform query operation on query in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.query.query" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.query.query", "type": "safe_execute", "description": "Safely verify dns.query.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.query.query", "type": "declared", "state": "declared", "description": "Discover declared support for dns.query.query" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2466", "external_name": "Dns Query Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.query.update", "stable_id": "OSCO-CAP-0480", "name": "Update Query", "description": "Perform update operation on query in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.query.update" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "query state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.query.update", "type": "safe_execute", "description": "Safely verify dns.query.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.query.update", "type": "declared", "state": "declared", "description": "Discover declared support for dns.query.update" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2468", "external_name": "Dns Query Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.record.create", "stable_id": "OSCO-CAP-0464", "name": "Create Record", "description": "Perform create operation on record in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.record.create" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "record state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.record.create", "type": "safe_execute", "description": "Safely verify dns.record.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.record.create", "type": "declared", "state": "declared", "description": "Discover declared support for dns.record.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2452", "external_name": "Dns Record Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.record.delete", "stable_id": "OSCO-CAP-0466", "name": "Delete Record", "description": "Perform delete operation on record in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.record.delete" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "record state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.record.delete", "type": "safe_execute", "description": "Safely verify dns.record.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.record.delete", "type": "declared", "state": "declared", "description": "Discover declared support for dns.record.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2454", "external_name": "Dns Record Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.record.monitor", "stable_id": "OSCO-CAP-0467", "name": "Monitor Record", "description": "Perform monitor operation on record in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.record.monitor" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "record state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.record.monitor", "type": "safe_execute", "description": "Safely verify dns.record.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.record.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for dns.record.monitor" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2455", "external_name": "Dns Record Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.record.query", "stable_id": "OSCO-CAP-0463", "name": "Query Record", "description": "Perform query operation on record in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.record.query" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "record state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.record.query", "type": "safe_execute", "description": "Safely verify dns.record.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.record.query", "type": "declared", "state": "declared", "description": "Discover declared support for dns.record.query" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2451", "external_name": "Dns Record Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.record.update", "stable_id": "OSCO-CAP-0465", "name": "Update Record", "description": "Perform update operation on record in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.record.update" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "record state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.record.update", "type": "safe_execute", "description": "Safely verify dns.record.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.record.update", "type": "declared", "state": "declared", "description": "Discover declared support for dns.record.update" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2453", "external_name": "Dns Record Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.resolver.create", "stable_id": "OSCO-CAP-0474", "name": "Create Resolver", "description": "Perform create operation on resolver in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.resolver.create" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "resolver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.resolver.create", "type": "safe_execute", "description": "Safely verify dns.resolver.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.resolver.create", "type": "declared", "state": "declared", "description": "Discover declared support for dns.resolver.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2462", "external_name": "Dns Resolver Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.resolver.delete", "stable_id": "OSCO-CAP-0476", "name": "Delete Resolver", "description": "Perform delete operation on resolver in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.resolver.delete" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "resolver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.resolver.delete", "type": "safe_execute", "description": "Safely verify dns.resolver.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.resolver.delete", "type": "declared", "state": "declared", "description": "Discover declared support for dns.resolver.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2464", "external_name": "Dns Resolver Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.resolver.monitor", "stable_id": "OSCO-CAP-0477", "name": "Monitor Resolver", "description": "Perform monitor operation on resolver in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.resolver.monitor" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "resolver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.resolver.monitor", "type": "safe_execute", "description": "Safely verify dns.resolver.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.resolver.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for dns.resolver.monitor" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2465", "external_name": "Dns Resolver Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.resolver.query", "stable_id": "OSCO-CAP-0473", "name": "Query Resolver", "description": "Perform query operation on resolver in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.resolver.query" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "resolver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.resolver.query", "type": "safe_execute", "description": "Safely verify dns.resolver.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.resolver.query", "type": "declared", "state": "declared", "description": "Discover declared support for dns.resolver.query" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2461", "external_name": "Dns Resolver Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.resolver.update", "stable_id": "OSCO-CAP-0475", "name": "Update Resolver", "description": "Perform update operation on resolver in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.resolver.update" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "resolver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.resolver.update", "type": "safe_execute", "description": "Safely verify dns.resolver.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.resolver.update", "type": "declared", "state": "declared", "description": "Discover declared support for dns.resolver.update" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2463", "external_name": "Dns Resolver Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.zone.create", "stable_id": "OSCO-CAP-0469", "name": "Create Zone", "description": "Perform create operation on zone in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.zone.create" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "zone state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.zone.create", "type": "safe_execute", "description": "Safely verify dns.zone.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.zone.create", "type": "declared", "state": "declared", "description": "Discover declared support for dns.zone.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2457", "external_name": "Dns Zone Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.zone.delete", "stable_id": "OSCO-CAP-0471", "name": "Delete Zone", "description": "Perform delete operation on zone in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.zone.delete" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "zone state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.zone.delete", "type": "safe_execute", "description": "Safely verify dns.zone.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.zone.delete", "type": "declared", "state": "declared", "description": "Discover declared support for dns.zone.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2459", "external_name": "Dns Zone Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.zone.monitor", "stable_id": "OSCO-CAP-0472", "name": "Monitor Zone", "description": "Perform monitor operation on zone in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.zone.monitor" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "zone state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.zone.monitor", "type": "safe_execute", "description": "Safely verify dns.zone.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.zone.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for dns.zone.monitor" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2460", "external_name": "Dns Zone Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.zone.query", "stable_id": "OSCO-CAP-0468", "name": "Query Zone", "description": "Perform query operation on zone in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.zone.query" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "zone state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.zone.query", "type": "safe_execute", "description": "Safely verify dns.zone.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.zone.query", "type": "declared", "state": "declared", "description": "Discover declared support for dns.zone.query" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2456", "external_name": "Dns Zone Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "dns.zone.update", "stable_id": "OSCO-CAP-0470", "name": "Update Zone", "description": "Perform update operation on zone in the dns domain.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "dns.zone.update" ], "preconditions": [ "provider exposes dns capability surface" ], "postconditions": [ "zone state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.dns.zone.update", "type": "safe_execute", "description": "Safely verify dns.zone.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.dns.zone.update", "type": "declared", "state": "declared", "description": "Discover declared support for dns.zone.update" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2458", "external_name": "Dns Zone Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver.install", "stable_id": "OSCO-CAP-0166", "name": "Install Driver", "description": "Perform install operation on driver in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver.install" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver.install", "type": "safe_execute", "description": "Safely verify driver.driver.install with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver.install", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver.install" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2154", "external_name": "Driver Driver Install", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver.load", "stable_id": "OSCO-CAP-0164", "name": "Load Driver", "description": "Perform load operation on driver in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver.load" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver.load", "type": "safe_execute", "description": "Safely verify driver.driver.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver.load", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver.load" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2152", "external_name": "Driver Driver Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver.query", "stable_id": "OSCO-CAP-0167", "name": "Query Driver", "description": "Perform query operation on driver in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver.query" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver.query", "type": "safe_execute", "description": "Safely verify driver.driver.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver.query", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver.query" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2155", "external_name": "Driver Driver Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver.unload", "stable_id": "OSCO-CAP-0165", "name": "Unload Driver", "description": "Perform unload operation on driver in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver.unload" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver.unload", "type": "safe_execute", "description": "Safely verify driver.driver.unload with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver.unload", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver.unload" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2153", "external_name": "Driver Driver Unload", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver.verify", "stable_id": "OSCO-CAP-0168", "name": "Verify Driver", "description": "Perform verify operation on driver in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver.verify" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver.verify", "type": "safe_execute", "description": "Safely verify driver.driver.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver.verify", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver.verify" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2156", "external_name": "Driver Driver Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_service.install", "stable_id": "OSCO-CAP-0171", "name": "Install Driver Service", "description": "Perform install operation on driver service in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_service.install" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_service.install", "type": "safe_execute", "description": "Safely verify driver.driver_service.install with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_service.install", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_service.install" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2159", "external_name": "Driver Driver Service Install", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_service.load", "stable_id": "OSCO-CAP-0169", "name": "Load Driver Service", "description": "Perform load operation on driver service in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_service.load" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_service.load", "type": "safe_execute", "description": "Safely verify driver.driver_service.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_service.load", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_service.load" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2157", "external_name": "Driver Driver Service Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_service.query", "stable_id": "OSCO-CAP-0172", "name": "Query Driver Service", "description": "Perform query operation on driver service in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_service.query" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_service.query", "type": "safe_execute", "description": "Safely verify driver.driver_service.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_service.query", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_service.query" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2160", "external_name": "Driver Driver Service Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_service.unload", "stable_id": "OSCO-CAP-0170", "name": "Unload Driver Service", "description": "Perform unload operation on driver service in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_service.unload" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_service.unload", "type": "safe_execute", "description": "Safely verify driver.driver_service.unload with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_service.unload", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_service.unload" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2158", "external_name": "Driver Driver Service Unload", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_service.verify", "stable_id": "OSCO-CAP-0173", "name": "Verify Driver Service", "description": "Perform verify operation on driver service in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_service.verify" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_service.verify", "type": "safe_execute", "description": "Safely verify driver.driver_service.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_service.verify", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_service.verify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2161", "external_name": "Driver Driver Service Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_signature.install", "stable_id": "OSCO-CAP-0176", "name": "Install Driver Signature", "description": "Perform install operation on driver signature in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_signature.install" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver signature state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_signature.install", "type": "safe_execute", "description": "Safely verify driver.driver_signature.install with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_signature.install", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_signature.install" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2164", "external_name": "Driver Driver Signature Install", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_signature.load", "stable_id": "OSCO-CAP-0174", "name": "Load Driver Signature", "description": "Perform load operation on driver signature in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_signature.load" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver signature state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_signature.load", "type": "safe_execute", "description": "Safely verify driver.driver_signature.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_signature.load", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_signature.load" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2162", "external_name": "Driver Driver Signature Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_signature.query", "stable_id": "OSCO-CAP-0177", "name": "Query Driver Signature", "description": "Perform query operation on driver signature in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_signature.query" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver signature state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_signature.query", "type": "safe_execute", "description": "Safely verify driver.driver_signature.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_signature.query", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_signature.query" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2165", "external_name": "Driver Driver Signature Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_signature.unload", "stable_id": "OSCO-CAP-0175", "name": "Unload Driver Signature", "description": "Perform unload operation on driver signature in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_signature.unload" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver signature state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_signature.unload", "type": "safe_execute", "description": "Safely verify driver.driver_signature.unload with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_signature.unload", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_signature.unload" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2163", "external_name": "Driver Driver Signature Unload", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "driver.driver_signature.verify", "stable_id": "OSCO-CAP-0178", "name": "Verify Driver Signature", "description": "Perform verify operation on driver signature in the driver domain.", "category": "endpoint", "domain": "driver", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "driver.driver_signature.verify" ], "preconditions": [ "provider exposes driver capability surface" ], "postconditions": [ "driver signature state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.driver.driver_signature.verify", "type": "safe_execute", "description": "Safely verify driver.driver_signature.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.driver.driver_signature.verify", "type": "declared", "state": "declared", "description": "Discover declared support for driver.driver_signature.verify" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2166", "external_name": "Driver Driver Signature Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.forwarding.audit", "stable_id": "OSCO-CAP-0751", "name": "Audit Forwarding", "description": "Perform audit operation on forwarding in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.forwarding.audit" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "forwarding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.forwarding.audit", "type": "safe_execute", "description": "Safely verify email.forwarding.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.forwarding.audit", "type": "declared", "state": "declared", "description": "Discover declared support for email.forwarding.audit" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2739", "external_name": "Email Forwarding Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.forwarding.create", "stable_id": "OSCO-CAP-0747", "name": "Create Forwarding", "description": "Perform create operation on forwarding in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.forwarding.create" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "forwarding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.forwarding.create", "type": "safe_execute", "description": "Safely verify email.forwarding.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.forwarding.create", "type": "declared", "state": "declared", "description": "Discover declared support for email.forwarding.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2735", "external_name": "Email Forwarding Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.forwarding.delete", "stable_id": "OSCO-CAP-0750", "name": "Delete Forwarding", "description": "Perform delete operation on forwarding in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.forwarding.delete" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "forwarding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.forwarding.delete", "type": "safe_execute", "description": "Safely verify email.forwarding.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.forwarding.delete", "type": "declared", "state": "declared", "description": "Discover declared support for email.forwarding.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2738", "external_name": "Email Forwarding Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.forwarding.read", "stable_id": "OSCO-CAP-0748", "name": "Read Forwarding", "description": "Perform read operation on forwarding in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.forwarding.read" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "forwarding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.forwarding.read", "type": "safe_execute", "description": "Safely verify email.forwarding.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.forwarding.read", "type": "declared", "state": "declared", "description": "Discover declared support for email.forwarding.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2736", "external_name": "Email Forwarding Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.forwarding.update", "stable_id": "OSCO-CAP-0749", "name": "Update Forwarding", "description": "Perform update operation on forwarding in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.forwarding.update" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "forwarding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.forwarding.update", "type": "safe_execute", "description": "Safely verify email.forwarding.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.forwarding.update", "type": "declared", "state": "declared", "description": "Discover declared support for email.forwarding.update" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2737", "external_name": "Email Forwarding Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.mailbox.audit", "stable_id": "OSCO-CAP-0761", "name": "Audit Mailbox", "description": "Perform audit operation on mailbox in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.mailbox.audit" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "mailbox state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.mailbox.audit", "type": "safe_execute", "description": "Safely verify email.mailbox.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.mailbox.audit", "type": "declared", "state": "declared", "description": "Discover declared support for email.mailbox.audit" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2749", "external_name": "Email Mailbox Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.mailbox.create", "stable_id": "OSCO-CAP-0757", "name": "Create Mailbox", "description": "Perform create operation on mailbox in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.mailbox.create" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "mailbox state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.mailbox.create", "type": "safe_execute", "description": "Safely verify email.mailbox.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.mailbox.create", "type": "declared", "state": "declared", "description": "Discover declared support for email.mailbox.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2745", "external_name": "Email Mailbox Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.mailbox.delete", "stable_id": "OSCO-CAP-0760", "name": "Delete Mailbox", "description": "Perform delete operation on mailbox in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.mailbox.delete" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "mailbox state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.mailbox.delete", "type": "safe_execute", "description": "Safely verify email.mailbox.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.mailbox.delete", "type": "declared", "state": "declared", "description": "Discover declared support for email.mailbox.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2748", "external_name": "Email Mailbox Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.mailbox.read", "stable_id": "OSCO-CAP-0758", "name": "Read Mailbox", "description": "Perform read operation on mailbox in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.mailbox.read" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "mailbox state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.mailbox.read", "type": "safe_execute", "description": "Safely verify email.mailbox.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.mailbox.read", "type": "declared", "state": "declared", "description": "Discover declared support for email.mailbox.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2746", "external_name": "Email Mailbox Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.mailbox.update", "stable_id": "OSCO-CAP-0759", "name": "Update Mailbox", "description": "Perform update operation on mailbox in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.mailbox.update" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "mailbox state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.mailbox.update", "type": "safe_execute", "description": "Safely verify email.mailbox.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.mailbox.update", "type": "declared", "state": "declared", "description": "Discover declared support for email.mailbox.update" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2747", "external_name": "Email Mailbox Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.rule.audit", "stable_id": "OSCO-CAP-0756", "name": "Audit Rule", "description": "Perform audit operation on rule in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.rule.audit" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.rule.audit", "type": "safe_execute", "description": "Safely verify email.rule.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.rule.audit", "type": "declared", "state": "declared", "description": "Discover declared support for email.rule.audit" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2744", "external_name": "Email Rule Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.rule.create", "stable_id": "OSCO-CAP-0752", "name": "Create Rule", "description": "Perform create operation on rule in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.rule.create" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.rule.create", "type": "safe_execute", "description": "Safely verify email.rule.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.rule.create", "type": "declared", "state": "declared", "description": "Discover declared support for email.rule.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2740", "external_name": "Email Rule Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.rule.delete", "stable_id": "OSCO-CAP-0755", "name": "Delete Rule", "description": "Perform delete operation on rule in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.rule.delete" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.rule.delete", "type": "safe_execute", "description": "Safely verify email.rule.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.rule.delete", "type": "declared", "state": "declared", "description": "Discover declared support for email.rule.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2743", "external_name": "Email Rule Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.rule.read", "stable_id": "OSCO-CAP-0753", "name": "Read Rule", "description": "Perform read operation on rule in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.rule.read" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.rule.read", "type": "safe_execute", "description": "Safely verify email.rule.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.rule.read", "type": "declared", "state": "declared", "description": "Discover declared support for email.rule.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2741", "external_name": "Email Rule Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.rule.update", "stable_id": "OSCO-CAP-0754", "name": "Update Rule", "description": "Perform update operation on rule in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.rule.update" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.rule.update", "type": "safe_execute", "description": "Safely verify email.rule.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.rule.update", "type": "declared", "state": "declared", "description": "Discover declared support for email.rule.update" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2742", "external_name": "Email Rule Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.transport.audit", "stable_id": "OSCO-CAP-0766", "name": "Audit Transport", "description": "Perform audit operation on transport in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.transport.audit" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "transport state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.transport.audit", "type": "safe_execute", "description": "Safely verify email.transport.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.transport.audit", "type": "declared", "state": "declared", "description": "Discover declared support for email.transport.audit" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2754", "external_name": "Email Transport Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.transport.create", "stable_id": "OSCO-CAP-0762", "name": "Create Transport", "description": "Perform create operation on transport in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.transport.create" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "transport state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.transport.create", "type": "safe_execute", "description": "Safely verify email.transport.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.transport.create", "type": "declared", "state": "declared", "description": "Discover declared support for email.transport.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2750", "external_name": "Email Transport Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.transport.delete", "stable_id": "OSCO-CAP-0765", "name": "Delete Transport", "description": "Perform delete operation on transport in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.transport.delete" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "transport state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.transport.delete", "type": "safe_execute", "description": "Safely verify email.transport.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.transport.delete", "type": "declared", "state": "declared", "description": "Discover declared support for email.transport.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2753", "external_name": "Email Transport Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.transport.read", "stable_id": "OSCO-CAP-0763", "name": "Read Transport", "description": "Perform read operation on transport in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.transport.read" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "transport state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.transport.read", "type": "safe_execute", "description": "Safely verify email.transport.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.transport.read", "type": "declared", "state": "declared", "description": "Discover declared support for email.transport.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2751", "external_name": "Email Transport Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "email.transport.update", "stable_id": "OSCO-CAP-0764", "name": "Update Transport", "description": "Perform update operation on transport in the email domain.", "category": "saas", "domain": "email", "platforms": [ "saas", "cloud" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "email.transport.update" ], "preconditions": [ "provider exposes email capability surface" ], "postconditions": [ "transport state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.email.transport.update", "type": "safe_execute", "description": "Safely verify email.transport.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.email.transport.update", "type": "declared", "state": "declared", "description": "Discover declared support for email.transport.update" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2752", "external_name": "Email Transport Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.context.annotate", "stable_id": "OSCO-CAP-0949", "name": "Annotate Context", "description": "Perform annotate operation on context in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.context.annotate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.context.annotate", "type": "safe_execute", "description": "Safely verify enrichment.context.annotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.context.annotate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.context.annotate" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2937", "external_name": "Enrichment Context Annotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.context.correlate", "stable_id": "OSCO-CAP-0947", "name": "Correlate Context", "description": "Perform correlate operation on context in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.context.correlate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.context.correlate", "type": "safe_execute", "description": "Safely verify enrichment.context.correlate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.context.correlate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.context.correlate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2935", "external_name": "Enrichment Context Correlate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.context.lookup", "stable_id": "OSCO-CAP-0946", "name": "Lookup Context", "description": "Perform lookup operation on context in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.context.lookup" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.context.lookup", "type": "safe_execute", "description": "Safely verify enrichment.context.lookup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.context.lookup", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.context.lookup" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2934", "external_name": "Enrichment Context Lookup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.context.publish", "stable_id": "OSCO-CAP-0950", "name": "Publish Context", "description": "Perform publish operation on context in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.context.publish" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.context.publish", "type": "safe_execute", "description": "Safely verify enrichment.context.publish with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.context.publish", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.context.publish" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2938", "external_name": "Enrichment Context Publish", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.context.score", "stable_id": "OSCO-CAP-0948", "name": "Score Context", "description": "Perform score operation on context in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.context.score" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.context.score", "type": "safe_execute", "description": "Safely verify enrichment.context.score with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.context.score", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.context.score" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2936", "external_name": "Enrichment Context Score", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.entity.annotate", "stable_id": "OSCO-CAP-0944", "name": "Annotate Entity", "description": "Perform annotate operation on entity in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.entity.annotate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "entity state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.entity.annotate", "type": "safe_execute", "description": "Safely verify enrichment.entity.annotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.entity.annotate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.entity.annotate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2932", "external_name": "Enrichment Entity Annotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.entity.correlate", "stable_id": "OSCO-CAP-0942", "name": "Correlate Entity", "description": "Perform correlate operation on entity in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.entity.correlate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "entity state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.entity.correlate", "type": "safe_execute", "description": "Safely verify enrichment.entity.correlate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.entity.correlate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.entity.correlate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2930", "external_name": "Enrichment Entity Correlate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.entity.lookup", "stable_id": "OSCO-CAP-0941", "name": "Lookup Entity", "description": "Perform lookup operation on entity in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.entity.lookup" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "entity state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.entity.lookup", "type": "safe_execute", "description": "Safely verify enrichment.entity.lookup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.entity.lookup", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.entity.lookup" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2929", "external_name": "Enrichment Entity Lookup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.entity.publish", "stable_id": "OSCO-CAP-0945", "name": "Publish Entity", "description": "Perform publish operation on entity in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.entity.publish" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "entity state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.entity.publish", "type": "safe_execute", "description": "Safely verify enrichment.entity.publish with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.entity.publish", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.entity.publish" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2933", "external_name": "Enrichment Entity Publish", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.entity.score", "stable_id": "OSCO-CAP-0943", "name": "Score Entity", "description": "Perform score operation on entity in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.entity.score" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "entity state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.entity.score", "type": "safe_execute", "description": "Safely verify enrichment.entity.score with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.entity.score", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.entity.score" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2931", "external_name": "Enrichment Entity Score", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.indicator.annotate", "stable_id": "OSCO-CAP-0939", "name": "Annotate Indicator", "description": "Perform annotate operation on indicator in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.indicator.annotate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "indicator state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.indicator.annotate", "type": "safe_execute", "description": "Safely verify enrichment.indicator.annotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.indicator.annotate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.indicator.annotate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2927", "external_name": "Enrichment Indicator Annotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.indicator.correlate", "stable_id": "OSCO-CAP-0937", "name": "Correlate Indicator", "description": "Perform correlate operation on indicator in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.indicator.correlate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "indicator state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.indicator.correlate", "type": "safe_execute", "description": "Safely verify enrichment.indicator.correlate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.indicator.correlate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.indicator.correlate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2925", "external_name": "Enrichment Indicator Correlate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.indicator.lookup", "stable_id": "OSCO-CAP-0936", "name": "Lookup Indicator", "description": "Perform lookup operation on indicator in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.indicator.lookup" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "indicator state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.indicator.lookup", "type": "safe_execute", "description": "Safely verify enrichment.indicator.lookup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.indicator.lookup", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.indicator.lookup" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2924", "external_name": "Enrichment Indicator Lookup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.indicator.publish", "stable_id": "OSCO-CAP-0940", "name": "Publish Indicator", "description": "Perform publish operation on indicator in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.indicator.publish" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "indicator state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.indicator.publish", "type": "safe_execute", "description": "Safely verify enrichment.indicator.publish with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.indicator.publish", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.indicator.publish" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2928", "external_name": "Enrichment Indicator Publish", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.indicator.score", "stable_id": "OSCO-CAP-0938", "name": "Score Indicator", "description": "Perform score operation on indicator in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.indicator.score" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "indicator state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.indicator.score", "type": "safe_execute", "description": "Safely verify enrichment.indicator.score with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.indicator.score", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.indicator.score" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2926", "external_name": "Enrichment Indicator Score", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.risk.annotate", "stable_id": "OSCO-CAP-0954", "name": "Annotate Risk", "description": "Perform annotate operation on risk in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.risk.annotate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "risk state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.risk.annotate", "type": "safe_execute", "description": "Safely verify enrichment.risk.annotate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.risk.annotate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.risk.annotate" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2942", "external_name": "Enrichment Risk Annotate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.risk.correlate", "stable_id": "OSCO-CAP-0952", "name": "Correlate Risk", "description": "Perform correlate operation on risk in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.risk.correlate" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "risk state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.risk.correlate", "type": "safe_execute", "description": "Safely verify enrichment.risk.correlate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.risk.correlate", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.risk.correlate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2940", "external_name": "Enrichment Risk Correlate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.risk.lookup", "stable_id": "OSCO-CAP-0951", "name": "Lookup Risk", "description": "Perform lookup operation on risk in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.risk.lookup" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "risk state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.risk.lookup", "type": "safe_execute", "description": "Safely verify enrichment.risk.lookup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.risk.lookup", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.risk.lookup" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2939", "external_name": "Enrichment Risk Lookup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.risk.publish", "stable_id": "OSCO-CAP-0955", "name": "Publish Risk", "description": "Perform publish operation on risk in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.risk.publish" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "risk state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.risk.publish", "type": "safe_execute", "description": "Safely verify enrichment.risk.publish with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.risk.publish", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.risk.publish" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2943", "external_name": "Enrichment Risk Publish", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "enrichment.risk.score", "stable_id": "OSCO-CAP-0953", "name": "Score Risk", "description": "Perform score operation on risk in the enrichment domain.", "category": "enrichment", "domain": "enrichment", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "enrichment.risk.score" ], "preconditions": [ "provider exposes enrichment capability surface" ], "postconditions": [ "risk state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.enrichment.risk.score", "type": "safe_execute", "description": "Safely verify enrichment.risk.score with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.enrichment.risk.score", "type": "declared", "state": "declared", "description": "Discover declared support for enrichment.risk.score" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2941", "external_name": "Enrichment Risk Score", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.consumer.emit", "stable_id": "OSCO-CAP-0316", "name": "Emit Consumer", "description": "Perform emit operation on consumer in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.consumer.emit" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "consumer state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.consumer.emit", "type": "safe_execute", "description": "Safely verify etw.consumer.emit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.consumer.emit", "type": "declared", "state": "declared", "description": "Discover declared support for etw.consumer.emit" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2304", "external_name": "Etw Consumer Emit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.consumer.parse", "stable_id": "OSCO-CAP-0317", "name": "Parse Consumer", "description": "Perform parse operation on consumer in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.consumer.parse" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "consumer state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.consumer.parse", "type": "safe_execute", "description": "Safely verify etw.consumer.parse with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.consumer.parse", "type": "declared", "state": "declared", "description": "Discover declared support for etw.consumer.parse" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2305", "external_name": "Etw Consumer Parse", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.consumer.start", "stable_id": "OSCO-CAP-0313", "name": "Start Consumer", "description": "Perform start operation on consumer in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.consumer.start" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "consumer state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.consumer.start", "type": "safe_execute", "description": "Safely verify etw.consumer.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.consumer.start", "type": "declared", "state": "declared", "description": "Discover declared support for etw.consumer.start" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2301", "external_name": "Etw Consumer Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.consumer.stop", "stable_id": "OSCO-CAP-0314", "name": "Stop Consumer", "description": "Perform stop operation on consumer in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.consumer.stop" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "consumer state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.consumer.stop", "type": "safe_execute", "description": "Safely verify etw.consumer.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.consumer.stop", "type": "declared", "state": "declared", "description": "Discover declared support for etw.consumer.stop" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2302", "external_name": "Etw Consumer Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.consumer.subscribe", "stable_id": "OSCO-CAP-0315", "name": "Subscribe Consumer", "description": "Perform subscribe operation on consumer in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.consumer.subscribe" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "consumer state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.consumer.subscribe", "type": "safe_execute", "description": "Safely verify etw.consumer.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.consumer.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for etw.consumer.subscribe" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2303", "external_name": "Etw Consumer Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.provider.emit", "stable_id": "OSCO-CAP-0306", "name": "Emit Provider", "description": "Perform emit operation on provider in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.provider.emit" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "provider state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.provider.emit", "type": "safe_execute", "description": "Safely verify etw.provider.emit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.provider.emit", "type": "declared", "state": "declared", "description": "Discover declared support for etw.provider.emit" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2294", "external_name": "Etw Provider Emit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.provider.parse", "stable_id": "OSCO-CAP-0307", "name": "Parse Provider", "description": "Perform parse operation on provider in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.provider.parse" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "provider state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.provider.parse", "type": "safe_execute", "description": "Safely verify etw.provider.parse with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.provider.parse", "type": "declared", "state": "declared", "description": "Discover declared support for etw.provider.parse" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2295", "external_name": "Etw Provider Parse", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.provider.start", "stable_id": "OSCO-CAP-0303", "name": "Start Provider", "description": "Perform start operation on provider in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.provider.start" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "provider state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.provider.start", "type": "safe_execute", "description": "Safely verify etw.provider.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.provider.start", "type": "declared", "state": "declared", "description": "Discover declared support for etw.provider.start" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2291", "external_name": "Etw Provider Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.provider.stop", "stable_id": "OSCO-CAP-0304", "name": "Stop Provider", "description": "Perform stop operation on provider in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.provider.stop" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "provider state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.provider.stop", "type": "safe_execute", "description": "Safely verify etw.provider.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.provider.stop", "type": "declared", "state": "declared", "description": "Discover declared support for etw.provider.stop" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2292", "external_name": "Etw Provider Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.provider.subscribe", "stable_id": "OSCO-CAP-0305", "name": "Subscribe Provider", "description": "Perform subscribe operation on provider in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.provider.subscribe" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "provider state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.provider.subscribe", "type": "safe_execute", "description": "Safely verify etw.provider.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.provider.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for etw.provider.subscribe" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2293", "external_name": "Etw Provider Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.session.emit", "stable_id": "OSCO-CAP-0311", "name": "Emit Session", "description": "Perform emit operation on session in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.session.emit" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.session.emit", "type": "safe_execute", "description": "Safely verify etw.session.emit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.session.emit", "type": "declared", "state": "declared", "description": "Discover declared support for etw.session.emit" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2299", "external_name": "Etw Session Emit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.session.parse", "stable_id": "OSCO-CAP-0312", "name": "Parse Session", "description": "Perform parse operation on session in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.session.parse" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.session.parse", "type": "safe_execute", "description": "Safely verify etw.session.parse with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.session.parse", "type": "declared", "state": "declared", "description": "Discover declared support for etw.session.parse" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2300", "external_name": "Etw Session Parse", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.session.start", "stable_id": "OSCO-CAP-0308", "name": "Start Session", "description": "Perform start operation on session in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.session.start" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.session.start", "type": "safe_execute", "description": "Safely verify etw.session.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.session.start", "type": "declared", "state": "declared", "description": "Discover declared support for etw.session.start" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2296", "external_name": "Etw Session Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.session.stop", "stable_id": "OSCO-CAP-0309", "name": "Stop Session", "description": "Perform stop operation on session in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.session.stop" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.session.stop", "type": "safe_execute", "description": "Safely verify etw.session.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.session.stop", "type": "declared", "state": "declared", "description": "Discover declared support for etw.session.stop" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2297", "external_name": "Etw Session Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.session.subscribe", "stable_id": "OSCO-CAP-0310", "name": "Subscribe Session", "description": "Perform subscribe operation on session in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.session.subscribe" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.session.subscribe", "type": "safe_execute", "description": "Safely verify etw.session.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.session.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for etw.session.subscribe" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2298", "external_name": "Etw Session Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.trace.emit", "stable_id": "OSCO-CAP-0321", "name": "Emit Trace", "description": "Perform emit operation on trace in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.trace.emit" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "trace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.trace.emit", "type": "safe_execute", "description": "Safely verify etw.trace.emit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.trace.emit", "type": "declared", "state": "declared", "description": "Discover declared support for etw.trace.emit" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2309", "external_name": "Etw Trace Emit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.trace.parse", "stable_id": "OSCO-CAP-0322", "name": "Parse Trace", "description": "Perform parse operation on trace in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.trace.parse" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "trace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.trace.parse", "type": "safe_execute", "description": "Safely verify etw.trace.parse with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.trace.parse", "type": "declared", "state": "declared", "description": "Discover declared support for etw.trace.parse" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2310", "external_name": "Etw Trace Parse", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.trace.start", "stable_id": "OSCO-CAP-0318", "name": "Start Trace", "description": "Perform start operation on trace in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.trace.start" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "trace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.trace.start", "type": "safe_execute", "description": "Safely verify etw.trace.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.trace.start", "type": "declared", "state": "declared", "description": "Discover declared support for etw.trace.start" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2306", "external_name": "Etw Trace Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.trace.stop", "stable_id": "OSCO-CAP-0319", "name": "Stop Trace", "description": "Perform stop operation on trace in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.trace.stop" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "trace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.trace.stop", "type": "safe_execute", "description": "Safely verify etw.trace.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.trace.stop", "type": "declared", "state": "declared", "description": "Discover declared support for etw.trace.stop" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2307", "external_name": "Etw Trace Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "etw.trace.subscribe", "stable_id": "OSCO-CAP-0320", "name": "Subscribe Trace", "description": "Perform subscribe operation on trace in the etw domain.", "category": "telemetry", "domain": "etw", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "etw.trace.subscribe" ], "preconditions": [ "provider exposes etw capability surface" ], "postconditions": [ "trace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.etw.trace.subscribe", "type": "safe_execute", "description": "Safely verify etw.trace.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.etw.trace.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for etw.trace.subscribe" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2308", "external_name": "Etw Trace Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.channel.clear", "stable_id": "OSCO-CAP-0265", "name": "Clear Channel", "description": "Perform clear operation on channel in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.channel.clear" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.channel.clear", "type": "safe_execute", "description": "Safely verify eventlog.channel.clear with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.channel.clear", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.channel.clear" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2253", "external_name": "Eventlog Channel Clear", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.channel.configure", "stable_id": "OSCO-CAP-0267", "name": "Configure Channel", "description": "Perform configure operation on channel in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.channel.configure" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.channel.configure", "type": "safe_execute", "description": "Safely verify eventlog.channel.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.channel.configure", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.channel.configure" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2255", "external_name": "Eventlog Channel Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.channel.export", "stable_id": "OSCO-CAP-0266", "name": "Export Channel", "description": "Perform export operation on channel in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.channel.export" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.channel.export", "type": "safe_execute", "description": "Safely verify eventlog.channel.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.channel.export", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.channel.export" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2254", "external_name": "Eventlog Channel Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.channel.read", "stable_id": "OSCO-CAP-0263", "name": "Read Channel", "description": "Perform read operation on channel in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.channel.read" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.channel.read", "type": "safe_execute", "description": "Safely verify eventlog.channel.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.channel.read", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.channel.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2251", "external_name": "Eventlog Channel Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.channel.write", "stable_id": "OSCO-CAP-0264", "name": "Write Channel", "description": "Perform write operation on channel in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.channel.write" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "channel state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.channel.write", "type": "safe_execute", "description": "Safely verify eventlog.channel.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.channel.write", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.channel.write" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2252", "external_name": "Eventlog Channel Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.event.clear", "stable_id": "OSCO-CAP-0270", "name": "Clear Event", "description": "Perform clear operation on event in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.event.clear" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.event.clear", "type": "safe_execute", "description": "Safely verify eventlog.event.clear with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.event.clear", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.event.clear" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2258", "external_name": "Eventlog Event Clear", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.event.configure", "stable_id": "OSCO-CAP-0272", "name": "Configure Event", "description": "Perform configure operation on event in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.event.configure" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.event.configure", "type": "safe_execute", "description": "Safely verify eventlog.event.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.event.configure", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.event.configure" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2260", "external_name": "Eventlog Event Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.event.export", "stable_id": "OSCO-CAP-0271", "name": "Export Event", "description": "Perform export operation on event in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.event.export" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.event.export", "type": "safe_execute", "description": "Safely verify eventlog.event.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.event.export", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.event.export" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2259", "external_name": "Eventlog Event Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.event.read", "stable_id": "OSCO-CAP-0268", "name": "Read Event", "description": "Perform read operation on event in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.event.read" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.event.read", "type": "safe_execute", "description": "Safely verify eventlog.event.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.event.read", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.event.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2256", "external_name": "Eventlog Event Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.event.write", "stable_id": "OSCO-CAP-0269", "name": "Write Event", "description": "Perform write operation on event in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.event.write" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "event state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.event.write", "type": "safe_execute", "description": "Safely verify eventlog.event.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.event.write", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.event.write" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2257", "external_name": "Eventlog Event Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.retention.clear", "stable_id": "OSCO-CAP-0280", "name": "Clear Retention", "description": "Perform clear operation on retention in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.retention.clear" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.retention.clear", "type": "safe_execute", "description": "Safely verify eventlog.retention.clear with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.retention.clear", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.retention.clear" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2268", "external_name": "Eventlog Retention Clear", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.retention.configure", "stable_id": "OSCO-CAP-0282", "name": "Configure Retention", "description": "Perform configure operation on retention in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.retention.configure" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.retention.configure", "type": "safe_execute", "description": "Safely verify eventlog.retention.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.retention.configure", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.retention.configure" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2270", "external_name": "Eventlog Retention Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.retention.export", "stable_id": "OSCO-CAP-0281", "name": "Export Retention", "description": "Perform export operation on retention in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.retention.export" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.retention.export", "type": "safe_execute", "description": "Safely verify eventlog.retention.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.retention.export", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.retention.export" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2269", "external_name": "Eventlog Retention Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.retention.read", "stable_id": "OSCO-CAP-0278", "name": "Read Retention", "description": "Perform read operation on retention in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.retention.read" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.retention.read", "type": "safe_execute", "description": "Safely verify eventlog.retention.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.retention.read", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.retention.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2266", "external_name": "Eventlog Retention Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.retention.write", "stable_id": "OSCO-CAP-0279", "name": "Write Retention", "description": "Perform write operation on retention in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.retention.write" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "retention state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.retention.write", "type": "safe_execute", "description": "Safely verify eventlog.retention.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.retention.write", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.retention.write" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2267", "external_name": "Eventlog Retention Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.subscription.clear", "stable_id": "OSCO-CAP-0275", "name": "Clear Subscription", "description": "Perform clear operation on subscription in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.subscription.clear" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.subscription.clear", "type": "safe_execute", "description": "Safely verify eventlog.subscription.clear with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.subscription.clear", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.subscription.clear" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2263", "external_name": "Eventlog Subscription Clear", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.subscription.configure", "stable_id": "OSCO-CAP-0277", "name": "Configure Subscription", "description": "Perform configure operation on subscription in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.subscription.configure" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.subscription.configure", "type": "safe_execute", "description": "Safely verify eventlog.subscription.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.subscription.configure", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.subscription.configure" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2265", "external_name": "Eventlog Subscription Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.subscription.export", "stable_id": "OSCO-CAP-0276", "name": "Export Subscription", "description": "Perform export operation on subscription in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.subscription.export" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.subscription.export", "type": "safe_execute", "description": "Safely verify eventlog.subscription.export with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.subscription.export", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.subscription.export" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2264", "external_name": "Eventlog Subscription Export", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.subscription.read", "stable_id": "OSCO-CAP-0273", "name": "Read Subscription", "description": "Perform read operation on subscription in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.subscription.read" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.subscription.read", "type": "safe_execute", "description": "Safely verify eventlog.subscription.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.subscription.read", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.subscription.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2261", "external_name": "Eventlog Subscription Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "eventlog.subscription.write", "stable_id": "OSCO-CAP-0274", "name": "Write Subscription", "description": "Perform write operation on subscription in the eventlog domain.", "category": "telemetry", "domain": "eventlog", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "eventlog.subscription.write" ], "preconditions": [ "provider exposes eventlog capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.eventlog.subscription.write", "type": "safe_execute", "description": "Safely verify eventlog.subscription.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.eventlog.subscription.write", "type": "declared", "state": "declared", "description": "Discover declared support for eventlog.subscription.write" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2262", "external_name": "Eventlog Subscription Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.directory.create", "stable_id": "OSCO-CAP-0018", "name": "Create Directory", "description": "Perform create operation on directory in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.directory.create" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "directory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.directory.create", "type": "safe_execute", "description": "Safely verify filesystem.directory.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.directory.create", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.directory.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2006", "external_name": "Filesystem Directory Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.directory.delete", "stable_id": "OSCO-CAP-0021", "name": "Delete Directory", "description": "Perform delete operation on directory in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.directory.delete" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "directory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.directory.delete", "type": "safe_execute", "description": "Safely verify filesystem.directory.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.directory.delete", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.directory.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2009", "external_name": "Filesystem Directory Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.directory.hash", "stable_id": "OSCO-CAP-0023", "name": "Hash Directory", "description": "Perform hash operation on directory in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.directory.hash" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "directory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.directory.hash", "type": "safe_execute", "description": "Safely verify filesystem.directory.hash with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.directory.hash", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.directory.hash" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2011", "external_name": "Filesystem Directory Hash", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.directory.list", "stable_id": "OSCO-CAP-0022", "name": "List Directory", "description": "Perform list operation on directory in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.directory.list" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "directory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.directory.list", "type": "safe_execute", "description": "Safely verify filesystem.directory.list with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.directory.list", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.directory.list" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2010", "external_name": "Filesystem Directory List", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.directory.modify", "stable_id": "OSCO-CAP-0020", "name": "Modify Directory", "description": "Perform modify operation on directory in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.directory.modify" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "directory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.directory.modify", "type": "safe_execute", "description": "Safely verify filesystem.directory.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.directory.modify", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.directory.modify" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2008", "external_name": "Filesystem Directory Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.directory.read", "stable_id": "OSCO-CAP-0019", "name": "Read Directory", "description": "Perform read operation on directory in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.directory.read" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "directory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.directory.read", "type": "safe_execute", "description": "Safely verify filesystem.directory.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.directory.read", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.directory.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2007", "external_name": "Filesystem Directory Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.file.create", "stable_id": "OSCO-CAP-0001", "name": "Create File", "description": "Create a file object at a target path.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.windows", "provider.linux", "provider.macos", "provider.docker" ], "status": "stable", "confidence": 0.95, "safety": "caution", "related_capabilities": [ "filesystem.file.modify", "filesystem.file.delete" ], "required_privileges": [ "write_path" ], "preconditions": [ "target path exists and is writable" ], "postconditions": [ "new file inode or equivalent exists" ], "inputs": [ "path", "content" ], "outputs": [ "created_file_path" ], "evidence": [ { "evidence_id": "ev.file.metadata", "type": "file", "description": "File metadata record with create timestamp" } ], "produced_telemetry": [ { "telemetry_id": "tm.sysmon.11", "source": "sysmon", "event_type": "FileCreate", "description": "Sysmon file creation event" } ], "verification_methods": [ { "method_id": "verify.tempfile", "type": "safe_execute", "description": "Create and remove temporary file in controlled path" } ], "discovery_methods": [ { "method_id": "discover.api.filesystem", "type": "declared", "state": "declared", "description": "Check provider API surface for file create primitives" } ], "execution_metadata": [ { "implementation_id": "impl.winapi.createfilew", "implementation_type": "native_api", "interface": "CreateFileW" }, { "implementation_id": "impl.posix.open", "implementation_type": "native_api", "interface": "open(O_CREAT)" } ], "references": [ "https://learn.microsoft.com/windows/win32/api/fileapi/nf-fileapi-createfilew" ], "mappings": [ { "framework": "mitre_attack", "external_id": "T1105", "external_name": "Ingress Tool Transfer", "relation": "related_to", "confidence": 0.55 }, { "framework": "ocsf", "external_id": "file_activity", "external_name": "File Activity", "confidence": 0.8 } ] }, { "capability_id": "filesystem.file.delete", "stable_id": "OSCO-CAP-0015", "name": "Delete File", "description": "Perform delete operation on file in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.file.delete" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.file.delete", "type": "safe_execute", "description": "Safely verify filesystem.file.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.file.delete", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.file.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2003", "external_name": "Filesystem File Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.file.hash", "stable_id": "OSCO-CAP-0017", "name": "Hash File", "description": "Perform hash operation on file in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.file.hash" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.file.hash", "type": "safe_execute", "description": "Safely verify filesystem.file.hash with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.file.hash", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.file.hash" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2005", "external_name": "Filesystem File Hash", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.file.list", "stable_id": "OSCO-CAP-0016", "name": "List File", "description": "Perform list operation on file in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.file.list" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.file.list", "type": "safe_execute", "description": "Safely verify filesystem.file.list with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.file.list", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.file.list" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2004", "external_name": "Filesystem File List", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.file.modify", "stable_id": "OSCO-CAP-0014", "name": "Modify File", "description": "Perform modify operation on file in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.file.modify" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.file.modify", "type": "safe_execute", "description": "Safely verify filesystem.file.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.file.modify", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.file.modify" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2002", "external_name": "Filesystem File Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.file.read", "stable_id": "OSCO-CAP-0013", "name": "Read File", "description": "Perform read operation on file in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.file.read" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.file.read", "type": "safe_execute", "description": "Safely verify filesystem.file.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.file.read", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.file.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2001", "external_name": "Filesystem File Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.link.create", "stable_id": "OSCO-CAP-0024", "name": "Create Link", "description": "Perform create operation on link in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.link.create" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "link state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.link.create", "type": "safe_execute", "description": "Safely verify filesystem.link.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.link.create", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.link.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2012", "external_name": "Filesystem Link Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.link.delete", "stable_id": "OSCO-CAP-0027", "name": "Delete Link", "description": "Perform delete operation on link in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.link.delete" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "link state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.link.delete", "type": "safe_execute", "description": "Safely verify filesystem.link.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.link.delete", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.link.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2015", "external_name": "Filesystem Link Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.link.hash", "stable_id": "OSCO-CAP-0029", "name": "Hash Link", "description": "Perform hash operation on link in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.link.hash" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "link state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.link.hash", "type": "safe_execute", "description": "Safely verify filesystem.link.hash with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.link.hash", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.link.hash" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2017", "external_name": "Filesystem Link Hash", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.link.list", "stable_id": "OSCO-CAP-0028", "name": "List Link", "description": "Perform list operation on link in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.link.list" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "link state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.link.list", "type": "safe_execute", "description": "Safely verify filesystem.link.list with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.link.list", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.link.list" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2016", "external_name": "Filesystem Link List", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.link.modify", "stable_id": "OSCO-CAP-0026", "name": "Modify Link", "description": "Perform modify operation on link in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.link.modify" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "link state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.link.modify", "type": "safe_execute", "description": "Safely verify filesystem.link.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.link.modify", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.link.modify" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2014", "external_name": "Filesystem Link Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.link.read", "stable_id": "OSCO-CAP-0025", "name": "Read Link", "description": "Perform read operation on link in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.link.read" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "link state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.link.read", "type": "safe_execute", "description": "Safely verify filesystem.link.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.link.read", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.link.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2013", "external_name": "Filesystem Link Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.metadata.create", "stable_id": "OSCO-CAP-0036", "name": "Create Metadata", "description": "Perform create operation on metadata in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.metadata.create" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "metadata state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.metadata.create", "type": "safe_execute", "description": "Safely verify filesystem.metadata.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.metadata.create", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.metadata.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2024", "external_name": "Filesystem Metadata Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.metadata.delete", "stable_id": "OSCO-CAP-0039", "name": "Delete Metadata", "description": "Perform delete operation on metadata in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.metadata.delete" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "metadata state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.metadata.delete", "type": "safe_execute", "description": "Safely verify filesystem.metadata.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.metadata.delete", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.metadata.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2027", "external_name": "Filesystem Metadata Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.metadata.hash", "stable_id": "OSCO-CAP-0041", "name": "Hash Metadata", "description": "Perform hash operation on metadata in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.metadata.hash" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "metadata state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.metadata.hash", "type": "safe_execute", "description": "Safely verify filesystem.metadata.hash with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.metadata.hash", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.metadata.hash" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2029", "external_name": "Filesystem Metadata Hash", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.metadata.list", "stable_id": "OSCO-CAP-0040", "name": "List Metadata", "description": "Perform list operation on metadata in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.metadata.list" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "metadata state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.metadata.list", "type": "safe_execute", "description": "Safely verify filesystem.metadata.list with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.metadata.list", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.metadata.list" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2028", "external_name": "Filesystem Metadata List", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.metadata.modify", "stable_id": "OSCO-CAP-0038", "name": "Modify Metadata", "description": "Perform modify operation on metadata in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.metadata.modify" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "metadata state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.metadata.modify", "type": "safe_execute", "description": "Safely verify filesystem.metadata.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.metadata.modify", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.metadata.modify" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2026", "external_name": "Filesystem Metadata Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.metadata.read", "stable_id": "OSCO-CAP-0037", "name": "Read Metadata", "description": "Perform read operation on metadata in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.metadata.read" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "metadata state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.metadata.read", "type": "safe_execute", "description": "Safely verify filesystem.metadata.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.metadata.read", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.metadata.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2025", "external_name": "Filesystem Metadata Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.permission.create", "stable_id": "OSCO-CAP-0030", "name": "Create Permission", "description": "Perform create operation on permission in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.permission.create" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.permission.create", "type": "safe_execute", "description": "Safely verify filesystem.permission.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.permission.create", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.permission.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2018", "external_name": "Filesystem Permission Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.permission.delete", "stable_id": "OSCO-CAP-0033", "name": "Delete Permission", "description": "Perform delete operation on permission in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.permission.delete" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.permission.delete", "type": "safe_execute", "description": "Safely verify filesystem.permission.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.permission.delete", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.permission.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2021", "external_name": "Filesystem Permission Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.permission.hash", "stable_id": "OSCO-CAP-0035", "name": "Hash Permission", "description": "Perform hash operation on permission in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.permission.hash" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.permission.hash", "type": "safe_execute", "description": "Safely verify filesystem.permission.hash with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.permission.hash", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.permission.hash" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2023", "external_name": "Filesystem Permission Hash", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.permission.list", "stable_id": "OSCO-CAP-0034", "name": "List Permission", "description": "Perform list operation on permission in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.permission.list" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.permission.list", "type": "safe_execute", "description": "Safely verify filesystem.permission.list with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.permission.list", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.permission.list" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2022", "external_name": "Filesystem Permission List", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.permission.modify", "stable_id": "OSCO-CAP-0032", "name": "Modify Permission", "description": "Perform modify operation on permission in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.permission.modify" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.permission.modify", "type": "safe_execute", "description": "Safely verify filesystem.permission.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.permission.modify", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.permission.modify" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2020", "external_name": "Filesystem Permission Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "filesystem.permission.read", "stable_id": "OSCO-CAP-0031", "name": "Read Permission", "description": "Perform read operation on permission in the filesystem domain.", "category": "endpoint", "domain": "filesystem", "platforms": [ "windows", "linux", "macos", "container" ], "providers": [ "provider.docker", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "filesystem.permission.read" ], "preconditions": [ "provider exposes filesystem capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.filesystem.permission.read", "type": "safe_execute", "description": "Safely verify filesystem.permission.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.filesystem.permission.read", "type": "declared", "state": "declared", "description": "Discover declared support for filesystem.permission.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2019", "external_name": "Filesystem Permission Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.exception.audit", "stable_id": "OSCO-CAP-0502", "name": "Audit Exception", "description": "Perform audit operation on exception in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.exception.audit" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "exception state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.exception.audit", "type": "safe_execute", "description": "Safely verify firewall.exception.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.exception.audit", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.exception.audit" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2490", "external_name": "Firewall Exception Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.exception.create", "stable_id": "OSCO-CAP-0498", "name": "Create Exception", "description": "Perform create operation on exception in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.exception.create" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "exception state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.exception.create", "type": "safe_execute", "description": "Safely verify firewall.exception.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.exception.create", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.exception.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2486", "external_name": "Firewall Exception Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.exception.delete", "stable_id": "OSCO-CAP-0499", "name": "Delete Exception", "description": "Perform delete operation on exception in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.exception.delete" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "exception state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.exception.delete", "type": "safe_execute", "description": "Safely verify firewall.exception.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.exception.delete", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.exception.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2487", "external_name": "Firewall Exception Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.exception.disable", "stable_id": "OSCO-CAP-0501", "name": "Disable Exception", "description": "Perform disable operation on exception in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.exception.disable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "exception state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.exception.disable", "type": "safe_execute", "description": "Safely verify firewall.exception.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.exception.disable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.exception.disable" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2489", "external_name": "Firewall Exception Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.exception.enable", "stable_id": "OSCO-CAP-0500", "name": "Enable Exception", "description": "Perform enable operation on exception in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.exception.enable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "exception state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.exception.enable", "type": "safe_execute", "description": "Safely verify firewall.exception.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.exception.enable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.exception.enable" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2488", "external_name": "Firewall Exception Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.policy.audit", "stable_id": "OSCO-CAP-0492", "name": "Audit Policy", "description": "Perform audit operation on policy in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.policy.audit" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.policy.audit", "type": "safe_execute", "description": "Safely verify firewall.policy.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.policy.audit", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.policy.audit" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2480", "external_name": "Firewall Policy Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.policy.create", "stable_id": "OSCO-CAP-0488", "name": "Create Policy", "description": "Perform create operation on policy in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.policy.create" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.policy.create", "type": "safe_execute", "description": "Safely verify firewall.policy.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.policy.create", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.policy.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2476", "external_name": "Firewall Policy Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.policy.delete", "stable_id": "OSCO-CAP-0489", "name": "Delete Policy", "description": "Perform delete operation on policy in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.policy.delete" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.policy.delete", "type": "safe_execute", "description": "Safely verify firewall.policy.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.policy.delete", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.policy.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2477", "external_name": "Firewall Policy Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.policy.disable", "stable_id": "OSCO-CAP-0491", "name": "Disable Policy", "description": "Perform disable operation on policy in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.policy.disable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.policy.disable", "type": "safe_execute", "description": "Safely verify firewall.policy.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.policy.disable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.policy.disable" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2479", "external_name": "Firewall Policy Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.policy.enable", "stable_id": "OSCO-CAP-0490", "name": "Enable Policy", "description": "Perform enable operation on policy in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.policy.enable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "policy state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.policy.enable", "type": "safe_execute", "description": "Safely verify firewall.policy.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.policy.enable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.policy.enable" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2478", "external_name": "Firewall Policy Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.profile.audit", "stable_id": "OSCO-CAP-0497", "name": "Audit Profile", "description": "Perform audit operation on profile in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.profile.audit" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "profile state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.profile.audit", "type": "safe_execute", "description": "Safely verify firewall.profile.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.profile.audit", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.profile.audit" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2485", "external_name": "Firewall Profile Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.profile.create", "stable_id": "OSCO-CAP-0493", "name": "Create Profile", "description": "Perform create operation on profile in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.profile.create" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "profile state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.profile.create", "type": "safe_execute", "description": "Safely verify firewall.profile.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.profile.create", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.profile.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2481", "external_name": "Firewall Profile Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.profile.delete", "stable_id": "OSCO-CAP-0494", "name": "Delete Profile", "description": "Perform delete operation on profile in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.profile.delete" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "profile state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.profile.delete", "type": "safe_execute", "description": "Safely verify firewall.profile.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.profile.delete", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.profile.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2482", "external_name": "Firewall Profile Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.profile.disable", "stable_id": "OSCO-CAP-0496", "name": "Disable Profile", "description": "Perform disable operation on profile in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.profile.disable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "profile state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.profile.disable", "type": "safe_execute", "description": "Safely verify firewall.profile.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.profile.disable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.profile.disable" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2484", "external_name": "Firewall Profile Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.profile.enable", "stable_id": "OSCO-CAP-0495", "name": "Enable Profile", "description": "Perform enable operation on profile in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.profile.enable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "profile state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.profile.enable", "type": "safe_execute", "description": "Safely verify firewall.profile.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.profile.enable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.profile.enable" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2483", "external_name": "Firewall Profile Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.rule.audit", "stable_id": "OSCO-CAP-0487", "name": "Audit Rule", "description": "Perform audit operation on rule in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.rule.audit" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.rule.audit", "type": "safe_execute", "description": "Safely verify firewall.rule.audit with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.rule.audit", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.rule.audit" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2475", "external_name": "Firewall Rule Audit", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.rule.create", "stable_id": "OSCO-CAP-0483", "name": "Create Rule", "description": "Perform create operation on rule in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.rule.create" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.rule.create", "type": "safe_execute", "description": "Safely verify firewall.rule.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.rule.create", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.rule.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2471", "external_name": "Firewall Rule Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.rule.delete", "stable_id": "OSCO-CAP-0484", "name": "Delete Rule", "description": "Perform delete operation on rule in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.rule.delete" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.rule.delete", "type": "safe_execute", "description": "Safely verify firewall.rule.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.rule.delete", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.rule.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2472", "external_name": "Firewall Rule Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.rule.disable", "stable_id": "OSCO-CAP-0486", "name": "Disable Rule", "description": "Perform disable operation on rule in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.rule.disable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.rule.disable", "type": "safe_execute", "description": "Safely verify firewall.rule.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.rule.disable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.rule.disable" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2474", "external_name": "Firewall Rule Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "firewall.rule.enable", "stable_id": "OSCO-CAP-0485", "name": "Enable Rule", "description": "Perform enable operation on rule in the firewall domain.", "category": "network", "domain": "firewall", "platforms": [ "windows", "linux", "macos", "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "firewall.rule.enable" ], "preconditions": [ "provider exposes firewall capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.firewall.rule.enable", "type": "safe_execute", "description": "Safely verify firewall.rule.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.firewall.rule.enable", "type": "declared", "state": "declared", "description": "Discover declared support for firewall.rule.enable" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2473", "external_name": "Firewall Rule Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.federation.create", "stable_id": "OSCO-CAP-0338", "name": "Create Federation", "description": "Perform create operation on federation in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.federation.create" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "federation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.federation.create", "type": "safe_execute", "description": "Safely verify identity.federation.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.federation.create", "type": "declared", "state": "declared", "description": "Discover declared support for identity.federation.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2326", "external_name": "Identity Federation Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.federation.delete", "stable_id": "OSCO-CAP-0341", "name": "Delete Federation", "description": "Perform delete operation on federation in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.federation.delete" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "federation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.federation.delete", "type": "safe_execute", "description": "Safely verify identity.federation.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.federation.delete", "type": "declared", "state": "declared", "description": "Discover declared support for identity.federation.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2329", "external_name": "Identity Federation Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.federation.enumerate", "stable_id": "OSCO-CAP-0342", "name": "Enumerate Federation", "description": "Perform enumerate operation on federation in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.federation.enumerate" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "federation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.federation.enumerate", "type": "safe_execute", "description": "Safely verify identity.federation.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.federation.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for identity.federation.enumerate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2330", "external_name": "Identity Federation Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.federation.read", "stable_id": "OSCO-CAP-0339", "name": "Read Federation", "description": "Perform read operation on federation in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.federation.read" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "federation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.federation.read", "type": "safe_execute", "description": "Safely verify identity.federation.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.federation.read", "type": "declared", "state": "declared", "description": "Discover declared support for identity.federation.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2327", "external_name": "Identity Federation Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.federation.update", "stable_id": "OSCO-CAP-0340", "name": "Update Federation", "description": "Perform update operation on federation in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.federation.update" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "federation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.federation.update", "type": "safe_execute", "description": "Safely verify identity.federation.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.federation.update", "type": "declared", "state": "declared", "description": "Discover declared support for identity.federation.update" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2328", "external_name": "Identity Federation Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.group.create", "stable_id": "OSCO-CAP-0328", "name": "Create Group", "description": "Perform create operation on group in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.group.create" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "group state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.group.create", "type": "safe_execute", "description": "Safely verify identity.group.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.group.create", "type": "declared", "state": "declared", "description": "Discover declared support for identity.group.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2316", "external_name": "Identity Group Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.group.delete", "stable_id": "OSCO-CAP-0331", "name": "Delete Group", "description": "Perform delete operation on group in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.group.delete" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "group state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.group.delete", "type": "safe_execute", "description": "Safely verify identity.group.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.group.delete", "type": "declared", "state": "declared", "description": "Discover declared support for identity.group.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2319", "external_name": "Identity Group Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.group.enumerate", "stable_id": "OSCO-CAP-0332", "name": "Enumerate Group", "description": "Perform enumerate operation on group in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.group.enumerate" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "group state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.group.enumerate", "type": "safe_execute", "description": "Safely verify identity.group.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.group.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for identity.group.enumerate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2320", "external_name": "Identity Group Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.group.read", "stable_id": "OSCO-CAP-0329", "name": "Read Group", "description": "Perform read operation on group in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.group.read" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "group state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.group.read", "type": "safe_execute", "description": "Safely verify identity.group.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.group.read", "type": "declared", "state": "declared", "description": "Discover declared support for identity.group.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2317", "external_name": "Identity Group Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.group.update", "stable_id": "OSCO-CAP-0330", "name": "Update Group", "description": "Perform update operation on group in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.group.update" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "group state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.group.update", "type": "safe_execute", "description": "Safely verify identity.group.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.group.update", "type": "declared", "state": "declared", "description": "Discover declared support for identity.group.update" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2318", "external_name": "Identity Group Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.service_principal.create", "stable_id": "OSCO-CAP-0333", "name": "Create Service Principal", "description": "Perform create operation on service principal in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.service_principal.create" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "service principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.service_principal.create", "type": "safe_execute", "description": "Safely verify identity.service_principal.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.service_principal.create", "type": "declared", "state": "declared", "description": "Discover declared support for identity.service_principal.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2321", "external_name": "Identity Service Principal Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.service_principal.delete", "stable_id": "OSCO-CAP-0336", "name": "Delete Service Principal", "description": "Perform delete operation on service principal in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.service_principal.delete" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "service principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.service_principal.delete", "type": "safe_execute", "description": "Safely verify identity.service_principal.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.service_principal.delete", "type": "declared", "state": "declared", "description": "Discover declared support for identity.service_principal.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2324", "external_name": "Identity Service Principal Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.service_principal.enumerate", "stable_id": "OSCO-CAP-0337", "name": "Enumerate Service Principal", "description": "Perform enumerate operation on service principal in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.service_principal.enumerate" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "service principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.service_principal.enumerate", "type": "safe_execute", "description": "Safely verify identity.service_principal.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.service_principal.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for identity.service_principal.enumerate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2325", "external_name": "Identity Service Principal Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.service_principal.read", "stable_id": "OSCO-CAP-0334", "name": "Read Service Principal", "description": "Perform read operation on service principal in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.service_principal.read" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "service principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.service_principal.read", "type": "safe_execute", "description": "Safely verify identity.service_principal.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.service_principal.read", "type": "declared", "state": "declared", "description": "Discover declared support for identity.service_principal.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2322", "external_name": "Identity Service Principal Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.service_principal.update", "stable_id": "OSCO-CAP-0335", "name": "Update Service Principal", "description": "Perform update operation on service principal in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.service_principal.update" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "service principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.service_principal.update", "type": "safe_execute", "description": "Safely verify identity.service_principal.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.service_principal.update", "type": "declared", "state": "declared", "description": "Discover declared support for identity.service_principal.update" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2323", "external_name": "Identity Service Principal Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.user.create", "stable_id": "OSCO-CAP-0323", "name": "Create User", "description": "Perform create operation on user in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.user.create" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.user.create", "type": "safe_execute", "description": "Safely verify identity.user.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.user.create", "type": "declared", "state": "declared", "description": "Discover declared support for identity.user.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2311", "external_name": "Identity User Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.user.delete", "stable_id": "OSCO-CAP-0326", "name": "Delete User", "description": "Perform delete operation on user in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.user.delete" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.user.delete", "type": "safe_execute", "description": "Safely verify identity.user.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.user.delete", "type": "declared", "state": "declared", "description": "Discover declared support for identity.user.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2314", "external_name": "Identity User Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.user.enumerate", "stable_id": "OSCO-CAP-0327", "name": "Enumerate User", "description": "Perform enumerate operation on user in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.user.enumerate" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.user.enumerate", "type": "safe_execute", "description": "Safely verify identity.user.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.user.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for identity.user.enumerate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2315", "external_name": "Identity User Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.user.read", "stable_id": "OSCO-CAP-0324", "name": "Read User", "description": "Perform read operation on user in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.user.read" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.user.read", "type": "safe_execute", "description": "Safely verify identity.user.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.user.read", "type": "declared", "state": "declared", "description": "Discover declared support for identity.user.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2312", "external_name": "Identity User Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "identity.user.update", "stable_id": "OSCO-CAP-0325", "name": "Update User", "description": "Perform update operation on user in the identity domain.", "category": "identity", "domain": "identity", "platforms": [ "cloud", "saas", "identity" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "identity.user.update" ], "preconditions": [ "provider exposes identity capability surface" ], "postconditions": [ "user state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.identity.user.update", "type": "safe_execute", "description": "Safely verify identity.user.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.identity.user.update", "type": "declared", "state": "declared", "description": "Discover declared support for identity.user.update" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2313", "external_name": "Identity User Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.delegation.delegate", "stable_id": "OSCO-CAP-0441", "name": "Delegate Delegation", "description": "Perform delegate operation on delegation in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.delegation.delegate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "delegation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.delegation.delegate", "type": "safe_execute", "description": "Safely verify kerberos.delegation.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.delegation.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.delegation.delegate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2429", "external_name": "Kerberos Delegation Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.delegation.purge", "stable_id": "OSCO-CAP-0442", "name": "Purge Delegation", "description": "Perform purge operation on delegation in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.delegation.purge" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "delegation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.delegation.purge", "type": "safe_execute", "description": "Safely verify kerberos.delegation.purge with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.delegation.purge", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.delegation.purge" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2430", "external_name": "Kerberos Delegation Purge", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.delegation.renew", "stable_id": "OSCO-CAP-0439", "name": "Renew Delegation", "description": "Perform renew operation on delegation in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.delegation.renew" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "delegation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.delegation.renew", "type": "safe_execute", "description": "Safely verify kerberos.delegation.renew with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.delegation.renew", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.delegation.renew" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2427", "external_name": "Kerberos Delegation Renew", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.delegation.request", "stable_id": "OSCO-CAP-0438", "name": "Request Delegation", "description": "Perform request operation on delegation in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.delegation.request" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "delegation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.delegation.request", "type": "safe_execute", "description": "Safely verify kerberos.delegation.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.delegation.request", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.delegation.request" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2426", "external_name": "Kerberos Delegation Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.delegation.validate", "stable_id": "OSCO-CAP-0440", "name": "Validate Delegation", "description": "Perform validate operation on delegation in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.delegation.validate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "delegation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.delegation.validate", "type": "safe_execute", "description": "Safely verify kerberos.delegation.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.delegation.validate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.delegation.validate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2428", "external_name": "Kerberos Delegation Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.service_ticket.delegate", "stable_id": "OSCO-CAP-0436", "name": "Delegate Service Ticket", "description": "Perform delegate operation on service ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.service_ticket.delegate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "service ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.service_ticket.delegate", "type": "safe_execute", "description": "Safely verify kerberos.service_ticket.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.service_ticket.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.service_ticket.delegate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2424", "external_name": "Kerberos Service Ticket Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.service_ticket.purge", "stable_id": "OSCO-CAP-0437", "name": "Purge Service Ticket", "description": "Perform purge operation on service ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.service_ticket.purge" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "service ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.service_ticket.purge", "type": "safe_execute", "description": "Safely verify kerberos.service_ticket.purge with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.service_ticket.purge", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.service_ticket.purge" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2425", "external_name": "Kerberos Service Ticket Purge", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.service_ticket.renew", "stable_id": "OSCO-CAP-0434", "name": "Renew Service Ticket", "description": "Perform renew operation on service ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.service_ticket.renew" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "service ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.service_ticket.renew", "type": "safe_execute", "description": "Safely verify kerberos.service_ticket.renew with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.service_ticket.renew", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.service_ticket.renew" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2422", "external_name": "Kerberos Service Ticket Renew", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.service_ticket.request", "stable_id": "OSCO-CAP-0433", "name": "Request Service Ticket", "description": "Perform request operation on service ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.service_ticket.request" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "service ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.service_ticket.request", "type": "safe_execute", "description": "Safely verify kerberos.service_ticket.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.service_ticket.request", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.service_ticket.request" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2421", "external_name": "Kerberos Service Ticket Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.service_ticket.validate", "stable_id": "OSCO-CAP-0435", "name": "Validate Service Ticket", "description": "Perform validate operation on service ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.service_ticket.validate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "service ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.service_ticket.validate", "type": "safe_execute", "description": "Safely verify kerberos.service_ticket.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.service_ticket.validate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.service_ticket.validate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2423", "external_name": "Kerberos Service Ticket Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.tgt.delegate", "stable_id": "OSCO-CAP-0431", "name": "Delegate Tgt", "description": "Perform delegate operation on tgt in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.tgt.delegate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "tgt state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.tgt.delegate", "type": "safe_execute", "description": "Safely verify kerberos.tgt.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.tgt.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.tgt.delegate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2419", "external_name": "Kerberos Tgt Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.tgt.purge", "stable_id": "OSCO-CAP-0432", "name": "Purge Tgt", "description": "Perform purge operation on tgt in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.tgt.purge" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "tgt state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.tgt.purge", "type": "safe_execute", "description": "Safely verify kerberos.tgt.purge with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.tgt.purge", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.tgt.purge" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2420", "external_name": "Kerberos Tgt Purge", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.tgt.renew", "stable_id": "OSCO-CAP-0429", "name": "Renew Tgt", "description": "Perform renew operation on tgt in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.tgt.renew" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "tgt state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.tgt.renew", "type": "safe_execute", "description": "Safely verify kerberos.tgt.renew with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.tgt.renew", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.tgt.renew" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2417", "external_name": "Kerberos Tgt Renew", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.tgt.request", "stable_id": "OSCO-CAP-0428", "name": "Request Tgt", "description": "Perform request operation on tgt in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.tgt.request" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "tgt state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.tgt.request", "type": "safe_execute", "description": "Safely verify kerberos.tgt.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.tgt.request", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.tgt.request" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2416", "external_name": "Kerberos Tgt Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.tgt.validate", "stable_id": "OSCO-CAP-0430", "name": "Validate Tgt", "description": "Perform validate operation on tgt in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.tgt.validate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "tgt state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.tgt.validate", "type": "safe_execute", "description": "Safely verify kerberos.tgt.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.tgt.validate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.tgt.validate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2418", "external_name": "Kerberos Tgt Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.ticket.delegate", "stable_id": "OSCO-CAP-0426", "name": "Delegate Ticket", "description": "Perform delegate operation on ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.ticket.delegate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.ticket.delegate", "type": "safe_execute", "description": "Safely verify kerberos.ticket.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.ticket.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.ticket.delegate" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2414", "external_name": "Kerberos Ticket Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.ticket.purge", "stable_id": "OSCO-CAP-0427", "name": "Purge Ticket", "description": "Perform purge operation on ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.ticket.purge" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.ticket.purge", "type": "safe_execute", "description": "Safely verify kerberos.ticket.purge with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.ticket.purge", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.ticket.purge" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2415", "external_name": "Kerberos Ticket Purge", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.ticket.renew", "stable_id": "OSCO-CAP-0424", "name": "Renew Ticket", "description": "Perform renew operation on ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.ticket.renew" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.ticket.renew", "type": "safe_execute", "description": "Safely verify kerberos.ticket.renew with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.ticket.renew", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.ticket.renew" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2412", "external_name": "Kerberos Ticket Renew", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.ticket.request", "stable_id": "OSCO-CAP-0423", "name": "Request Ticket", "description": "Perform request operation on ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.ticket.request" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.ticket.request", "type": "safe_execute", "description": "Safely verify kerberos.ticket.request with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.ticket.request", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.ticket.request" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2411", "external_name": "Kerberos Ticket Request", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kerberos.ticket.validate", "stable_id": "OSCO-CAP-0425", "name": "Validate Ticket", "description": "Perform validate operation on ticket in the kerberos domain.", "category": "identity", "domain": "kerberos", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kerberos.ticket.validate" ], "preconditions": [ "provider exposes kerberos capability surface" ], "postconditions": [ "ticket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kerberos.ticket.validate", "type": "safe_execute", "description": "Safely verify kerberos.ticket.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kerberos.ticket.validate", "type": "declared", "state": "declared", "description": "Discover declared support for kerberos.ticket.validate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2413", "external_name": "Kerberos Ticket Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.extension.inspect", "stable_id": "OSCO-CAP-0196", "name": "Inspect Extension", "description": "Perform inspect operation on extension in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.extension.inspect" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.extension.inspect", "type": "safe_execute", "description": "Safely verify kernel.extension.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.extension.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.extension.inspect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2184", "external_name": "Kernel Extension Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.extension.load", "stable_id": "OSCO-CAP-0194", "name": "Load Extension", "description": "Perform load operation on extension in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.extension.load" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.extension.load", "type": "safe_execute", "description": "Safely verify kernel.extension.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.extension.load", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.extension.load" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2182", "external_name": "Kernel Extension Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.extension.modify", "stable_id": "OSCO-CAP-0195", "name": "Modify Extension", "description": "Perform modify operation on extension in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.extension.modify" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.extension.modify", "type": "safe_execute", "description": "Safely verify kernel.extension.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.extension.modify", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.extension.modify" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2183", "external_name": "Kernel Extension Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.extension.register", "stable_id": "OSCO-CAP-0197", "name": "Register Extension", "description": "Perform register operation on extension in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.extension.register" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.extension.register", "type": "safe_execute", "description": "Safely verify kernel.extension.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.extension.register", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.extension.register" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2185", "external_name": "Kernel Extension Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.extension.remove", "stable_id": "OSCO-CAP-0198", "name": "Remove Extension", "description": "Perform remove operation on extension in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.extension.remove" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "extension state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.extension.remove", "type": "safe_execute", "description": "Safely verify kernel.extension.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.extension.remove", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.extension.remove" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2186", "external_name": "Kernel Extension Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.hook.inspect", "stable_id": "OSCO-CAP-0186", "name": "Inspect Hook", "description": "Perform inspect operation on hook in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.hook.inspect" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "hook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.hook.inspect", "type": "safe_execute", "description": "Safely verify kernel.hook.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.hook.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.hook.inspect" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2174", "external_name": "Kernel Hook Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.hook.load", "stable_id": "OSCO-CAP-0184", "name": "Load Hook", "description": "Perform load operation on hook in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.hook.load" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "hook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.hook.load", "type": "safe_execute", "description": "Safely verify kernel.hook.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.hook.load", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.hook.load" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2172", "external_name": "Kernel Hook Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.hook.modify", "stable_id": "OSCO-CAP-0185", "name": "Modify Hook", "description": "Perform modify operation on hook in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.hook.modify" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "hook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.hook.modify", "type": "safe_execute", "description": "Safely verify kernel.hook.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.hook.modify", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.hook.modify" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2173", "external_name": "Kernel Hook Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.hook.register", "stable_id": "OSCO-CAP-0187", "name": "Register Hook", "description": "Perform register operation on hook in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.hook.register" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "hook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.hook.register", "type": "safe_execute", "description": "Safely verify kernel.hook.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.hook.register", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.hook.register" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2175", "external_name": "Kernel Hook Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.hook.remove", "stable_id": "OSCO-CAP-0188", "name": "Remove Hook", "description": "Perform remove operation on hook in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.hook.remove" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "hook state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.hook.remove", "type": "safe_execute", "description": "Safely verify kernel.hook.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.hook.remove", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.hook.remove" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2176", "external_name": "Kernel Hook Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.module.inspect", "stable_id": "OSCO-CAP-0181", "name": "Inspect Module", "description": "Perform inspect operation on module in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.module.inspect" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.module.inspect", "type": "safe_execute", "description": "Safely verify kernel.module.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.module.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.module.inspect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2169", "external_name": "Kernel Module Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.module.load", "stable_id": "OSCO-CAP-0179", "name": "Load Module", "description": "Perform load operation on module in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.module.load" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.module.load", "type": "safe_execute", "description": "Safely verify kernel.module.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.module.load", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.module.load" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2167", "external_name": "Kernel Module Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.module.modify", "stable_id": "OSCO-CAP-0180", "name": "Modify Module", "description": "Perform modify operation on module in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.module.modify" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.module.modify", "type": "safe_execute", "description": "Safely verify kernel.module.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.module.modify", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.module.modify" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2168", "external_name": "Kernel Module Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.module.register", "stable_id": "OSCO-CAP-0182", "name": "Register Module", "description": "Perform register operation on module in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.module.register" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.module.register", "type": "safe_execute", "description": "Safely verify kernel.module.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.module.register", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.module.register" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2170", "external_name": "Kernel Module Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.module.remove", "stable_id": "OSCO-CAP-0183", "name": "Remove Module", "description": "Perform remove operation on module in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.module.remove" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.module.remove", "type": "safe_execute", "description": "Safely verify kernel.module.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.module.remove", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.module.remove" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2171", "external_name": "Kernel Module Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.syscall.inspect", "stable_id": "OSCO-CAP-0191", "name": "Inspect Syscall", "description": "Perform inspect operation on syscall in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.syscall.inspect" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "syscall state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.syscall.inspect", "type": "safe_execute", "description": "Safely verify kernel.syscall.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.syscall.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.syscall.inspect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2179", "external_name": "Kernel Syscall Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.syscall.load", "stable_id": "OSCO-CAP-0189", "name": "Load Syscall", "description": "Perform load operation on syscall in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.syscall.load" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "syscall state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.syscall.load", "type": "safe_execute", "description": "Safely verify kernel.syscall.load with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.syscall.load", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.syscall.load" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2177", "external_name": "Kernel Syscall Load", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.syscall.modify", "stable_id": "OSCO-CAP-0190", "name": "Modify Syscall", "description": "Perform modify operation on syscall in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.syscall.modify" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "syscall state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.syscall.modify", "type": "safe_execute", "description": "Safely verify kernel.syscall.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.syscall.modify", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.syscall.modify" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2178", "external_name": "Kernel Syscall Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.syscall.register", "stable_id": "OSCO-CAP-0192", "name": "Register Syscall", "description": "Perform register operation on syscall in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.syscall.register" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "syscall state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.syscall.register", "type": "safe_execute", "description": "Safely verify kernel.syscall.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.syscall.register", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.syscall.register" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2180", "external_name": "Kernel Syscall Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kernel.syscall.remove", "stable_id": "OSCO-CAP-0193", "name": "Remove Syscall", "description": "Perform remove operation on syscall in the kernel domain.", "category": "endpoint", "domain": "kernel", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "kernel.syscall.remove" ], "preconditions": [ "provider exposes kernel capability surface" ], "postconditions": [ "syscall state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.kernel.syscall.remove", "type": "safe_execute", "description": "Safely verify kernel.syscall.remove with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kernel.syscall.remove", "type": "declared", "state": "declared", "description": "Discover declared support for kernel.syscall.remove" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2181", "external_name": "Kernel Syscall Remove", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.configmap.create", "stable_id": "OSCO-CAP-0712", "name": "Create Configmap", "description": "Perform create operation on configmap in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.configmap.create" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "configmap state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.configmap.create", "type": "safe_execute", "description": "Safely verify kubernetes.configmap.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.configmap.create", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.configmap.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2700", "external_name": "Kubernetes Configmap Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.configmap.delete", "stable_id": "OSCO-CAP-0715", "name": "Delete Configmap", "description": "Perform delete operation on configmap in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.configmap.delete" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "configmap state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.configmap.delete", "type": "safe_execute", "description": "Safely verify kubernetes.configmap.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.configmap.delete", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.configmap.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2703", "external_name": "Kubernetes Configmap Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.configmap.exec", "stable_id": "OSCO-CAP-0716", "name": "Exec Configmap", "description": "Perform exec operation on configmap in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.configmap.exec" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "configmap state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.configmap.exec", "type": "safe_execute", "description": "Safely verify kubernetes.configmap.exec with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.configmap.exec", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.configmap.exec" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2704", "external_name": "Kubernetes Configmap Exec", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.configmap.read", "stable_id": "OSCO-CAP-0713", "name": "Read Configmap", "description": "Perform read operation on configmap in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.configmap.read" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "configmap state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.configmap.read", "type": "safe_execute", "description": "Safely verify kubernetes.configmap.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.configmap.read", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.configmap.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2701", "external_name": "Kubernetes Configmap Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.configmap.update", "stable_id": "OSCO-CAP-0714", "name": "Update Configmap", "description": "Perform update operation on configmap in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.configmap.update" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "configmap state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.configmap.update", "type": "safe_execute", "description": "Safely verify kubernetes.configmap.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.configmap.update", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.configmap.update" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2702", "external_name": "Kubernetes Configmap Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.pod.create", "stable_id": "OSCO-CAP-0703", "name": "Create Pod", "description": "Perform create operation on pod in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.pod.create" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "pod state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.pod.create", "type": "safe_execute", "description": "Safely verify kubernetes.pod.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.pod.create", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.pod.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2691", "external_name": "Kubernetes Pod Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.pod.delete", "stable_id": "OSCO-CAP-0706", "name": "Delete Pod", "description": "Perform delete operation on pod in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.pod.delete" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "pod state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.pod.delete", "type": "safe_execute", "description": "Safely verify kubernetes.pod.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.pod.delete", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.pod.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2694", "external_name": "Kubernetes Pod Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.pod.exec", "stable_id": "OSCO-CAP-0707", "name": "Exec Pod", "description": "Perform exec operation on pod in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.pod.exec" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "pod state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.pod.exec", "type": "safe_execute", "description": "Safely verify kubernetes.pod.exec with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.pod.exec", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.pod.exec" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2695", "external_name": "Kubernetes Pod Exec", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.pod.read", "stable_id": "OSCO-CAP-0704", "name": "Read Pod", "description": "Perform read operation on pod in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.pod.read" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "pod state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.pod.read", "type": "safe_execute", "description": "Safely verify kubernetes.pod.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.pod.read", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.pod.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2692", "external_name": "Kubernetes Pod Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.pod.update", "stable_id": "OSCO-CAP-0705", "name": "Update Pod", "description": "Perform update operation on pod in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.pod.update" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "pod state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.pod.update", "type": "safe_execute", "description": "Safely verify kubernetes.pod.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.pod.update", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.pod.update" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2693", "external_name": "Kubernetes Pod Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.role.create", "stable_id": "OSCO-CAP-0717", "name": "Create Role", "description": "Perform create operation on role in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.role.create" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.role.create", "type": "safe_execute", "description": "Safely verify kubernetes.role.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.role.create", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.role.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2705", "external_name": "Kubernetes Role Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.role.delete", "stable_id": "OSCO-CAP-0720", "name": "Delete Role", "description": "Perform delete operation on role in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.role.delete" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.role.delete", "type": "safe_execute", "description": "Safely verify kubernetes.role.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.role.delete", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.role.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2708", "external_name": "Kubernetes Role Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.role.exec", "stable_id": "OSCO-CAP-0721", "name": "Exec Role", "description": "Perform exec operation on role in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.role.exec" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.role.exec", "type": "safe_execute", "description": "Safely verify kubernetes.role.exec with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.role.exec", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.role.exec" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2709", "external_name": "Kubernetes Role Exec", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.role.read", "stable_id": "OSCO-CAP-0718", "name": "Read Role", "description": "Perform read operation on role in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.role.read" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.role.read", "type": "safe_execute", "description": "Safely verify kubernetes.role.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.role.read", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.role.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2706", "external_name": "Kubernetes Role Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.role.update", "stable_id": "OSCO-CAP-0719", "name": "Update Role", "description": "Perform update operation on role in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.role.update" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.role.update", "type": "safe_execute", "description": "Safely verify kubernetes.role.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.role.update", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.role.update" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2707", "external_name": "Kubernetes Role Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.secret.create", "stable_id": "OSCO-CAP-0708", "name": "Create Secret", "description": "Perform create operation on secret in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.secret.create" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "secret state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.secret.create", "type": "safe_execute", "description": "Safely verify kubernetes.secret.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.secret.create", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.secret.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2696", "external_name": "Kubernetes Secret Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.secret.delete", "stable_id": "OSCO-CAP-0710", "name": "Delete Secret", "description": "Perform delete operation on secret in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.secret.delete" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "secret state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.secret.delete", "type": "safe_execute", "description": "Safely verify kubernetes.secret.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.secret.delete", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.secret.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2698", "external_name": "Kubernetes Secret Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.secret.exec", "stable_id": "OSCO-CAP-0711", "name": "Exec Secret", "description": "Perform exec operation on secret in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.secret.exec" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "secret state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.secret.exec", "type": "safe_execute", "description": "Safely verify kubernetes.secret.exec with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.secret.exec", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.secret.exec" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2699", "external_name": "Kubernetes Secret Exec", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.secret.read", "stable_id": "OSCO-CAP-0007", "name": "Read Kubernetes Secret", "description": "Read Kubernetes secret object data.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "status": "stable", "confidence": 0.9, "safety": "caution", "required_privileges": [ "k8s.secret.get" ], "mappings": [ { "framework": "mitre_attack", "external_id": "T1552", "external_name": "Unsecured Credentials", "confidence": 0.75 } ] }, { "capability_id": "kubernetes.secret.update", "stable_id": "OSCO-CAP-0709", "name": "Update Secret", "description": "Perform update operation on secret in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.secret.update" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "secret state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.secret.update", "type": "safe_execute", "description": "Safely verify kubernetes.secret.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.secret.update", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.secret.update" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2697", "external_name": "Kubernetes Secret Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.service_account.create", "stable_id": "OSCO-CAP-0722", "name": "Create Service Account", "description": "Perform create operation on service account in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.service_account.create" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "service account state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.service_account.create", "type": "safe_execute", "description": "Safely verify kubernetes.service_account.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.service_account.create", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.service_account.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2710", "external_name": "Kubernetes Service Account Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.service_account.delete", "stable_id": "OSCO-CAP-0725", "name": "Delete Service Account", "description": "Perform delete operation on service account in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.service_account.delete" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "service account state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.service_account.delete", "type": "safe_execute", "description": "Safely verify kubernetes.service_account.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.service_account.delete", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.service_account.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2713", "external_name": "Kubernetes Service Account Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.service_account.exec", "stable_id": "OSCO-CAP-0726", "name": "Exec Service Account", "description": "Perform exec operation on service account in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.service_account.exec" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "service account state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.service_account.exec", "type": "safe_execute", "description": "Safely verify kubernetes.service_account.exec with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.service_account.exec", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.service_account.exec" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2714", "external_name": "Kubernetes Service Account Exec", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.service_account.read", "stable_id": "OSCO-CAP-0723", "name": "Read Service Account", "description": "Perform read operation on service account in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.service_account.read" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "service account state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.service_account.read", "type": "safe_execute", "description": "Safely verify kubernetes.service_account.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.service_account.read", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.service_account.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2711", "external_name": "Kubernetes Service Account Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "kubernetes.service_account.update", "stable_id": "OSCO-CAP-0724", "name": "Update Service Account", "description": "Perform update operation on service account in the kubernetes domain.", "category": "container", "domain": "kubernetes", "platforms": [ "container", "cloud" ], "providers": [ "provider.kubernetes" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "kubernetes.service_account.update" ], "preconditions": [ "provider exposes kubernetes capability surface" ], "postconditions": [ "service account state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.kubernetes.service_account.update", "type": "safe_execute", "description": "Safely verify kubernetes.service_account.update with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.kubernetes.service_account.update", "type": "declared", "state": "declared", "description": "Discover declared support for kubernetes.service_account.update" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2712", "external_name": "Kubernetes Service Account Update", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.collector.configure", "stable_id": "OSCO-CAP-0861", "name": "Configure Collector", "description": "Perform configure operation on collector in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.collector.configure" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.collector.configure", "type": "safe_execute", "description": "Safely verify logging.collector.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.collector.configure", "type": "declared", "state": "declared", "description": "Discover declared support for logging.collector.configure" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2849", "external_name": "Logging Collector Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.collector.route", "stable_id": "OSCO-CAP-0864", "name": "Route Collector", "description": "Perform route operation on collector in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.collector.route" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.collector.route", "type": "safe_execute", "description": "Safely verify logging.collector.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.collector.route", "type": "declared", "state": "declared", "description": "Discover declared support for logging.collector.route" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2852", "external_name": "Logging Collector Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.collector.start", "stable_id": "OSCO-CAP-0862", "name": "Start Collector", "description": "Perform start operation on collector in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.collector.start" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.collector.start", "type": "safe_execute", "description": "Safely verify logging.collector.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.collector.start", "type": "declared", "state": "declared", "description": "Discover declared support for logging.collector.start" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2850", "external_name": "Logging Collector Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.collector.stop", "stable_id": "OSCO-CAP-0863", "name": "Stop Collector", "description": "Perform stop operation on collector in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.collector.stop" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.collector.stop", "type": "safe_execute", "description": "Safely verify logging.collector.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.collector.stop", "type": "declared", "state": "declared", "description": "Discover declared support for logging.collector.stop" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2851", "external_name": "Logging Collector Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.collector.validate", "stable_id": "OSCO-CAP-0865", "name": "Validate Collector", "description": "Perform validate operation on collector in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.collector.validate" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.collector.validate", "type": "safe_execute", "description": "Safely verify logging.collector.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.collector.validate", "type": "declared", "state": "declared", "description": "Discover declared support for logging.collector.validate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2853", "external_name": "Logging Collector Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.parser.configure", "stable_id": "OSCO-CAP-0866", "name": "Configure Parser", "description": "Perform configure operation on parser in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.parser.configure" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "parser state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.parser.configure", "type": "safe_execute", "description": "Safely verify logging.parser.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.parser.configure", "type": "declared", "state": "declared", "description": "Discover declared support for logging.parser.configure" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2854", "external_name": "Logging Parser Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.parser.route", "stable_id": "OSCO-CAP-0869", "name": "Route Parser", "description": "Perform route operation on parser in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.parser.route" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "parser state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.parser.route", "type": "safe_execute", "description": "Safely verify logging.parser.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.parser.route", "type": "declared", "state": "declared", "description": "Discover declared support for logging.parser.route" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2857", "external_name": "Logging Parser Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.parser.start", "stable_id": "OSCO-CAP-0867", "name": "Start Parser", "description": "Perform start operation on parser in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.parser.start" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "parser state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.parser.start", "type": "safe_execute", "description": "Safely verify logging.parser.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.parser.start", "type": "declared", "state": "declared", "description": "Discover declared support for logging.parser.start" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2855", "external_name": "Logging Parser Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.parser.stop", "stable_id": "OSCO-CAP-0868", "name": "Stop Parser", "description": "Perform stop operation on parser in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.parser.stop" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "parser state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.parser.stop", "type": "safe_execute", "description": "Safely verify logging.parser.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.parser.stop", "type": "declared", "state": "declared", "description": "Discover declared support for logging.parser.stop" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2856", "external_name": "Logging Parser Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.parser.validate", "stable_id": "OSCO-CAP-0870", "name": "Validate Parser", "description": "Perform validate operation on parser in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.parser.validate" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "parser state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.parser.validate", "type": "safe_execute", "description": "Safely verify logging.parser.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.parser.validate", "type": "declared", "state": "declared", "description": "Discover declared support for logging.parser.validate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2858", "external_name": "Logging Parser Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.pipeline.configure", "stable_id": "OSCO-CAP-0856", "name": "Configure Pipeline", "description": "Perform configure operation on pipeline in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.pipeline.configure" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.pipeline.configure", "type": "safe_execute", "description": "Safely verify logging.pipeline.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.pipeline.configure", "type": "declared", "state": "declared", "description": "Discover declared support for logging.pipeline.configure" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2844", "external_name": "Logging Pipeline Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.pipeline.route", "stable_id": "OSCO-CAP-0859", "name": "Route Pipeline", "description": "Perform route operation on pipeline in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.pipeline.route" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.pipeline.route", "type": "safe_execute", "description": "Safely verify logging.pipeline.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.pipeline.route", "type": "declared", "state": "declared", "description": "Discover declared support for logging.pipeline.route" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2847", "external_name": "Logging Pipeline Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.pipeline.start", "stable_id": "OSCO-CAP-0857", "name": "Start Pipeline", "description": "Perform start operation on pipeline in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.pipeline.start" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.pipeline.start", "type": "safe_execute", "description": "Safely verify logging.pipeline.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.pipeline.start", "type": "declared", "state": "declared", "description": "Discover declared support for logging.pipeline.start" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2845", "external_name": "Logging Pipeline Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.pipeline.stop", "stable_id": "OSCO-CAP-0858", "name": "Stop Pipeline", "description": "Perform stop operation on pipeline in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.pipeline.stop" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.pipeline.stop", "type": "safe_execute", "description": "Safely verify logging.pipeline.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.pipeline.stop", "type": "declared", "state": "declared", "description": "Discover declared support for logging.pipeline.stop" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2846", "external_name": "Logging Pipeline Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.pipeline.validate", "stable_id": "OSCO-CAP-0860", "name": "Validate Pipeline", "description": "Perform validate operation on pipeline in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.pipeline.validate" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.pipeline.validate", "type": "safe_execute", "description": "Safely verify logging.pipeline.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.pipeline.validate", "type": "declared", "state": "declared", "description": "Discover declared support for logging.pipeline.validate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2848", "external_name": "Logging Pipeline Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.sink.configure", "stable_id": "OSCO-CAP-0871", "name": "Configure Sink", "description": "Perform configure operation on sink in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.sink.configure" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.sink.configure", "type": "safe_execute", "description": "Safely verify logging.sink.configure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.sink.configure", "type": "declared", "state": "declared", "description": "Discover declared support for logging.sink.configure" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2859", "external_name": "Logging Sink Configure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.sink.route", "stable_id": "OSCO-CAP-0874", "name": "Route Sink", "description": "Perform route operation on sink in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.sink.route" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.sink.route", "type": "safe_execute", "description": "Safely verify logging.sink.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.sink.route", "type": "declared", "state": "declared", "description": "Discover declared support for logging.sink.route" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2862", "external_name": "Logging Sink Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.sink.start", "stable_id": "OSCO-CAP-0872", "name": "Start Sink", "description": "Perform start operation on sink in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.sink.start" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.sink.start", "type": "safe_execute", "description": "Safely verify logging.sink.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.sink.start", "type": "declared", "state": "declared", "description": "Discover declared support for logging.sink.start" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2860", "external_name": "Logging Sink Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.sink.stop", "stable_id": "OSCO-CAP-0873", "name": "Stop Sink", "description": "Perform stop operation on sink in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.sink.stop" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.sink.stop", "type": "safe_execute", "description": "Safely verify logging.sink.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.sink.stop", "type": "declared", "state": "declared", "description": "Discover declared support for logging.sink.stop" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2861", "external_name": "Logging Sink Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "logging.sink.validate", "stable_id": "OSCO-CAP-0875", "name": "Validate Sink", "description": "Perform validate operation on sink in the logging domain.", "category": "telemetry", "domain": "logging", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "logging.sink.validate" ], "preconditions": [ "provider exposes logging capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.logging.sink.validate", "type": "safe_execute", "description": "Safely verify logging.sink.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.logging.sink.validate", "type": "declared", "state": "declared", "description": "Discover declared support for logging.sink.validate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2863", "external_name": "Logging Sink Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "mail.forwarding.create", "stable_id": "OSCO-CAP-0005", "name": "Create Mail Forwarding Rule", "description": "Create forwarding rule for mailbox routing.", "category": "saas", "domain": "email", "platforms": [ "saas" ], "providers": [ "provider.google_workspace", "provider.microsoft365" ], "status": "stable", "confidence": 0.92, "safety": "caution", "required_privileges": [ "mailbox.rule.create" ], "mappings": [ { "framework": "mitre_attack", "external_id": "T1114.003", "external_name": "Email Collection: Email Forwarding Rule", "confidence": 0.97 }, { "framework": "event_maturity_matrix", "external_id": "identity-mail-03", "external_name": "Email Forwarding Visibility", "confidence": 0.8 } ] }, { "capability_id": "memory.dump.allocate", "stable_id": "OSCO-CAP-0117", "name": "Allocate Dump", "description": "Perform allocate operation on dump in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.dump.allocate" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "dump state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.dump.allocate", "type": "safe_execute", "description": "Safely verify memory.dump.allocate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.dump.allocate", "type": "declared", "state": "declared", "description": "Discover declared support for memory.dump.allocate" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2105", "external_name": "Memory Dump Allocate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.dump.dump", "stable_id": "OSCO-CAP-0119", "name": "Dump Dump", "description": "Perform dump operation on dump in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.dump.dump" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "dump state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.dump.dump", "type": "safe_execute", "description": "Safely verify memory.dump.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.dump.dump", "type": "declared", "state": "declared", "description": "Discover declared support for memory.dump.dump" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2107", "external_name": "Memory Dump Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.dump.protect", "stable_id": "OSCO-CAP-0118", "name": "Protect Dump", "description": "Perform protect operation on dump in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.dump.protect" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "dump state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.dump.protect", "type": "safe_execute", "description": "Safely verify memory.dump.protect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.dump.protect", "type": "declared", "state": "declared", "description": "Discover declared support for memory.dump.protect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2106", "external_name": "Memory Dump Protect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.dump.read", "stable_id": "OSCO-CAP-0115", "name": "Read Dump", "description": "Perform read operation on dump in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.dump.read" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "dump state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.dump.read", "type": "safe_execute", "description": "Safely verify memory.dump.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.dump.read", "type": "declared", "state": "declared", "description": "Discover declared support for memory.dump.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2103", "external_name": "Memory Dump Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.dump.write", "stable_id": "OSCO-CAP-0116", "name": "Write Dump", "description": "Perform write operation on dump in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.dump.write" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "dump state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.dump.write", "type": "safe_execute", "description": "Safely verify memory.dump.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.dump.write", "type": "declared", "state": "declared", "description": "Discover declared support for memory.dump.write" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2104", "external_name": "Memory Dump Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.page.allocate", "stable_id": "OSCO-CAP-0107", "name": "Allocate Page", "description": "Perform allocate operation on page in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.page.allocate" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "page state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.page.allocate", "type": "safe_execute", "description": "Safely verify memory.page.allocate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.page.allocate", "type": "declared", "state": "declared", "description": "Discover declared support for memory.page.allocate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2095", "external_name": "Memory Page Allocate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.page.dump", "stable_id": "OSCO-CAP-0109", "name": "Dump Page", "description": "Perform dump operation on page in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.page.dump" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "page state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.page.dump", "type": "safe_execute", "description": "Safely verify memory.page.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.page.dump", "type": "declared", "state": "declared", "description": "Discover declared support for memory.page.dump" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2097", "external_name": "Memory Page Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.page.protect", "stable_id": "OSCO-CAP-0108", "name": "Protect Page", "description": "Perform protect operation on page in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.page.protect" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "page state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.page.protect", "type": "safe_execute", "description": "Safely verify memory.page.protect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.page.protect", "type": "declared", "state": "declared", "description": "Discover declared support for memory.page.protect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2096", "external_name": "Memory Page Protect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.page.read", "stable_id": "OSCO-CAP-0105", "name": "Read Page", "description": "Perform read operation on page in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.page.read" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "page state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.page.read", "type": "safe_execute", "description": "Safely verify memory.page.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.page.read", "type": "declared", "state": "declared", "description": "Discover declared support for memory.page.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2093", "external_name": "Memory Page Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.page.write", "stable_id": "OSCO-CAP-0106", "name": "Write Page", "description": "Perform write operation on page in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.page.write" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "page state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.page.write", "type": "safe_execute", "description": "Safely verify memory.page.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.page.write", "type": "declared", "state": "declared", "description": "Discover declared support for memory.page.write" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2094", "external_name": "Memory Page Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.process_memory.allocate", "stable_id": "OSCO-CAP-0112", "name": "Allocate Process Memory", "description": "Perform allocate operation on process memory in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.process_memory.allocate" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "process memory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.process_memory.allocate", "type": "safe_execute", "description": "Safely verify memory.process_memory.allocate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.process_memory.allocate", "type": "declared", "state": "declared", "description": "Discover declared support for memory.process_memory.allocate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2100", "external_name": "Memory Process Memory Allocate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.process_memory.dump", "stable_id": "OSCO-CAP-0114", "name": "Dump Process Memory", "description": "Perform dump operation on process memory in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.process_memory.dump" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "process memory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.process_memory.dump", "type": "safe_execute", "description": "Safely verify memory.process_memory.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.process_memory.dump", "type": "declared", "state": "declared", "description": "Discover declared support for memory.process_memory.dump" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2102", "external_name": "Memory Process Memory Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.process_memory.protect", "stable_id": "OSCO-CAP-0113", "name": "Protect Process Memory", "description": "Perform protect operation on process memory in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.process_memory.protect" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "process memory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.process_memory.protect", "type": "safe_execute", "description": "Safely verify memory.process_memory.protect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.process_memory.protect", "type": "declared", "state": "declared", "description": "Discover declared support for memory.process_memory.protect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2101", "external_name": "Memory Process Memory Protect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.process_memory.read", "stable_id": "OSCO-CAP-0110", "name": "Read Process Memory", "description": "Perform read operation on process memory in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.process_memory.read" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "process memory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.process_memory.read", "type": "safe_execute", "description": "Safely verify memory.process_memory.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.process_memory.read", "type": "declared", "state": "declared", "description": "Discover declared support for memory.process_memory.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2098", "external_name": "Memory Process Memory Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.process_memory.write", "stable_id": "OSCO-CAP-0111", "name": "Write Process Memory", "description": "Perform write operation on process memory in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.process_memory.write" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "process memory state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.process_memory.write", "type": "safe_execute", "description": "Safely verify memory.process_memory.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.process_memory.write", "type": "declared", "state": "declared", "description": "Discover declared support for memory.process_memory.write" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2099", "external_name": "Memory Process Memory Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.region.allocate", "stable_id": "OSCO-CAP-0102", "name": "Allocate Region", "description": "Perform allocate operation on region in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.region.allocate" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "region state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.region.allocate", "type": "safe_execute", "description": "Safely verify memory.region.allocate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.region.allocate", "type": "declared", "state": "declared", "description": "Discover declared support for memory.region.allocate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2090", "external_name": "Memory Region Allocate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.region.dump", "stable_id": "OSCO-CAP-0104", "name": "Dump Region", "description": "Perform dump operation on region in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.region.dump" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "region state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.region.dump", "type": "safe_execute", "description": "Safely verify memory.region.dump with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.region.dump", "type": "declared", "state": "declared", "description": "Discover declared support for memory.region.dump" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2092", "external_name": "Memory Region Dump", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.region.protect", "stable_id": "OSCO-CAP-0103", "name": "Protect Region", "description": "Perform protect operation on region in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.region.protect" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "region state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.region.protect", "type": "safe_execute", "description": "Safely verify memory.region.protect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.region.protect", "type": "declared", "state": "declared", "description": "Discover declared support for memory.region.protect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2091", "external_name": "Memory Region Protect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.region.read", "stable_id": "OSCO-CAP-0100", "name": "Read Region", "description": "Perform read operation on region in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.region.read" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "region state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.region.read", "type": "safe_execute", "description": "Safely verify memory.region.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.region.read", "type": "declared", "state": "declared", "description": "Discover declared support for memory.region.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2088", "external_name": "Memory Region Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "memory.region.write", "stable_id": "OSCO-CAP-0101", "name": "Write Region", "description": "Perform write operation on region in the memory domain.", "category": "endpoint", "domain": "memory", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "memory.region.write" ], "preconditions": [ "provider exposes memory capability surface" ], "postconditions": [ "region state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.memory.region.write", "type": "safe_execute", "description": "Safely verify memory.region.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.memory.region.write", "type": "declared", "state": "declared", "description": "Discover declared support for memory.region.write" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2089", "external_name": "Memory Region Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.client.close", "stable_id": "OSCO-CAP-0577", "name": "Close Client", "description": "Perform close operation on client in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.client.close" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "client state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.client.close", "type": "safe_execute", "description": "Safely verify named_pipe.client.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.client.close", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.client.close" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2565", "external_name": "Named Pipe Client Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.client.connect", "stable_id": "OSCO-CAP-0574", "name": "Connect Client", "description": "Perform connect operation on client in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.client.connect" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "client state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.client.connect", "type": "safe_execute", "description": "Safely verify named_pipe.client.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.client.connect", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.client.connect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2562", "external_name": "Named Pipe Client Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.client.create", "stable_id": "OSCO-CAP-0573", "name": "Create Client", "description": "Perform create operation on client in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.client.create" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "client state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.client.create", "type": "safe_execute", "description": "Safely verify named_pipe.client.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.client.create", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.client.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2561", "external_name": "Named Pipe Client Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.client.read", "stable_id": "OSCO-CAP-0575", "name": "Read Client", "description": "Perform read operation on client in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.client.read" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "client state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.client.read", "type": "safe_execute", "description": "Safely verify named_pipe.client.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.client.read", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.client.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2563", "external_name": "Named Pipe Client Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.client.write", "stable_id": "OSCO-CAP-0576", "name": "Write Client", "description": "Perform write operation on client in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.client.write" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "client state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.client.write", "type": "safe_execute", "description": "Safely verify named_pipe.client.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.client.write", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.client.write" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2564", "external_name": "Named Pipe Client Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.message.close", "stable_id": "OSCO-CAP-0582", "name": "Close Message", "description": "Perform close operation on message in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.message.close" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "message state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.message.close", "type": "safe_execute", "description": "Safely verify named_pipe.message.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.message.close", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.message.close" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2570", "external_name": "Named Pipe Message Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.message.connect", "stable_id": "OSCO-CAP-0579", "name": "Connect Message", "description": "Perform connect operation on message in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.message.connect" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "message state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.message.connect", "type": "safe_execute", "description": "Safely verify named_pipe.message.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.message.connect", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.message.connect" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2567", "external_name": "Named Pipe Message Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.message.create", "stable_id": "OSCO-CAP-0578", "name": "Create Message", "description": "Perform create operation on message in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.message.create" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "message state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.message.create", "type": "safe_execute", "description": "Safely verify named_pipe.message.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.message.create", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.message.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2566", "external_name": "Named Pipe Message Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.message.read", "stable_id": "OSCO-CAP-0580", "name": "Read Message", "description": "Perform read operation on message in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.message.read" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "message state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.message.read", "type": "safe_execute", "description": "Safely verify named_pipe.message.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.message.read", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.message.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2568", "external_name": "Named Pipe Message Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.message.write", "stable_id": "OSCO-CAP-0581", "name": "Write Message", "description": "Perform write operation on message in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.message.write" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "message state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.message.write", "type": "safe_execute", "description": "Safely verify named_pipe.message.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.message.write", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.message.write" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2569", "external_name": "Named Pipe Message Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.pipe.close", "stable_id": "OSCO-CAP-0567", "name": "Close Pipe", "description": "Perform close operation on pipe in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.pipe.close" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.pipe.close", "type": "safe_execute", "description": "Safely verify named_pipe.pipe.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.pipe.close", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.pipe.close" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2555", "external_name": "Named Pipe Pipe Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.pipe.connect", "stable_id": "OSCO-CAP-0564", "name": "Connect Pipe", "description": "Perform connect operation on pipe in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.pipe.connect" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.pipe.connect", "type": "safe_execute", "description": "Safely verify named_pipe.pipe.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.pipe.connect", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.pipe.connect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2552", "external_name": "Named Pipe Pipe Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.pipe.create", "stable_id": "OSCO-CAP-0563", "name": "Create Pipe", "description": "Perform create operation on pipe in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.pipe.create" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.pipe.create", "type": "safe_execute", "description": "Safely verify named_pipe.pipe.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.pipe.create", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.pipe.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2551", "external_name": "Named Pipe Pipe Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.pipe.read", "stable_id": "OSCO-CAP-0565", "name": "Read Pipe", "description": "Perform read operation on pipe in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.pipe.read" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.pipe.read", "type": "safe_execute", "description": "Safely verify named_pipe.pipe.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.pipe.read", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.pipe.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2553", "external_name": "Named Pipe Pipe Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.pipe.write", "stable_id": "OSCO-CAP-0566", "name": "Write Pipe", "description": "Perform write operation on pipe in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.pipe.write" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.pipe.write", "type": "safe_execute", "description": "Safely verify named_pipe.pipe.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.pipe.write", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.pipe.write" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2554", "external_name": "Named Pipe Pipe Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.server.close", "stable_id": "OSCO-CAP-0572", "name": "Close Server", "description": "Perform close operation on server in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.server.close" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "server state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.server.close", "type": "safe_execute", "description": "Safely verify named_pipe.server.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.server.close", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.server.close" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2560", "external_name": "Named Pipe Server Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.server.connect", "stable_id": "OSCO-CAP-0569", "name": "Connect Server", "description": "Perform connect operation on server in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.server.connect" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "server state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.server.connect", "type": "safe_execute", "description": "Safely verify named_pipe.server.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.server.connect", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.server.connect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2557", "external_name": "Named Pipe Server Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.server.create", "stable_id": "OSCO-CAP-0568", "name": "Create Server", "description": "Perform create operation on server in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.server.create" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "server state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.server.create", "type": "safe_execute", "description": "Safely verify named_pipe.server.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.server.create", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.server.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2556", "external_name": "Named Pipe Server Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.server.read", "stable_id": "OSCO-CAP-0570", "name": "Read Server", "description": "Perform read operation on server in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.server.read" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "server state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.server.read", "type": "safe_execute", "description": "Safely verify named_pipe.server.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.server.read", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.server.read" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2558", "external_name": "Named Pipe Server Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "named_pipe.server.write", "stable_id": "OSCO-CAP-0571", "name": "Write Server", "description": "Perform write operation on server in the named_pipe domain.", "category": "endpoint", "domain": "named_pipe", "platforms": [ "windows", "linux" ], "providers": [ "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "named_pipe.server.write" ], "preconditions": [ "provider exposes named_pipe capability surface" ], "postconditions": [ "server state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.named_pipe.server.write", "type": "safe_execute", "description": "Safely verify named_pipe.server.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.named_pipe.server.write", "type": "declared", "state": "declared", "description": "Discover declared support for named_pipe.server.write" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2559", "external_name": "Named Pipe Server Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.connection.close", "stable_id": "OSCO-CAP-0449", "name": "Close Connection", "description": "Perform close operation on connection in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.connection.close" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "connection state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.connection.close", "type": "safe_execute", "description": "Safely verify network.connection.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.connection.close", "type": "declared", "state": "declared", "description": "Discover declared support for network.connection.close" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2437", "external_name": "Network Connection Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.connection.inspect", "stable_id": "OSCO-CAP-0450", "name": "Inspect Connection", "description": "Perform inspect operation on connection in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.connection.inspect" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "connection state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.connection.inspect", "type": "safe_execute", "description": "Safely verify network.connection.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.connection.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for network.connection.inspect" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2438", "external_name": "Network Connection Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.connection.modify", "stable_id": "OSCO-CAP-0451", "name": "Modify Connection", "description": "Perform modify operation on connection in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.connection.modify" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "connection state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.connection.modify", "type": "safe_execute", "description": "Safely verify network.connection.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.connection.modify", "type": "declared", "state": "declared", "description": "Discover declared support for network.connection.modify" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2439", "external_name": "Network Connection Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.connection.monitor", "stable_id": "OSCO-CAP-0452", "name": "Monitor Connection", "description": "Perform monitor operation on connection in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.connection.monitor" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "connection state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.connection.monitor", "type": "safe_execute", "description": "Safely verify network.connection.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.connection.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for network.connection.monitor" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2440", "external_name": "Network Connection Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.connection.open", "stable_id": "OSCO-CAP-0448", "name": "Open Connection", "description": "Perform open operation on connection in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.connection.open" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "connection state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.connection.open", "type": "safe_execute", "description": "Safely verify network.connection.open with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.connection.open", "type": "declared", "state": "declared", "description": "Discover declared support for network.connection.open" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2436", "external_name": "Network Connection Open", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.dns.query", "stable_id": "OSCO-CAP-0006", "name": "Perform DNS Query", "description": "Resolve a DNS name through configured resolver.", "category": "network", "domain": "dns", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.windows", "provider.linux", "provider.macos", "provider.kubernetes" ], "status": "stable", "confidence": 0.9, "safety": "safe", "mappings": [ { "framework": "ocsf", "external_id": "dns_activity", "external_name": "DNS Activity", "confidence": 0.88 } ] }, { "capability_id": "network.interface.close", "stable_id": "OSCO-CAP-0459", "name": "Close Interface", "description": "Perform close operation on interface in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.interface.close" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "interface state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.interface.close", "type": "safe_execute", "description": "Safely verify network.interface.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.interface.close", "type": "declared", "state": "declared", "description": "Discover declared support for network.interface.close" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2447", "external_name": "Network Interface Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.interface.inspect", "stable_id": "OSCO-CAP-0460", "name": "Inspect Interface", "description": "Perform inspect operation on interface in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.interface.inspect" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "interface state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.interface.inspect", "type": "safe_execute", "description": "Safely verify network.interface.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.interface.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for network.interface.inspect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2448", "external_name": "Network Interface Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.interface.modify", "stable_id": "OSCO-CAP-0461", "name": "Modify Interface", "description": "Perform modify operation on interface in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.interface.modify" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "interface state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.interface.modify", "type": "safe_execute", "description": "Safely verify network.interface.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.interface.modify", "type": "declared", "state": "declared", "description": "Discover declared support for network.interface.modify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2449", "external_name": "Network Interface Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.interface.monitor", "stable_id": "OSCO-CAP-0462", "name": "Monitor Interface", "description": "Perform monitor operation on interface in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.interface.monitor" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "interface state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.interface.monitor", "type": "safe_execute", "description": "Safely verify network.interface.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.interface.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for network.interface.monitor" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2450", "external_name": "Network Interface Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.interface.open", "stable_id": "OSCO-CAP-0458", "name": "Open Interface", "description": "Perform open operation on interface in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.interface.open" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "interface state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.interface.open", "type": "safe_execute", "description": "Safely verify network.interface.open with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.interface.open", "type": "declared", "state": "declared", "description": "Discover declared support for network.interface.open" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2446", "external_name": "Network Interface Open", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.route.close", "stable_id": "OSCO-CAP-0454", "name": "Close Route", "description": "Perform close operation on route in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.route.close" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.route.close", "type": "safe_execute", "description": "Safely verify network.route.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.route.close", "type": "declared", "state": "declared", "description": "Discover declared support for network.route.close" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2442", "external_name": "Network Route Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.route.inspect", "stable_id": "OSCO-CAP-0455", "name": "Inspect Route", "description": "Perform inspect operation on route in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.route.inspect" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.route.inspect", "type": "safe_execute", "description": "Safely verify network.route.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.route.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for network.route.inspect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2443", "external_name": "Network Route Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.route.modify", "stable_id": "OSCO-CAP-0456", "name": "Modify Route", "description": "Perform modify operation on route in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.route.modify" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.route.modify", "type": "safe_execute", "description": "Safely verify network.route.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.route.modify", "type": "declared", "state": "declared", "description": "Discover declared support for network.route.modify" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2444", "external_name": "Network Route Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.route.monitor", "stable_id": "OSCO-CAP-0457", "name": "Monitor Route", "description": "Perform monitor operation on route in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.route.monitor" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.route.monitor", "type": "safe_execute", "description": "Safely verify network.route.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.route.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for network.route.monitor" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2445", "external_name": "Network Route Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.route.open", "stable_id": "OSCO-CAP-0453", "name": "Open Route", "description": "Perform open operation on route in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.route.open" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.route.open", "type": "safe_execute", "description": "Safely verify network.route.open with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.route.open", "type": "declared", "state": "declared", "description": "Discover declared support for network.route.open" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2441", "external_name": "Network Route Open", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.socket.close", "stable_id": "OSCO-CAP-0444", "name": "Close Socket", "description": "Perform close operation on socket in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.socket.close" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "socket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.socket.close", "type": "safe_execute", "description": "Safely verify network.socket.close with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.socket.close", "type": "declared", "state": "declared", "description": "Discover declared support for network.socket.close" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2432", "external_name": "Network Socket Close", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.socket.inspect", "stable_id": "OSCO-CAP-0445", "name": "Inspect Socket", "description": "Perform inspect operation on socket in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.socket.inspect" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "socket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.socket.inspect", "type": "safe_execute", "description": "Safely verify network.socket.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.socket.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for network.socket.inspect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2433", "external_name": "Network Socket Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.socket.modify", "stable_id": "OSCO-CAP-0446", "name": "Modify Socket", "description": "Perform modify operation on socket in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.socket.modify" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "socket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.socket.modify", "type": "safe_execute", "description": "Safely verify network.socket.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.socket.modify", "type": "declared", "state": "declared", "description": "Discover declared support for network.socket.modify" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2434", "external_name": "Network Socket Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.socket.monitor", "stable_id": "OSCO-CAP-0447", "name": "Monitor Socket", "description": "Perform monitor operation on socket in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.socket.monitor" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "socket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.socket.monitor", "type": "safe_execute", "description": "Safely verify network.socket.monitor with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.socket.monitor", "type": "declared", "state": "declared", "description": "Discover declared support for network.socket.monitor" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2435", "external_name": "Network Socket Monitor", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "network.socket.open", "stable_id": "OSCO-CAP-0443", "name": "Open Socket", "description": "Perform open operation on socket in the network domain.", "category": "network", "domain": "network", "platforms": [ "windows", "linux", "macos", "container", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.docker", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "network.socket.open" ], "preconditions": [ "provider exposes network capability surface" ], "postconditions": [ "socket state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.network.socket.open", "type": "safe_execute", "description": "Safely verify network.socket.open with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.network.socket.open", "type": "declared", "state": "declared", "description": "Discover declared support for network.socket.open" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2431", "external_name": "Network Socket Open", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.addin.create", "stable_id": "OSCO-CAP-0648", "name": "Create Addin", "description": "Perform create operation on addin in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.addin.create" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "addin state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.addin.create", "type": "safe_execute", "description": "Safely verify office.addin.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.addin.create", "type": "declared", "state": "declared", "description": "Discover declared support for office.addin.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2636", "external_name": "Office Addin Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.addin.delete", "stable_id": "OSCO-CAP-0652", "name": "Delete Addin", "description": "Perform delete operation on addin in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.addin.delete" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "addin state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.addin.delete", "type": "safe_execute", "description": "Safely verify office.addin.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.addin.delete", "type": "declared", "state": "declared", "description": "Discover declared support for office.addin.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2640", "external_name": "Office Addin Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.addin.disable", "stable_id": "OSCO-CAP-0650", "name": "Disable Addin", "description": "Perform disable operation on addin in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.addin.disable" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "addin state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.addin.disable", "type": "safe_execute", "description": "Safely verify office.addin.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.addin.disable", "type": "declared", "state": "declared", "description": "Discover declared support for office.addin.disable" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2638", "external_name": "Office Addin Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.addin.execute", "stable_id": "OSCO-CAP-0649", "name": "Execute Addin", "description": "Perform execute operation on addin in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.addin.execute" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "addin state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.addin.execute", "type": "safe_execute", "description": "Safely verify office.addin.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.addin.execute", "type": "declared", "state": "declared", "description": "Discover declared support for office.addin.execute" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2637", "external_name": "Office Addin Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.addin.inspect", "stable_id": "OSCO-CAP-0651", "name": "Inspect Addin", "description": "Perform inspect operation on addin in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.addin.inspect" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "addin state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.addin.inspect", "type": "safe_execute", "description": "Safely verify office.addin.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.addin.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for office.addin.inspect" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2639", "external_name": "Office Addin Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.document.create", "stable_id": "OSCO-CAP-0653", "name": "Create Document", "description": "Perform create operation on document in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.document.create" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "document state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.document.create", "type": "safe_execute", "description": "Safely verify office.document.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.document.create", "type": "declared", "state": "declared", "description": "Discover declared support for office.document.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2641", "external_name": "Office Document Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.document.delete", "stable_id": "OSCO-CAP-0657", "name": "Delete Document", "description": "Perform delete operation on document in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.document.delete" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "document state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.document.delete", "type": "safe_execute", "description": "Safely verify office.document.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.document.delete", "type": "declared", "state": "declared", "description": "Discover declared support for office.document.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2645", "external_name": "Office Document Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.document.disable", "stable_id": "OSCO-CAP-0655", "name": "Disable Document", "description": "Perform disable operation on document in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.document.disable" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "document state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.document.disable", "type": "safe_execute", "description": "Safely verify office.document.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.document.disable", "type": "declared", "state": "declared", "description": "Discover declared support for office.document.disable" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2643", "external_name": "Office Document Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.document.execute", "stable_id": "OSCO-CAP-0654", "name": "Execute Document", "description": "Perform execute operation on document in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.document.execute" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "document state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.document.execute", "type": "safe_execute", "description": "Safely verify office.document.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.document.execute", "type": "declared", "state": "declared", "description": "Discover declared support for office.document.execute" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2642", "external_name": "Office Document Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.document.inspect", "stable_id": "OSCO-CAP-0656", "name": "Inspect Document", "description": "Perform inspect operation on document in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.document.inspect" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "document state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.document.inspect", "type": "safe_execute", "description": "Safely verify office.document.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.document.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for office.document.inspect" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2644", "external_name": "Office Document Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.macro.create", "stable_id": "OSCO-CAP-0643", "name": "Create Macro", "description": "Perform create operation on macro in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.macro.create" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "macro state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.macro.create", "type": "safe_execute", "description": "Safely verify office.macro.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.macro.create", "type": "declared", "state": "declared", "description": "Discover declared support for office.macro.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2631", "external_name": "Office Macro Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.macro.delete", "stable_id": "OSCO-CAP-0647", "name": "Delete Macro", "description": "Perform delete operation on macro in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.macro.delete" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "macro state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.macro.delete", "type": "safe_execute", "description": "Safely verify office.macro.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.macro.delete", "type": "declared", "state": "declared", "description": "Discover declared support for office.macro.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2635", "external_name": "Office Macro Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.macro.disable", "stable_id": "OSCO-CAP-0645", "name": "Disable Macro", "description": "Perform disable operation on macro in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.macro.disable" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "macro state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.macro.disable", "type": "safe_execute", "description": "Safely verify office.macro.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.macro.disable", "type": "declared", "state": "declared", "description": "Discover declared support for office.macro.disable" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2633", "external_name": "Office Macro Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.macro.execute", "stable_id": "OSCO-CAP-0644", "name": "Execute Macro", "description": "Perform execute operation on macro in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.macro.execute" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "macro state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.macro.execute", "type": "safe_execute", "description": "Safely verify office.macro.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.macro.execute", "type": "declared", "state": "declared", "description": "Discover declared support for office.macro.execute" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2632", "external_name": "Office Macro Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.macro.inspect", "stable_id": "OSCO-CAP-0646", "name": "Inspect Macro", "description": "Perform inspect operation on macro in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.macro.inspect" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "macro state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.macro.inspect", "type": "safe_execute", "description": "Safely verify office.macro.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.macro.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for office.macro.inspect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2634", "external_name": "Office Macro Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.template.create", "stable_id": "OSCO-CAP-0658", "name": "Create Template", "description": "Perform create operation on template in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.template.create" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.template.create", "type": "safe_execute", "description": "Safely verify office.template.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.template.create", "type": "declared", "state": "declared", "description": "Discover declared support for office.template.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2646", "external_name": "Office Template Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.template.delete", "stable_id": "OSCO-CAP-0662", "name": "Delete Template", "description": "Perform delete operation on template in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.template.delete" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.template.delete", "type": "safe_execute", "description": "Safely verify office.template.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.template.delete", "type": "declared", "state": "declared", "description": "Discover declared support for office.template.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2650", "external_name": "Office Template Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.template.disable", "stable_id": "OSCO-CAP-0660", "name": "Disable Template", "description": "Perform disable operation on template in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.template.disable" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.template.disable", "type": "safe_execute", "description": "Safely verify office.template.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.template.disable", "type": "declared", "state": "declared", "description": "Discover declared support for office.template.disable" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2648", "external_name": "Office Template Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.template.execute", "stable_id": "OSCO-CAP-0659", "name": "Execute Template", "description": "Perform execute operation on template in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.template.execute" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.template.execute", "type": "safe_execute", "description": "Safely verify office.template.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.template.execute", "type": "declared", "state": "declared", "description": "Discover declared support for office.template.execute" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2647", "external_name": "Office Template Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "office.template.inspect", "stable_id": "OSCO-CAP-0661", "name": "Inspect Template", "description": "Perform inspect operation on template in the office domain.", "category": "saas", "domain": "office", "platforms": [ "saas", "windows", "macos" ], "providers": [ "provider.microsoft365" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "office.template.inspect" ], "preconditions": [ "provider exposes office capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.office.template.inspect", "type": "safe_execute", "description": "Safely verify office.template.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.office.template.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for office.template.inspect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2649", "external_name": "Office Template Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.command.constrain", "stable_id": "OSCO-CAP-0636", "name": "Constrain Command", "description": "Perform constrain operation on command in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.command.constrain" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "command state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.command.constrain", "type": "safe_execute", "description": "Safely verify powershell.command.constrain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.command.constrain", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.command.constrain" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2624", "external_name": "Powershell Command Constrain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.command.execute", "stable_id": "OSCO-CAP-0633", "name": "Execute Command", "description": "Perform execute operation on command in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.command.execute" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "command state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.command.execute", "type": "safe_execute", "description": "Safely verify powershell.command.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.command.execute", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.command.execute" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2621", "external_name": "Powershell Command Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.command.import", "stable_id": "OSCO-CAP-0634", "name": "Import Command", "description": "Perform import operation on command in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.command.import" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "command state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.command.import", "type": "safe_execute", "description": "Safely verify powershell.command.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.command.import", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.command.import" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2622", "external_name": "Powershell Command Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.command.inspect", "stable_id": "OSCO-CAP-0635", "name": "Inspect Command", "description": "Perform inspect operation on command in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.command.inspect" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "command state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.command.inspect", "type": "safe_execute", "description": "Safely verify powershell.command.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.command.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.command.inspect" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2623", "external_name": "Powershell Command Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.command.log", "stable_id": "OSCO-CAP-0637", "name": "Log Command", "description": "Perform log operation on command in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.command.log" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "command state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.command.log", "type": "safe_execute", "description": "Safely verify powershell.command.log with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.command.log", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.command.log" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2625", "external_name": "Powershell Command Log", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.module.constrain", "stable_id": "OSCO-CAP-0631", "name": "Constrain Module", "description": "Perform constrain operation on module in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.module.constrain" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.module.constrain", "type": "safe_execute", "description": "Safely verify powershell.module.constrain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.module.constrain", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.module.constrain" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2619", "external_name": "Powershell Module Constrain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.module.execute", "stable_id": "OSCO-CAP-0628", "name": "Execute Module", "description": "Perform execute operation on module in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.module.execute" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.module.execute", "type": "safe_execute", "description": "Safely verify powershell.module.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.module.execute", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.module.execute" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2616", "external_name": "Powershell Module Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.module.import", "stable_id": "OSCO-CAP-0629", "name": "Import Module", "description": "Perform import operation on module in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.module.import" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.module.import", "type": "safe_execute", "description": "Safely verify powershell.module.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.module.import", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.module.import" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2617", "external_name": "Powershell Module Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.module.inspect", "stable_id": "OSCO-CAP-0630", "name": "Inspect Module", "description": "Perform inspect operation on module in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.module.inspect" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.module.inspect", "type": "safe_execute", "description": "Safely verify powershell.module.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.module.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.module.inspect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2618", "external_name": "Powershell Module Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.module.log", "stable_id": "OSCO-CAP-0632", "name": "Log Module", "description": "Perform log operation on module in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.module.log" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "module state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.module.log", "type": "safe_execute", "description": "Safely verify powershell.module.log with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.module.log", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.module.log" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2620", "external_name": "Powershell Module Log", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.runspace.constrain", "stable_id": "OSCO-CAP-0641", "name": "Constrain Runspace", "description": "Perform constrain operation on runspace in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.runspace.constrain" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "runspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.runspace.constrain", "type": "safe_execute", "description": "Safely verify powershell.runspace.constrain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.runspace.constrain", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.runspace.constrain" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2629", "external_name": "Powershell Runspace Constrain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.runspace.execute", "stable_id": "OSCO-CAP-0638", "name": "Execute Runspace", "description": "Perform execute operation on runspace in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.runspace.execute" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "runspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.runspace.execute", "type": "safe_execute", "description": "Safely verify powershell.runspace.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.runspace.execute", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.runspace.execute" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2626", "external_name": "Powershell Runspace Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.runspace.import", "stable_id": "OSCO-CAP-0639", "name": "Import Runspace", "description": "Perform import operation on runspace in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.runspace.import" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "runspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.runspace.import", "type": "safe_execute", "description": "Safely verify powershell.runspace.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.runspace.import", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.runspace.import" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2627", "external_name": "Powershell Runspace Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.runspace.inspect", "stable_id": "OSCO-CAP-0640", "name": "Inspect Runspace", "description": "Perform inspect operation on runspace in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.runspace.inspect" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "runspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.runspace.inspect", "type": "safe_execute", "description": "Safely verify powershell.runspace.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.runspace.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.runspace.inspect" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2628", "external_name": "Powershell Runspace Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.runspace.log", "stable_id": "OSCO-CAP-0642", "name": "Log Runspace", "description": "Perform log operation on runspace in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.runspace.log" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "runspace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.runspace.log", "type": "safe_execute", "description": "Safely verify powershell.runspace.log with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.runspace.log", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.runspace.log" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2630", "external_name": "Powershell Runspace Log", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.script.constrain", "stable_id": "OSCO-CAP-0626", "name": "Constrain Script", "description": "Perform constrain operation on script in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.script.constrain" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "script state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.script.constrain", "type": "safe_execute", "description": "Safely verify powershell.script.constrain with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.script.constrain", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.script.constrain" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2614", "external_name": "Powershell Script Constrain", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.script.execute", "stable_id": "OSCO-CAP-0623", "name": "Execute Script", "description": "Perform execute operation on script in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.script.execute" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "script state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.script.execute", "type": "safe_execute", "description": "Safely verify powershell.script.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.script.execute", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.script.execute" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2611", "external_name": "Powershell Script Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.script.import", "stable_id": "OSCO-CAP-0624", "name": "Import Script", "description": "Perform import operation on script in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.script.import" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "script state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.script.import", "type": "safe_execute", "description": "Safely verify powershell.script.import with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.script.import", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.script.import" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2612", "external_name": "Powershell Script Import", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.script.inspect", "stable_id": "OSCO-CAP-0625", "name": "Inspect Script", "description": "Perform inspect operation on script in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.script.inspect" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "script state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.script.inspect", "type": "safe_execute", "description": "Safely verify powershell.script.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.script.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.script.inspect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2613", "external_name": "Powershell Script Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "powershell.script.log", "stable_id": "OSCO-CAP-0627", "name": "Log Script", "description": "Perform log operation on script in the powershell domain.", "category": "endpoint", "domain": "powershell", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "powershell.script.log" ], "preconditions": [ "provider exposes powershell capability surface" ], "postconditions": [ "script state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.powershell.script.log", "type": "safe_execute", "description": "Safely verify powershell.script.log with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.powershell.script.log", "type": "declared", "state": "declared", "description": "Discover declared support for powershell.script.log" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2615", "external_name": "Powershell Script Log", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.context.delegate", "stable_id": "OSCO-CAP-0400", "name": "Delegate Context", "description": "Perform delegate operation on context in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.context.delegate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.context.delegate", "type": "safe_execute", "description": "Safely verify privilege.context.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.context.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.context.delegate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2388", "external_name": "Privilege Context Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.context.drop", "stable_id": "OSCO-CAP-0399", "name": "Drop Context", "description": "Perform drop operation on context in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.context.drop" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.context.drop", "type": "safe_execute", "description": "Safely verify privilege.context.drop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.context.drop", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.context.drop" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2387", "external_name": "Privilege Context Drop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.context.escalate", "stable_id": "OSCO-CAP-0398", "name": "Escalate Context", "description": "Perform escalate operation on context in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.context.escalate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.context.escalate", "type": "safe_execute", "description": "Safely verify privilege.context.escalate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.context.escalate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.context.escalate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2386", "external_name": "Privilege Context Escalate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.context.inspect", "stable_id": "OSCO-CAP-0401", "name": "Inspect Context", "description": "Perform inspect operation on context in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.context.inspect" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.context.inspect", "type": "safe_execute", "description": "Safely verify privilege.context.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.context.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.context.inspect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2389", "external_name": "Privilege Context Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.context.restrict", "stable_id": "OSCO-CAP-0402", "name": "Restrict Context", "description": "Perform restrict operation on context in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.context.restrict" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.context.restrict", "type": "safe_execute", "description": "Safely verify privilege.context.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.context.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.context.restrict" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2390", "external_name": "Privilege Context Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.permission_set.delegate", "stable_id": "OSCO-CAP-0395", "name": "Delegate Permission Set", "description": "Perform delegate operation on permission set in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.permission_set.delegate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "permission set state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.permission_set.delegate", "type": "safe_execute", "description": "Safely verify privilege.permission_set.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.permission_set.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.permission_set.delegate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2383", "external_name": "Privilege Permission Set Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.permission_set.drop", "stable_id": "OSCO-CAP-0394", "name": "Drop Permission Set", "description": "Perform drop operation on permission set in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.permission_set.drop" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "permission set state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.permission_set.drop", "type": "safe_execute", "description": "Safely verify privilege.permission_set.drop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.permission_set.drop", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.permission_set.drop" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2382", "external_name": "Privilege Permission Set Drop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.permission_set.escalate", "stable_id": "OSCO-CAP-0393", "name": "Escalate Permission Set", "description": "Perform escalate operation on permission set in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.permission_set.escalate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "permission set state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.permission_set.escalate", "type": "safe_execute", "description": "Safely verify privilege.permission_set.escalate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.permission_set.escalate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.permission_set.escalate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2381", "external_name": "Privilege Permission Set Escalate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.permission_set.inspect", "stable_id": "OSCO-CAP-0396", "name": "Inspect Permission Set", "description": "Perform inspect operation on permission set in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.permission_set.inspect" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "permission set state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.permission_set.inspect", "type": "safe_execute", "description": "Safely verify privilege.permission_set.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.permission_set.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.permission_set.inspect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2384", "external_name": "Privilege Permission Set Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.permission_set.restrict", "stable_id": "OSCO-CAP-0397", "name": "Restrict Permission Set", "description": "Perform restrict operation on permission set in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.permission_set.restrict" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "permission set state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.permission_set.restrict", "type": "safe_execute", "description": "Safely verify privilege.permission_set.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.permission_set.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.permission_set.restrict" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2385", "external_name": "Privilege Permission Set Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.role.delegate", "stable_id": "OSCO-CAP-0390", "name": "Delegate Role", "description": "Perform delegate operation on role in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.role.delegate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.role.delegate", "type": "safe_execute", "description": "Safely verify privilege.role.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.role.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.role.delegate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2378", "external_name": "Privilege Role Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.role.drop", "stable_id": "OSCO-CAP-0389", "name": "Drop Role", "description": "Perform drop operation on role in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.role.drop" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.role.drop", "type": "safe_execute", "description": "Safely verify privilege.role.drop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.role.drop", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.role.drop" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2377", "external_name": "Privilege Role Drop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.role.escalate", "stable_id": "OSCO-CAP-0388", "name": "Escalate Role", "description": "Perform escalate operation on role in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.role.escalate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.role.escalate", "type": "safe_execute", "description": "Safely verify privilege.role.escalate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.role.escalate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.role.escalate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2376", "external_name": "Privilege Role Escalate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.role.inspect", "stable_id": "OSCO-CAP-0391", "name": "Inspect Role", "description": "Perform inspect operation on role in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.role.inspect" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.role.inspect", "type": "safe_execute", "description": "Safely verify privilege.role.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.role.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.role.inspect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2379", "external_name": "Privilege Role Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.role.restrict", "stable_id": "OSCO-CAP-0392", "name": "Restrict Role", "description": "Perform restrict operation on role in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.role.restrict" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "role state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.role.restrict", "type": "safe_execute", "description": "Safely verify privilege.role.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.role.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.role.restrict" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2380", "external_name": "Privilege Role Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.token.delegate", "stable_id": "OSCO-CAP-0385", "name": "Delegate Token", "description": "Perform delegate operation on token in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.token.delegate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.token.delegate", "type": "safe_execute", "description": "Safely verify privilege.token.delegate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.token.delegate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.token.delegate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2373", "external_name": "Privilege Token Delegate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.token.drop", "stable_id": "OSCO-CAP-0384", "name": "Drop Token", "description": "Perform drop operation on token in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.token.drop" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.token.drop", "type": "safe_execute", "description": "Safely verify privilege.token.drop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.token.drop", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.token.drop" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2372", "external_name": "Privilege Token Drop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.token.escalate", "stable_id": "OSCO-CAP-0383", "name": "Escalate Token", "description": "Perform escalate operation on token in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.token.escalate" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.token.escalate", "type": "safe_execute", "description": "Safely verify privilege.token.escalate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.token.escalate", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.token.escalate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2371", "external_name": "Privilege Token Escalate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.token.inspect", "stable_id": "OSCO-CAP-0386", "name": "Inspect Token", "description": "Perform inspect operation on token in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.token.inspect" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.token.inspect", "type": "safe_execute", "description": "Safely verify privilege.token.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.token.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.token.inspect" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2374", "external_name": "Privilege Token Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "privilege.token.restrict", "stable_id": "OSCO-CAP-0387", "name": "Restrict Token", "description": "Perform restrict operation on token in the privilege domain.", "category": "identity", "domain": "privilege", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.8, "safety": "destructive", "required_privileges": [ "privilege.token.restrict" ], "preconditions": [ "provider exposes privilege capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": false, "verification_methods": [ { "method_id": "verify.privilege.token.restrict", "type": "safe_execute", "description": "Safely verify privilege.token.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.privilege.token.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for privilege.token.restrict" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2375", "external_name": "Privilege Token Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.argument.create", "stable_id": "OSCO-CAP-0073", "name": "Create Argument", "description": "Perform create operation on argument in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.argument.create" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "argument state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.argument.create", "type": "safe_execute", "description": "Safely verify process.argument.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.argument.create", "type": "declared", "state": "declared", "description": "Discover declared support for process.argument.create" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2061", "external_name": "Process Argument Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.argument.enumerate", "stable_id": "OSCO-CAP-0078", "name": "Enumerate Argument", "description": "Perform enumerate operation on argument in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.argument.enumerate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "argument state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.argument.enumerate", "type": "safe_execute", "description": "Safely verify process.argument.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.argument.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for process.argument.enumerate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2066", "external_name": "Process Argument Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.argument.inject", "stable_id": "OSCO-CAP-0076", "name": "Inject Argument", "description": "Perform inject operation on argument in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.argument.inject" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "argument state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.argument.inject", "type": "safe_execute", "description": "Safely verify process.argument.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.argument.inject", "type": "declared", "state": "declared", "description": "Discover declared support for process.argument.inject" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2064", "external_name": "Process Argument Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.argument.modify", "stable_id": "OSCO-CAP-0075", "name": "Modify Argument", "description": "Perform modify operation on argument in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.argument.modify" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "argument state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.argument.modify", "type": "safe_execute", "description": "Safely verify process.argument.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.argument.modify", "type": "declared", "state": "declared", "description": "Discover declared support for process.argument.modify" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2063", "external_name": "Process Argument Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.argument.read", "stable_id": "OSCO-CAP-0074", "name": "Read Argument", "description": "Perform read operation on argument in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.argument.read" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "argument state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.argument.read", "type": "safe_execute", "description": "Safely verify process.argument.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.argument.read", "type": "declared", "state": "declared", "description": "Discover declared support for process.argument.read" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2062", "external_name": "Process Argument Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.argument.terminate", "stable_id": "OSCO-CAP-0077", "name": "Terminate Argument", "description": "Perform terminate operation on argument in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.argument.terminate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "argument state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.argument.terminate", "type": "safe_execute", "description": "Safely verify process.argument.terminate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.argument.terminate", "type": "declared", "state": "declared", "description": "Discover declared support for process.argument.terminate" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2065", "external_name": "Process Argument Terminate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.environment.create", "stable_id": "OSCO-CAP-0079", "name": "Create Environment", "description": "Perform create operation on environment in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.environment.create" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "environment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.environment.create", "type": "safe_execute", "description": "Safely verify process.environment.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.environment.create", "type": "declared", "state": "declared", "description": "Discover declared support for process.environment.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2067", "external_name": "Process Environment Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.environment.enumerate", "stable_id": "OSCO-CAP-0084", "name": "Enumerate Environment", "description": "Perform enumerate operation on environment in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.environment.enumerate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "environment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.environment.enumerate", "type": "safe_execute", "description": "Safely verify process.environment.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.environment.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for process.environment.enumerate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2072", "external_name": "Process Environment Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.environment.inject", "stable_id": "OSCO-CAP-0082", "name": "Inject Environment", "description": "Perform inject operation on environment in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.environment.inject" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "environment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.environment.inject", "type": "safe_execute", "description": "Safely verify process.environment.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.environment.inject", "type": "declared", "state": "declared", "description": "Discover declared support for process.environment.inject" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2070", "external_name": "Process Environment Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.environment.modify", "stable_id": "OSCO-CAP-0081", "name": "Modify Environment", "description": "Perform modify operation on environment in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.environment.modify" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "environment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.environment.modify", "type": "safe_execute", "description": "Safely verify process.environment.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.environment.modify", "type": "declared", "state": "declared", "description": "Discover declared support for process.environment.modify" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2069", "external_name": "Process Environment Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.environment.read", "stable_id": "OSCO-CAP-0080", "name": "Read Environment", "description": "Perform read operation on environment in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.environment.read" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "environment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.environment.read", "type": "safe_execute", "description": "Safely verify process.environment.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.environment.read", "type": "declared", "state": "declared", "description": "Discover declared support for process.environment.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2068", "external_name": "Process Environment Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.environment.terminate", "stable_id": "OSCO-CAP-0083", "name": "Terminate Environment", "description": "Perform terminate operation on environment in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.environment.terminate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "environment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.environment.terminate", "type": "safe_execute", "description": "Safely verify process.environment.terminate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.environment.terminate", "type": "declared", "state": "declared", "description": "Discover declared support for process.environment.terminate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2071", "external_name": "Process Environment Terminate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.process.create", "stable_id": "OSCO-CAP-0061", "name": "Create Process", "description": "Perform create operation on process in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.process.create" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "process state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.process.create", "type": "safe_execute", "description": "Safely verify process.process.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.process.create", "type": "declared", "state": "declared", "description": "Discover declared support for process.process.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2049", "external_name": "Process Process Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.process.enumerate", "stable_id": "OSCO-CAP-0066", "name": "Enumerate Process", "description": "Perform enumerate operation on process in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.process.enumerate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "process state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.process.enumerate", "type": "safe_execute", "description": "Safely verify process.process.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.process.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for process.process.enumerate" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2054", "external_name": "Process Process Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.process.inject", "stable_id": "OSCO-CAP-0064", "name": "Inject Process", "description": "Perform inject operation on process in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.process.inject" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "process state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.process.inject", "type": "safe_execute", "description": "Safely verify process.process.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.process.inject", "type": "declared", "state": "declared", "description": "Discover declared support for process.process.inject" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2052", "external_name": "Process Process Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.process.modify", "stable_id": "OSCO-CAP-0063", "name": "Modify Process", "description": "Perform modify operation on process in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.process.modify" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "process state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.process.modify", "type": "safe_execute", "description": "Safely verify process.process.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.process.modify", "type": "declared", "state": "declared", "description": "Discover declared support for process.process.modify" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2051", "external_name": "Process Process Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.process.read", "stable_id": "OSCO-CAP-0062", "name": "Read Process", "description": "Perform read operation on process in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.process.read" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "process state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.process.read", "type": "safe_execute", "description": "Safely verify process.process.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.process.read", "type": "declared", "state": "declared", "description": "Discover declared support for process.process.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2050", "external_name": "Process Process Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.process.terminate", "stable_id": "OSCO-CAP-0065", "name": "Terminate Process", "description": "Perform terminate operation on process in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.process.terminate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "process state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.process.terminate", "type": "safe_execute", "description": "Safely verify process.process.terminate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.process.terminate", "type": "declared", "state": "declared", "description": "Discover declared support for process.process.terminate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2053", "external_name": "Process Process Terminate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.token.create", "stable_id": "OSCO-CAP-0067", "name": "Create Token", "description": "Perform create operation on token in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.token.create" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.token.create", "type": "safe_execute", "description": "Safely verify process.token.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.token.create", "type": "declared", "state": "declared", "description": "Discover declared support for process.token.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2055", "external_name": "Process Token Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.token.enumerate", "stable_id": "OSCO-CAP-0072", "name": "Enumerate Token", "description": "Perform enumerate operation on token in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.token.enumerate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.token.enumerate", "type": "safe_execute", "description": "Safely verify process.token.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.token.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for process.token.enumerate" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2060", "external_name": "Process Token Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.token.inject", "stable_id": "OSCO-CAP-0070", "name": "Inject Token", "description": "Perform inject operation on token in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.token.inject" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.token.inject", "type": "safe_execute", "description": "Safely verify process.token.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.token.inject", "type": "declared", "state": "declared", "description": "Discover declared support for process.token.inject" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2058", "external_name": "Process Token Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.token.modify", "stable_id": "OSCO-CAP-0069", "name": "Modify Token", "description": "Perform modify operation on token in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.token.modify" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.token.modify", "type": "safe_execute", "description": "Safely verify process.token.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.token.modify", "type": "declared", "state": "declared", "description": "Discover declared support for process.token.modify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2057", "external_name": "Process Token Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.token.read", "stable_id": "OSCO-CAP-0068", "name": "Read Token", "description": "Perform read operation on token in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.token.read" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.token.read", "type": "safe_execute", "description": "Safely verify process.token.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.token.read", "type": "declared", "state": "declared", "description": "Discover declared support for process.token.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2056", "external_name": "Process Token Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "process.token.terminate", "stable_id": "OSCO-CAP-0071", "name": "Terminate Token", "description": "Perform terminate operation on token in the process domain.", "category": "endpoint", "domain": "process", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "process.token.terminate" ], "preconditions": [ "provider exposes process capability surface" ], "postconditions": [ "token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.process.token.terminate", "type": "safe_execute", "description": "Safely verify process.token.terminate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.process.token.terminate", "type": "declared", "state": "declared", "description": "Discover declared support for process.token.terminate" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2059", "external_name": "Process Token Terminate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.configuration.bypass", "stable_id": "OSCO-CAP-0506", "name": "Bypass Configuration", "description": "Perform bypass operation on configuration in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.configuration.bypass" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "configuration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.configuration.bypass", "type": "safe_execute", "description": "Safely verify proxy.configuration.bypass with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.configuration.bypass", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.configuration.bypass" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2494", "external_name": "Proxy Configuration Bypass", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.configuration.delete", "stable_id": "OSCO-CAP-0505", "name": "Delete Configuration", "description": "Perform delete operation on configuration in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.configuration.delete" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "configuration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.configuration.delete", "type": "safe_execute", "description": "Safely verify proxy.configuration.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.configuration.delete", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.configuration.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2493", "external_name": "Proxy Configuration Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.configuration.enforce", "stable_id": "OSCO-CAP-0507", "name": "Enforce Configuration", "description": "Perform enforce operation on configuration in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.configuration.enforce" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "configuration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.configuration.enforce", "type": "safe_execute", "description": "Safely verify proxy.configuration.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.configuration.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.configuration.enforce" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2495", "external_name": "Proxy Configuration Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.configuration.read", "stable_id": "OSCO-CAP-0504", "name": "Read Configuration", "description": "Perform read operation on configuration in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.configuration.read" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "configuration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.configuration.read", "type": "safe_execute", "description": "Safely verify proxy.configuration.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.configuration.read", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.configuration.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2492", "external_name": "Proxy Configuration Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.configuration.set", "stable_id": "OSCO-CAP-0503", "name": "Set Configuration", "description": "Perform set operation on configuration in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.configuration.set" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "configuration state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.configuration.set", "type": "safe_execute", "description": "Safely verify proxy.configuration.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.configuration.set", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.configuration.set" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2491", "external_name": "Proxy Configuration Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.credential.bypass", "stable_id": "OSCO-CAP-0521", "name": "Bypass Credential", "description": "Perform bypass operation on credential in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.credential.bypass" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.credential.bypass", "type": "safe_execute", "description": "Safely verify proxy.credential.bypass with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.credential.bypass", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.credential.bypass" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2509", "external_name": "Proxy Credential Bypass", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.credential.delete", "stable_id": "OSCO-CAP-0520", "name": "Delete Credential", "description": "Perform delete operation on credential in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.credential.delete" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.credential.delete", "type": "safe_execute", "description": "Safely verify proxy.credential.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.credential.delete", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.credential.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2508", "external_name": "Proxy Credential Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.credential.enforce", "stable_id": "OSCO-CAP-0522", "name": "Enforce Credential", "description": "Perform enforce operation on credential in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.credential.enforce" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.credential.enforce", "type": "safe_execute", "description": "Safely verify proxy.credential.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.credential.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.credential.enforce" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2510", "external_name": "Proxy Credential Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.credential.read", "stable_id": "OSCO-CAP-0519", "name": "Read Credential", "description": "Perform read operation on credential in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.credential.read" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.credential.read", "type": "safe_execute", "description": "Safely verify proxy.credential.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.credential.read", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.credential.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2507", "external_name": "Proxy Credential Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.credential.set", "stable_id": "OSCO-CAP-0518", "name": "Set Credential", "description": "Perform set operation on credential in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.credential.set" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "credential state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.credential.set", "type": "safe_execute", "description": "Safely verify proxy.credential.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.credential.set", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.credential.set" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2506", "external_name": "Proxy Credential Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.route.bypass", "stable_id": "OSCO-CAP-0516", "name": "Bypass Route", "description": "Perform bypass operation on route in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.route.bypass" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.route.bypass", "type": "safe_execute", "description": "Safely verify proxy.route.bypass with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.route.bypass", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.route.bypass" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2504", "external_name": "Proxy Route Bypass", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.route.delete", "stable_id": "OSCO-CAP-0515", "name": "Delete Route", "description": "Perform delete operation on route in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.route.delete" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.route.delete", "type": "safe_execute", "description": "Safely verify proxy.route.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.route.delete", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.route.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2503", "external_name": "Proxy Route Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.route.enforce", "stable_id": "OSCO-CAP-0517", "name": "Enforce Route", "description": "Perform enforce operation on route in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.route.enforce" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.route.enforce", "type": "safe_execute", "description": "Safely verify proxy.route.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.route.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.route.enforce" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2505", "external_name": "Proxy Route Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.route.read", "stable_id": "OSCO-CAP-0514", "name": "Read Route", "description": "Perform read operation on route in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.route.read" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.route.read", "type": "safe_execute", "description": "Safely verify proxy.route.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.route.read", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.route.read" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2502", "external_name": "Proxy Route Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.route.set", "stable_id": "OSCO-CAP-0513", "name": "Set Route", "description": "Perform set operation on route in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.route.set" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "route state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.route.set", "type": "safe_execute", "description": "Safely verify proxy.route.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.route.set", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.route.set" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2501", "external_name": "Proxy Route Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.rule.bypass", "stable_id": "OSCO-CAP-0511", "name": "Bypass Rule", "description": "Perform bypass operation on rule in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.rule.bypass" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.rule.bypass", "type": "safe_execute", "description": "Safely verify proxy.rule.bypass with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.rule.bypass", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.rule.bypass" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2499", "external_name": "Proxy Rule Bypass", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.rule.delete", "stable_id": "OSCO-CAP-0510", "name": "Delete Rule", "description": "Perform delete operation on rule in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.rule.delete" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.rule.delete", "type": "safe_execute", "description": "Safely verify proxy.rule.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.rule.delete", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.rule.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2498", "external_name": "Proxy Rule Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.rule.enforce", "stable_id": "OSCO-CAP-0512", "name": "Enforce Rule", "description": "Perform enforce operation on rule in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.rule.enforce" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.rule.enforce", "type": "safe_execute", "description": "Safely verify proxy.rule.enforce with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.rule.enforce", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.rule.enforce" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2500", "external_name": "Proxy Rule Enforce", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.rule.read", "stable_id": "OSCO-CAP-0509", "name": "Read Rule", "description": "Perform read operation on rule in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.rule.read" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.rule.read", "type": "safe_execute", "description": "Safely verify proxy.rule.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.rule.read", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.rule.read" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2497", "external_name": "Proxy Rule Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "proxy.rule.set", "stable_id": "OSCO-CAP-0508", "name": "Set Rule", "description": "Perform set operation on rule in the proxy domain.", "category": "network", "domain": "proxy", "platforms": [ "windows", "linux", "macos", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "proxy.rule.set" ], "preconditions": [ "provider exposes proxy capability surface" ], "postconditions": [ "rule state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.proxy.rule.set", "type": "safe_execute", "description": "Safely verify proxy.rule.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.proxy.rule.set", "type": "declared", "state": "declared", "description": "Discover declared support for proxy.rule.set" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2496", "external_name": "Proxy Rule Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.hive.backup", "stable_id": "OSCO-CAP-0055", "name": "Backup Hive", "description": "Perform backup operation on hive in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.hive.backup" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "hive state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.hive.backup", "type": "safe_execute", "description": "Safely verify registry.hive.backup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.hive.backup", "type": "declared", "state": "declared", "description": "Discover declared support for registry.hive.backup" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2043", "external_name": "Registry Hive Backup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.hive.delete", "stable_id": "OSCO-CAP-0053", "name": "Delete Hive", "description": "Perform delete operation on hive in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.hive.delete" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "hive state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.hive.delete", "type": "safe_execute", "description": "Safely verify registry.hive.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.hive.delete", "type": "declared", "state": "declared", "description": "Discover declared support for registry.hive.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2041", "external_name": "Registry Hive Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.hive.enumerate", "stable_id": "OSCO-CAP-0054", "name": "Enumerate Hive", "description": "Perform enumerate operation on hive in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.hive.enumerate" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "hive state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.hive.enumerate", "type": "safe_execute", "description": "Safely verify registry.hive.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.hive.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for registry.hive.enumerate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2042", "external_name": "Registry Hive Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.hive.read", "stable_id": "OSCO-CAP-0052", "name": "Read Hive", "description": "Perform read operation on hive in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.hive.read" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "hive state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.hive.read", "type": "safe_execute", "description": "Safely verify registry.hive.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.hive.read", "type": "declared", "state": "declared", "description": "Discover declared support for registry.hive.read" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2040", "external_name": "Registry Hive Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.hive.set", "stable_id": "OSCO-CAP-0051", "name": "Set Hive", "description": "Perform set operation on hive in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.hive.set" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "hive state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.hive.set", "type": "safe_execute", "description": "Safely verify registry.hive.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.hive.set", "type": "declared", "state": "declared", "description": "Discover declared support for registry.hive.set" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2039", "external_name": "Registry Hive Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.key.backup", "stable_id": "OSCO-CAP-0045", "name": "Backup Key", "description": "Perform backup operation on key in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.key.backup" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.key.backup", "type": "safe_execute", "description": "Safely verify registry.key.backup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.key.backup", "type": "declared", "state": "declared", "description": "Discover declared support for registry.key.backup" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2033", "external_name": "Registry Key Backup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.key.delete", "stable_id": "OSCO-CAP-0043", "name": "Delete Key", "description": "Perform delete operation on key in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.key.delete" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.key.delete", "type": "safe_execute", "description": "Safely verify registry.key.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.key.delete", "type": "declared", "state": "declared", "description": "Discover declared support for registry.key.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2031", "external_name": "Registry Key Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.key.enumerate", "stable_id": "OSCO-CAP-0044", "name": "Enumerate Key", "description": "Perform enumerate operation on key in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.key.enumerate" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.key.enumerate", "type": "safe_execute", "description": "Safely verify registry.key.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.key.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for registry.key.enumerate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2032", "external_name": "Registry Key Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.key.read", "stable_id": "OSCO-CAP-0042", "name": "Read Key", "description": "Perform read operation on key in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.key.read" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "key state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.key.read", "type": "safe_execute", "description": "Safely verify registry.key.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.key.read", "type": "declared", "state": "declared", "description": "Discover declared support for registry.key.read" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2030", "external_name": "Registry Key Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.key.set", "stable_id": "OSCO-CAP-0002", "name": "Set Registry Key", "description": "Create or modify a registry key and value.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "status": "stable", "confidence": 0.96, "safety": "caution", "required_privileges": [ "registry_write" ], "evidence": [ { "evidence_id": "ev.registry.path", "type": "registry_key", "description": "Registry value exists at expected path" } ], "produced_telemetry": [ { "telemetry_id": "tm.sysmon.13", "source": "sysmon", "event_type": "RegistryValueSet", "description": "Registry value set telemetry" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "T1112", "external_name": "Modify Registry", "confidence": 0.94 }, { "framework": "sigma", "external_id": "proc_creation_win_reg", "external_name": "Registry Persistence Detection", "relation": "detects", "confidence": 0.88 } ] }, { "capability_id": "registry.permission.backup", "stable_id": "OSCO-CAP-0060", "name": "Backup Permission", "description": "Perform backup operation on permission in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.permission.backup" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.permission.backup", "type": "safe_execute", "description": "Safely verify registry.permission.backup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.permission.backup", "type": "declared", "state": "declared", "description": "Discover declared support for registry.permission.backup" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2048", "external_name": "Registry Permission Backup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.permission.delete", "stable_id": "OSCO-CAP-0058", "name": "Delete Permission", "description": "Perform delete operation on permission in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.permission.delete" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.permission.delete", "type": "safe_execute", "description": "Safely verify registry.permission.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.permission.delete", "type": "declared", "state": "declared", "description": "Discover declared support for registry.permission.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2046", "external_name": "Registry Permission Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.permission.enumerate", "stable_id": "OSCO-CAP-0059", "name": "Enumerate Permission", "description": "Perform enumerate operation on permission in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.permission.enumerate" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.permission.enumerate", "type": "safe_execute", "description": "Safely verify registry.permission.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.permission.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for registry.permission.enumerate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2047", "external_name": "Registry Permission Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.permission.read", "stable_id": "OSCO-CAP-0057", "name": "Read Permission", "description": "Perform read operation on permission in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.permission.read" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.permission.read", "type": "safe_execute", "description": "Safely verify registry.permission.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.permission.read", "type": "declared", "state": "declared", "description": "Discover declared support for registry.permission.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2045", "external_name": "Registry Permission Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.permission.set", "stable_id": "OSCO-CAP-0056", "name": "Set Permission", "description": "Perform set operation on permission in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.permission.set" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.permission.set", "type": "safe_execute", "description": "Safely verify registry.permission.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.permission.set", "type": "declared", "state": "declared", "description": "Discover declared support for registry.permission.set" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2044", "external_name": "Registry Permission Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.value.backup", "stable_id": "OSCO-CAP-0050", "name": "Backup Value", "description": "Perform backup operation on value in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.value.backup" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "value state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.value.backup", "type": "safe_execute", "description": "Safely verify registry.value.backup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.value.backup", "type": "declared", "state": "declared", "description": "Discover declared support for registry.value.backup" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2038", "external_name": "Registry Value Backup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.value.delete", "stable_id": "OSCO-CAP-0048", "name": "Delete Value", "description": "Perform delete operation on value in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.value.delete" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "value state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.value.delete", "type": "safe_execute", "description": "Safely verify registry.value.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.value.delete", "type": "declared", "state": "declared", "description": "Discover declared support for registry.value.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2036", "external_name": "Registry Value Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.value.enumerate", "stable_id": "OSCO-CAP-0049", "name": "Enumerate Value", "description": "Perform enumerate operation on value in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.value.enumerate" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "value state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.value.enumerate", "type": "safe_execute", "description": "Safely verify registry.value.enumerate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.value.enumerate", "type": "declared", "state": "declared", "description": "Discover declared support for registry.value.enumerate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2037", "external_name": "Registry Value Enumerate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.value.read", "stable_id": "OSCO-CAP-0047", "name": "Read Value", "description": "Perform read operation on value in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.value.read" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "value state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.value.read", "type": "safe_execute", "description": "Safely verify registry.value.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.value.read", "type": "declared", "state": "declared", "description": "Discover declared support for registry.value.read" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2035", "external_name": "Registry Value Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "registry.value.set", "stable_id": "OSCO-CAP-0046", "name": "Set Value", "description": "Perform set operation on value in the registry domain.", "category": "endpoint", "domain": "registry", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "registry.value.set" ], "preconditions": [ "provider exposes registry capability surface" ], "postconditions": [ "value state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.registry.value.set", "type": "safe_execute", "description": "Safely verify registry.value.set with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.registry.value.set", "type": "declared", "state": "declared", "description": "Discover declared support for registry.value.set" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2034", "external_name": "Registry Value Set", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.containment.document", "stable_id": "OSCO-CAP-0905", "name": "Document Containment", "description": "Perform document operation on containment in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.containment.document" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "containment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.containment.document", "type": "safe_execute", "description": "Safely verify response.containment.document with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.containment.document", "type": "declared", "state": "declared", "description": "Discover declared support for response.containment.document" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2893", "external_name": "Response Containment Document", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.containment.execute", "stable_id": "OSCO-CAP-0902", "name": "Execute Containment", "description": "Perform execute operation on containment in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.containment.execute" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "containment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.containment.execute", "type": "safe_execute", "description": "Safely verify response.containment.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.containment.execute", "type": "declared", "state": "declared", "description": "Discover declared support for response.containment.execute" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2890", "external_name": "Response Containment Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.containment.plan", "stable_id": "OSCO-CAP-0901", "name": "Plan Containment", "description": "Perform plan operation on containment in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.containment.plan" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "containment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.containment.plan", "type": "safe_execute", "description": "Safely verify response.containment.plan with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.containment.plan", "type": "declared", "state": "declared", "description": "Discover declared support for response.containment.plan" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2889", "external_name": "Response Containment Plan", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.containment.rollback", "stable_id": "OSCO-CAP-0904", "name": "Rollback Containment", "description": "Perform rollback operation on containment in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.containment.rollback" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "containment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.containment.rollback", "type": "safe_execute", "description": "Safely verify response.containment.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.containment.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for response.containment.rollback" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2892", "external_name": "Response Containment Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.containment.verify", "stable_id": "OSCO-CAP-0903", "name": "Verify Containment", "description": "Perform verify operation on containment in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.containment.verify" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "containment state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.containment.verify", "type": "safe_execute", "description": "Safely verify response.containment.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.containment.verify", "type": "declared", "state": "declared", "description": "Discover declared support for response.containment.verify" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2891", "external_name": "Response Containment Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.isolation.document", "stable_id": "OSCO-CAP-0900", "name": "Document Isolation", "description": "Perform document operation on isolation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.isolation.document" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "isolation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.isolation.document", "type": "safe_execute", "description": "Safely verify response.isolation.document with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.isolation.document", "type": "declared", "state": "declared", "description": "Discover declared support for response.isolation.document" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2888", "external_name": "Response Isolation Document", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.isolation.execute", "stable_id": "OSCO-CAP-0897", "name": "Execute Isolation", "description": "Perform execute operation on isolation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.isolation.execute" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "isolation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.isolation.execute", "type": "safe_execute", "description": "Safely verify response.isolation.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.isolation.execute", "type": "declared", "state": "declared", "description": "Discover declared support for response.isolation.execute" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2885", "external_name": "Response Isolation Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.isolation.plan", "stable_id": "OSCO-CAP-0896", "name": "Plan Isolation", "description": "Perform plan operation on isolation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.isolation.plan" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "isolation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.isolation.plan", "type": "safe_execute", "description": "Safely verify response.isolation.plan with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.isolation.plan", "type": "declared", "state": "declared", "description": "Discover declared support for response.isolation.plan" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2884", "external_name": "Response Isolation Plan", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.isolation.rollback", "stable_id": "OSCO-CAP-0899", "name": "Rollback Isolation", "description": "Perform rollback operation on isolation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.isolation.rollback" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "isolation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.isolation.rollback", "type": "safe_execute", "description": "Safely verify response.isolation.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.isolation.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for response.isolation.rollback" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2887", "external_name": "Response Isolation Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.isolation.verify", "stable_id": "OSCO-CAP-0898", "name": "Verify Isolation", "description": "Perform verify operation on isolation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.isolation.verify" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "isolation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.isolation.verify", "type": "safe_execute", "description": "Safely verify response.isolation.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.isolation.verify", "type": "declared", "state": "declared", "description": "Discover declared support for response.isolation.verify" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2886", "external_name": "Response Isolation Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.remediation.document", "stable_id": "OSCO-CAP-0910", "name": "Document Remediation", "description": "Perform document operation on remediation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.remediation.document" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "remediation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.remediation.document", "type": "safe_execute", "description": "Safely verify response.remediation.document with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.remediation.document", "type": "declared", "state": "declared", "description": "Discover declared support for response.remediation.document" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2898", "external_name": "Response Remediation Document", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.remediation.execute", "stable_id": "OSCO-CAP-0907", "name": "Execute Remediation", "description": "Perform execute operation on remediation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.remediation.execute" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "remediation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.remediation.execute", "type": "safe_execute", "description": "Safely verify response.remediation.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.remediation.execute", "type": "declared", "state": "declared", "description": "Discover declared support for response.remediation.execute" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2895", "external_name": "Response Remediation Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.remediation.plan", "stable_id": "OSCO-CAP-0906", "name": "Plan Remediation", "description": "Perform plan operation on remediation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.remediation.plan" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "remediation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.remediation.plan", "type": "safe_execute", "description": "Safely verify response.remediation.plan with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.remediation.plan", "type": "declared", "state": "declared", "description": "Discover declared support for response.remediation.plan" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2894", "external_name": "Response Remediation Plan", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.remediation.rollback", "stable_id": "OSCO-CAP-0909", "name": "Rollback Remediation", "description": "Perform rollback operation on remediation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.remediation.rollback" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "remediation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.remediation.rollback", "type": "safe_execute", "description": "Safely verify response.remediation.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.remediation.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for response.remediation.rollback" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2897", "external_name": "Response Remediation Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.remediation.verify", "stable_id": "OSCO-CAP-0908", "name": "Verify Remediation", "description": "Perform verify operation on remediation in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.remediation.verify" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "remediation state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.remediation.verify", "type": "safe_execute", "description": "Safely verify response.remediation.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.remediation.verify", "type": "declared", "state": "declared", "description": "Discover declared support for response.remediation.verify" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2896", "external_name": "Response Remediation Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.rollback.document", "stable_id": "OSCO-CAP-0915", "name": "Document Rollback", "description": "Perform document operation on rollback in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.rollback.document" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "rollback state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.rollback.document", "type": "safe_execute", "description": "Safely verify response.rollback.document with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.rollback.document", "type": "declared", "state": "declared", "description": "Discover declared support for response.rollback.document" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2903", "external_name": "Response Rollback Document", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.rollback.execute", "stable_id": "OSCO-CAP-0912", "name": "Execute Rollback", "description": "Perform execute operation on rollback in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.rollback.execute" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "rollback state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.rollback.execute", "type": "safe_execute", "description": "Safely verify response.rollback.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.rollback.execute", "type": "declared", "state": "declared", "description": "Discover declared support for response.rollback.execute" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2900", "external_name": "Response Rollback Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.rollback.plan", "stable_id": "OSCO-CAP-0911", "name": "Plan Rollback", "description": "Perform plan operation on rollback in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.rollback.plan" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "rollback state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.rollback.plan", "type": "safe_execute", "description": "Safely verify response.rollback.plan with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.rollback.plan", "type": "declared", "state": "declared", "description": "Discover declared support for response.rollback.plan" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2899", "external_name": "Response Rollback Plan", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.rollback.rollback", "stable_id": "OSCO-CAP-0914", "name": "Rollback Rollback", "description": "Perform rollback operation on rollback in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.rollback.rollback" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "rollback state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.rollback.rollback", "type": "safe_execute", "description": "Safely verify response.rollback.rollback with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.rollback.rollback", "type": "declared", "state": "declared", "description": "Discover declared support for response.rollback.rollback" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2902", "external_name": "Response Rollback Rollback", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "response.rollback.verify", "stable_id": "OSCO-CAP-0913", "name": "Verify Rollback", "description": "Perform verify operation on rollback in the response domain.", "category": "response", "domain": "response", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "response.rollback.verify" ], "preconditions": [ "provider exposes response capability surface" ], "postconditions": [ "rollback state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.response.rollback.verify", "type": "safe_execute", "description": "Safely verify response.rollback.verify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.response.rollback.verify", "type": "declared", "state": "declared", "description": "Discover declared support for response.rollback.verify" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2901", "external_name": "Response Rollback Verify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.binding.discover", "stable_id": "OSCO-CAP-0528", "name": "Discover Binding", "description": "Perform discover operation on binding in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.binding.discover" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.binding.discover", "type": "safe_execute", "description": "Safely verify rpc.binding.discover with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.binding.discover", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.binding.discover" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2516", "external_name": "Rpc Binding Discover", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.binding.inspect", "stable_id": "OSCO-CAP-0531", "name": "Inspect Binding", "description": "Perform inspect operation on binding in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.binding.inspect" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.binding.inspect", "type": "safe_execute", "description": "Safely verify rpc.binding.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.binding.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.binding.inspect" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2519", "external_name": "Rpc Binding Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.binding.invoke", "stable_id": "OSCO-CAP-0529", "name": "Invoke Binding", "description": "Perform invoke operation on binding in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.binding.invoke" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.binding.invoke", "type": "safe_execute", "description": "Safely verify rpc.binding.invoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.binding.invoke", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.binding.invoke" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2517", "external_name": "Rpc Binding Invoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.binding.register", "stable_id": "OSCO-CAP-0530", "name": "Register Binding", "description": "Perform register operation on binding in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.binding.register" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.binding.register", "type": "safe_execute", "description": "Safely verify rpc.binding.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.binding.register", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.binding.register" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2518", "external_name": "Rpc Binding Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.binding.restrict", "stable_id": "OSCO-CAP-0532", "name": "Restrict Binding", "description": "Perform restrict operation on binding in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.binding.restrict" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "binding state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.binding.restrict", "type": "safe_execute", "description": "Safely verify rpc.binding.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.binding.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.binding.restrict" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2520", "external_name": "Rpc Binding Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.endpoint.discover", "stable_id": "OSCO-CAP-0523", "name": "Discover Endpoint", "description": "Perform discover operation on endpoint in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.endpoint.discover" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.endpoint.discover", "type": "safe_execute", "description": "Safely verify rpc.endpoint.discover with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.endpoint.discover", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.endpoint.discover" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2511", "external_name": "Rpc Endpoint Discover", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.endpoint.inspect", "stable_id": "OSCO-CAP-0526", "name": "Inspect Endpoint", "description": "Perform inspect operation on endpoint in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.endpoint.inspect" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.endpoint.inspect", "type": "safe_execute", "description": "Safely verify rpc.endpoint.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.endpoint.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.endpoint.inspect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2514", "external_name": "Rpc Endpoint Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.endpoint.invoke", "stable_id": "OSCO-CAP-0524", "name": "Invoke Endpoint", "description": "Perform invoke operation on endpoint in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.endpoint.invoke" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.endpoint.invoke", "type": "safe_execute", "description": "Safely verify rpc.endpoint.invoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.endpoint.invoke", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.endpoint.invoke" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2512", "external_name": "Rpc Endpoint Invoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.endpoint.register", "stable_id": "OSCO-CAP-0525", "name": "Register Endpoint", "description": "Perform register operation on endpoint in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.endpoint.register" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.endpoint.register", "type": "safe_execute", "description": "Safely verify rpc.endpoint.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.endpoint.register", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.endpoint.register" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2513", "external_name": "Rpc Endpoint Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.endpoint.restrict", "stable_id": "OSCO-CAP-0527", "name": "Restrict Endpoint", "description": "Perform restrict operation on endpoint in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.endpoint.restrict" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "endpoint state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.endpoint.restrict", "type": "safe_execute", "description": "Safely verify rpc.endpoint.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.endpoint.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.endpoint.restrict" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2515", "external_name": "Rpc Endpoint Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.method.discover", "stable_id": "OSCO-CAP-0538", "name": "Discover Method", "description": "Perform discover operation on method in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.method.discover" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "method state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.method.discover", "type": "safe_execute", "description": "Safely verify rpc.method.discover with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.method.discover", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.method.discover" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2526", "external_name": "Rpc Method Discover", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.method.inspect", "stable_id": "OSCO-CAP-0541", "name": "Inspect Method", "description": "Perform inspect operation on method in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.method.inspect" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "method state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.method.inspect", "type": "safe_execute", "description": "Safely verify rpc.method.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.method.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.method.inspect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2529", "external_name": "Rpc Method Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.method.invoke", "stable_id": "OSCO-CAP-0539", "name": "Invoke Method", "description": "Perform invoke operation on method in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.method.invoke" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "method state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.method.invoke", "type": "safe_execute", "description": "Safely verify rpc.method.invoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.method.invoke", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.method.invoke" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2527", "external_name": "Rpc Method Invoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.method.register", "stable_id": "OSCO-CAP-0540", "name": "Register Method", "description": "Perform register operation on method in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.method.register" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "method state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.method.register", "type": "safe_execute", "description": "Safely verify rpc.method.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.method.register", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.method.register" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2528", "external_name": "Rpc Method Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.method.restrict", "stable_id": "OSCO-CAP-0542", "name": "Restrict Method", "description": "Perform restrict operation on method in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.method.restrict" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "method state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.method.restrict", "type": "safe_execute", "description": "Safely verify rpc.method.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.method.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.method.restrict" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2530", "external_name": "Rpc Method Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.service.discover", "stable_id": "OSCO-CAP-0533", "name": "Discover Service", "description": "Perform discover operation on service in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.service.discover" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.service.discover", "type": "safe_execute", "description": "Safely verify rpc.service.discover with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.service.discover", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.service.discover" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2521", "external_name": "Rpc Service Discover", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.service.inspect", "stable_id": "OSCO-CAP-0536", "name": "Inspect Service", "description": "Perform inspect operation on service in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.service.inspect" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.service.inspect", "type": "safe_execute", "description": "Safely verify rpc.service.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.service.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.service.inspect" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2524", "external_name": "Rpc Service Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.service.invoke", "stable_id": "OSCO-CAP-0534", "name": "Invoke Service", "description": "Perform invoke operation on service in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.service.invoke" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.service.invoke", "type": "safe_execute", "description": "Safely verify rpc.service.invoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.service.invoke", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.service.invoke" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2522", "external_name": "Rpc Service Invoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.service.register", "stable_id": "OSCO-CAP-0535", "name": "Register Service", "description": "Perform register operation on service in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.service.register" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.service.register", "type": "safe_execute", "description": "Safely verify rpc.service.register with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.service.register", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.service.register" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2523", "external_name": "Rpc Service Register", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "rpc.service.restrict", "stable_id": "OSCO-CAP-0537", "name": "Restrict Service", "description": "Perform restrict operation on service in the rpc domain.", "category": "network", "domain": "rpc", "platforms": [ "windows", "linux", "cloud" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.linux", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "rpc.service.restrict" ], "preconditions": [ "provider exposes rpc capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.rpc.service.restrict", "type": "safe_execute", "description": "Safely verify rpc.service.restrict with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.rpc.service.restrict", "type": "declared", "state": "declared", "description": "Discover declared support for rpc.service.restrict" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2525", "external_name": "Rpc Service Restrict", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.action.create", "stable_id": "OSCO-CAP-0154", "name": "Create Action", "description": "Perform create operation on action in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.action.create" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "action state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.action.create", "type": "safe_execute", "description": "Safely verify scheduled_task.action.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.action.create", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.action.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2142", "external_name": "Scheduled Task Action Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.action.delete", "stable_id": "OSCO-CAP-0156", "name": "Delete Action", "description": "Perform delete operation on action in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.action.delete" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "action state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.action.delete", "type": "safe_execute", "description": "Safely verify scheduled_task.action.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.action.delete", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.action.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2144", "external_name": "Scheduled Task Action Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.action.modify", "stable_id": "OSCO-CAP-0155", "name": "Modify Action", "description": "Perform modify operation on action in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.action.modify" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "action state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.action.modify", "type": "safe_execute", "description": "Safely verify scheduled_task.action.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.action.modify", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.action.modify" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2143", "external_name": "Scheduled Task Action Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.action.query", "stable_id": "OSCO-CAP-0157", "name": "Query Action", "description": "Perform query operation on action in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.action.query" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "action state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.action.query", "type": "safe_execute", "description": "Safely verify scheduled_task.action.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.action.query", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.action.query" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2145", "external_name": "Scheduled Task Action Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.action.run", "stable_id": "OSCO-CAP-0158", "name": "Run Action", "description": "Perform run operation on action in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.action.run" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "action state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.action.run", "type": "safe_execute", "description": "Safely verify scheduled_task.action.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.action.run", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.action.run" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2146", "external_name": "Scheduled Task Action Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.principal.create", "stable_id": "OSCO-CAP-0159", "name": "Create Principal", "description": "Perform create operation on principal in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.principal.create" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.principal.create", "type": "safe_execute", "description": "Safely verify scheduled_task.principal.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.principal.create", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.principal.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2147", "external_name": "Scheduled Task Principal Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.principal.delete", "stable_id": "OSCO-CAP-0161", "name": "Delete Principal", "description": "Perform delete operation on principal in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.principal.delete" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.principal.delete", "type": "safe_execute", "description": "Safely verify scheduled_task.principal.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.principal.delete", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.principal.delete" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2149", "external_name": "Scheduled Task Principal Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.principal.modify", "stable_id": "OSCO-CAP-0160", "name": "Modify Principal", "description": "Perform modify operation on principal in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.principal.modify" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.principal.modify", "type": "safe_execute", "description": "Safely verify scheduled_task.principal.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.principal.modify", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.principal.modify" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2148", "external_name": "Scheduled Task Principal Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.principal.query", "stable_id": "OSCO-CAP-0162", "name": "Query Principal", "description": "Perform query operation on principal in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.principal.query" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.principal.query", "type": "safe_execute", "description": "Safely verify scheduled_task.principal.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.principal.query", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.principal.query" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2150", "external_name": "Scheduled Task Principal Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.principal.run", "stable_id": "OSCO-CAP-0163", "name": "Run Principal", "description": "Perform run operation on principal in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.principal.run" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "principal state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.principal.run", "type": "safe_execute", "description": "Safely verify scheduled_task.principal.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.principal.run", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.principal.run" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2151", "external_name": "Scheduled Task Principal Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.task.create", "stable_id": "OSCO-CAP-0144", "name": "Create Task", "description": "Perform create operation on task in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.task.create" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.task.create", "type": "safe_execute", "description": "Safely verify scheduled_task.task.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.task.create", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.task.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2132", "external_name": "Scheduled Task Task Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.task.delete", "stable_id": "OSCO-CAP-0146", "name": "Delete Task", "description": "Perform delete operation on task in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.task.delete" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.task.delete", "type": "safe_execute", "description": "Safely verify scheduled_task.task.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.task.delete", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.task.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2134", "external_name": "Scheduled Task Task Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.task.modify", "stable_id": "OSCO-CAP-0145", "name": "Modify Task", "description": "Perform modify operation on task in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.task.modify" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.task.modify", "type": "safe_execute", "description": "Safely verify scheduled_task.task.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.task.modify", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.task.modify" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2133", "external_name": "Scheduled Task Task Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.task.query", "stable_id": "OSCO-CAP-0147", "name": "Query Task", "description": "Perform query operation on task in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.task.query" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.task.query", "type": "safe_execute", "description": "Safely verify scheduled_task.task.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.task.query", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.task.query" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2135", "external_name": "Scheduled Task Task Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.task.run", "stable_id": "OSCO-CAP-0148", "name": "Run Task", "description": "Perform run operation on task in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.task.run" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "task state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.task.run", "type": "safe_execute", "description": "Safely verify scheduled_task.task.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.task.run", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.task.run" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2136", "external_name": "Scheduled Task Task Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.trigger.create", "stable_id": "OSCO-CAP-0149", "name": "Create Trigger", "description": "Perform create operation on trigger in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.trigger.create" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "trigger state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.trigger.create", "type": "safe_execute", "description": "Safely verify scheduled_task.trigger.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.trigger.create", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.trigger.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2137", "external_name": "Scheduled Task Trigger Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.trigger.delete", "stable_id": "OSCO-CAP-0151", "name": "Delete Trigger", "description": "Perform delete operation on trigger in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.trigger.delete" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "trigger state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.trigger.delete", "type": "safe_execute", "description": "Safely verify scheduled_task.trigger.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.trigger.delete", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.trigger.delete" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2139", "external_name": "Scheduled Task Trigger Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.trigger.modify", "stable_id": "OSCO-CAP-0150", "name": "Modify Trigger", "description": "Perform modify operation on trigger in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.trigger.modify" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "trigger state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.trigger.modify", "type": "safe_execute", "description": "Safely verify scheduled_task.trigger.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.trigger.modify", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.trigger.modify" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2138", "external_name": "Scheduled Task Trigger Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.trigger.query", "stable_id": "OSCO-CAP-0152", "name": "Query Trigger", "description": "Perform query operation on trigger in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.trigger.query" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "trigger state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.trigger.query", "type": "safe_execute", "description": "Safely verify scheduled_task.trigger.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.trigger.query", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.trigger.query" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2140", "external_name": "Scheduled Task Trigger Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "scheduled_task.trigger.run", "stable_id": "OSCO-CAP-0153", "name": "Run Trigger", "description": "Perform run operation on trigger in the scheduled_task domain.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "scheduled_task.trigger.run" ], "preconditions": [ "provider exposes scheduled_task capability surface" ], "postconditions": [ "trigger state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.scheduled_task.trigger.run", "type": "safe_execute", "description": "Safely verify scheduled_task.trigger.run with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.scheduled_task.trigger.run", "type": "declared", "state": "declared", "description": "Discover declared support for scheduled_task.trigger.run" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2141", "external_name": "Scheduled Task Trigger Run", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.binary.create", "stable_id": "OSCO-CAP-0132", "name": "Create Binary", "description": "Perform create operation on binary in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.binary.create" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "binary state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.binary.create", "type": "safe_execute", "description": "Safely verify service.binary.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.binary.create", "type": "declared", "state": "declared", "description": "Discover declared support for service.binary.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2120", "external_name": "Service Binary Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.binary.delete", "stable_id": "OSCO-CAP-0136", "name": "Delete Binary", "description": "Perform delete operation on binary in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.binary.delete" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "binary state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.binary.delete", "type": "safe_execute", "description": "Safely verify service.binary.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.binary.delete", "type": "declared", "state": "declared", "description": "Discover declared support for service.binary.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2124", "external_name": "Service Binary Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.binary.modify", "stable_id": "OSCO-CAP-0133", "name": "Modify Binary", "description": "Perform modify operation on binary in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.binary.modify" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "binary state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.binary.modify", "type": "safe_execute", "description": "Safely verify service.binary.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.binary.modify", "type": "declared", "state": "declared", "description": "Discover declared support for service.binary.modify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2121", "external_name": "Service Binary Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.binary.query", "stable_id": "OSCO-CAP-0137", "name": "Query Binary", "description": "Perform query operation on binary in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.binary.query" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "binary state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.binary.query", "type": "safe_execute", "description": "Safely verify service.binary.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.binary.query", "type": "declared", "state": "declared", "description": "Discover declared support for service.binary.query" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2125", "external_name": "Service Binary Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.binary.start", "stable_id": "OSCO-CAP-0134", "name": "Start Binary", "description": "Perform start operation on binary in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.binary.start" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "binary state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.binary.start", "type": "safe_execute", "description": "Safely verify service.binary.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.binary.start", "type": "declared", "state": "declared", "description": "Discover declared support for service.binary.start" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2122", "external_name": "Service Binary Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.binary.stop", "stable_id": "OSCO-CAP-0135", "name": "Stop Binary", "description": "Perform stop operation on binary in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.binary.stop" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "binary state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.binary.stop", "type": "safe_execute", "description": "Safely verify service.binary.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.binary.stop", "type": "declared", "state": "declared", "description": "Discover declared support for service.binary.stop" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2123", "external_name": "Service Binary Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.config.create", "stable_id": "OSCO-CAP-0126", "name": "Create Config", "description": "Perform create operation on config in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.config.create" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "config state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.config.create", "type": "safe_execute", "description": "Safely verify service.config.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.config.create", "type": "declared", "state": "declared", "description": "Discover declared support for service.config.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2114", "external_name": "Service Config Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.config.delete", "stable_id": "OSCO-CAP-0130", "name": "Delete Config", "description": "Perform delete operation on config in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.config.delete" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "config state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.config.delete", "type": "safe_execute", "description": "Safely verify service.config.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.config.delete", "type": "declared", "state": "declared", "description": "Discover declared support for service.config.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2118", "external_name": "Service Config Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.config.modify", "stable_id": "OSCO-CAP-0127", "name": "Modify Config", "description": "Perform modify operation on config in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.config.modify" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "config state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.config.modify", "type": "safe_execute", "description": "Safely verify service.config.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.config.modify", "type": "declared", "state": "declared", "description": "Discover declared support for service.config.modify" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2115", "external_name": "Service Config Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.config.query", "stable_id": "OSCO-CAP-0131", "name": "Query Config", "description": "Perform query operation on config in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.config.query" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "config state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.config.query", "type": "safe_execute", "description": "Safely verify service.config.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.config.query", "type": "declared", "state": "declared", "description": "Discover declared support for service.config.query" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2119", "external_name": "Service Config Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.config.start", "stable_id": "OSCO-CAP-0128", "name": "Start Config", "description": "Perform start operation on config in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.config.start" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "config state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.config.start", "type": "safe_execute", "description": "Safely verify service.config.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.config.start", "type": "declared", "state": "declared", "description": "Discover declared support for service.config.start" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2116", "external_name": "Service Config Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.config.stop", "stable_id": "OSCO-CAP-0129", "name": "Stop Config", "description": "Perform stop operation on config in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.config.stop" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "config state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.config.stop", "type": "safe_execute", "description": "Safely verify service.config.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.config.stop", "type": "declared", "state": "declared", "description": "Discover declared support for service.config.stop" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2117", "external_name": "Service Config Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.permission.create", "stable_id": "OSCO-CAP-0138", "name": "Create Permission", "description": "Perform create operation on permission in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.permission.create" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.permission.create", "type": "safe_execute", "description": "Safely verify service.permission.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.permission.create", "type": "declared", "state": "declared", "description": "Discover declared support for service.permission.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2126", "external_name": "Service Permission Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.permission.delete", "stable_id": "OSCO-CAP-0142", "name": "Delete Permission", "description": "Perform delete operation on permission in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.permission.delete" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.permission.delete", "type": "safe_execute", "description": "Safely verify service.permission.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.permission.delete", "type": "declared", "state": "declared", "description": "Discover declared support for service.permission.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2130", "external_name": "Service Permission Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.permission.modify", "stable_id": "OSCO-CAP-0139", "name": "Modify Permission", "description": "Perform modify operation on permission in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.permission.modify" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.permission.modify", "type": "safe_execute", "description": "Safely verify service.permission.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.permission.modify", "type": "declared", "state": "declared", "description": "Discover declared support for service.permission.modify" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2127", "external_name": "Service Permission Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.permission.query", "stable_id": "OSCO-CAP-0143", "name": "Query Permission", "description": "Perform query operation on permission in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.permission.query" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.permission.query", "type": "safe_execute", "description": "Safely verify service.permission.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.permission.query", "type": "declared", "state": "declared", "description": "Discover declared support for service.permission.query" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2131", "external_name": "Service Permission Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.permission.start", "stable_id": "OSCO-CAP-0140", "name": "Start Permission", "description": "Perform start operation on permission in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.permission.start" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.permission.start", "type": "safe_execute", "description": "Safely verify service.permission.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.permission.start", "type": "declared", "state": "declared", "description": "Discover declared support for service.permission.start" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2128", "external_name": "Service Permission Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.permission.stop", "stable_id": "OSCO-CAP-0141", "name": "Stop Permission", "description": "Perform stop operation on permission in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.permission.stop" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "permission state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.permission.stop", "type": "safe_execute", "description": "Safely verify service.permission.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.permission.stop", "type": "declared", "state": "declared", "description": "Discover declared support for service.permission.stop" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2129", "external_name": "Service Permission Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.service.create", "stable_id": "OSCO-CAP-0120", "name": "Create Service", "description": "Perform create operation on service in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.service.create" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.service.create", "type": "safe_execute", "description": "Safely verify service.service.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.service.create", "type": "declared", "state": "declared", "description": "Discover declared support for service.service.create" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2108", "external_name": "Service Service Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.service.delete", "stable_id": "OSCO-CAP-0124", "name": "Delete Service", "description": "Perform delete operation on service in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.service.delete" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.service.delete", "type": "safe_execute", "description": "Safely verify service.service.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.service.delete", "type": "declared", "state": "declared", "description": "Discover declared support for service.service.delete" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2112", "external_name": "Service Service Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.service.modify", "stable_id": "OSCO-CAP-0121", "name": "Modify Service", "description": "Perform modify operation on service in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.service.modify" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.service.modify", "type": "safe_execute", "description": "Safely verify service.service.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.service.modify", "type": "declared", "state": "declared", "description": "Discover declared support for service.service.modify" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2109", "external_name": "Service Service Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.service.query", "stable_id": "OSCO-CAP-0125", "name": "Query Service", "description": "Perform query operation on service in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.service.query" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.service.query", "type": "safe_execute", "description": "Safely verify service.service.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.service.query", "type": "declared", "state": "declared", "description": "Discover declared support for service.service.query" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2113", "external_name": "Service Service Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.service.start", "stable_id": "OSCO-CAP-0122", "name": "Start Service", "description": "Perform start operation on service in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.service.start" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.service.start", "type": "safe_execute", "description": "Safely verify service.service.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.service.start", "type": "declared", "state": "declared", "description": "Discover declared support for service.service.start" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2110", "external_name": "Service Service Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "service.service.stop", "stable_id": "OSCO-CAP-0123", "name": "Stop Service", "description": "Perform stop operation on service in the service domain.", "category": "endpoint", "domain": "service", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "service.service.stop" ], "preconditions": [ "provider exposes service capability surface" ], "postconditions": [ "service state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.service.service.stop", "type": "safe_execute", "description": "Safely verify service.service.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.service.service.stop", "type": "declared", "state": "declared", "description": "Discover declared support for service.service.stop" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2111", "external_name": "Service Service Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.file.connect", "stable_id": "OSCO-CAP-0558", "name": "Connect File", "description": "Perform connect operation on file in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.file.connect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.file.connect", "type": "safe_execute", "description": "Safely verify smb.file.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.file.connect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.file.connect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2546", "external_name": "Smb File Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.file.disconnect", "stable_id": "OSCO-CAP-0562", "name": "Disconnect File", "description": "Perform disconnect operation on file in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.file.disconnect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.file.disconnect", "type": "safe_execute", "description": "Safely verify smb.file.disconnect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.file.disconnect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.file.disconnect" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2550", "external_name": "Smb File Disconnect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.file.mount", "stable_id": "OSCO-CAP-0559", "name": "Mount File", "description": "Perform mount operation on file in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.file.mount" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.file.mount", "type": "safe_execute", "description": "Safely verify smb.file.mount with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.file.mount", "type": "declared", "state": "declared", "description": "Discover declared support for smb.file.mount" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2547", "external_name": "Smb File Mount", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.file.read", "stable_id": "OSCO-CAP-0560", "name": "Read File", "description": "Perform read operation on file in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.file.read" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.file.read", "type": "safe_execute", "description": "Safely verify smb.file.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.file.read", "type": "declared", "state": "declared", "description": "Discover declared support for smb.file.read" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2548", "external_name": "Smb File Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.file.write", "stable_id": "OSCO-CAP-0561", "name": "Write File", "description": "Perform write operation on file in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.file.write" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "file state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.file.write", "type": "safe_execute", "description": "Safely verify smb.file.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.file.write", "type": "declared", "state": "declared", "description": "Discover declared support for smb.file.write" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2549", "external_name": "Smb File Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.pipe.connect", "stable_id": "OSCO-CAP-0553", "name": "Connect Pipe", "description": "Perform connect operation on pipe in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.pipe.connect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.pipe.connect", "type": "safe_execute", "description": "Safely verify smb.pipe.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.pipe.connect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.pipe.connect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2541", "external_name": "Smb Pipe Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.pipe.disconnect", "stable_id": "OSCO-CAP-0557", "name": "Disconnect Pipe", "description": "Perform disconnect operation on pipe in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.pipe.disconnect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.pipe.disconnect", "type": "safe_execute", "description": "Safely verify smb.pipe.disconnect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.pipe.disconnect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.pipe.disconnect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2545", "external_name": "Smb Pipe Disconnect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.pipe.mount", "stable_id": "OSCO-CAP-0554", "name": "Mount Pipe", "description": "Perform mount operation on pipe in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.pipe.mount" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.pipe.mount", "type": "safe_execute", "description": "Safely verify smb.pipe.mount with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.pipe.mount", "type": "declared", "state": "declared", "description": "Discover declared support for smb.pipe.mount" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2542", "external_name": "Smb Pipe Mount", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.pipe.read", "stable_id": "OSCO-CAP-0555", "name": "Read Pipe", "description": "Perform read operation on pipe in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.pipe.read" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.pipe.read", "type": "safe_execute", "description": "Safely verify smb.pipe.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.pipe.read", "type": "declared", "state": "declared", "description": "Discover declared support for smb.pipe.read" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2543", "external_name": "Smb Pipe Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.pipe.write", "stable_id": "OSCO-CAP-0556", "name": "Write Pipe", "description": "Perform write operation on pipe in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.pipe.write" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "pipe state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.pipe.write", "type": "safe_execute", "description": "Safely verify smb.pipe.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.pipe.write", "type": "declared", "state": "declared", "description": "Discover declared support for smb.pipe.write" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2544", "external_name": "Smb Pipe Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.session.connect", "stable_id": "OSCO-CAP-0548", "name": "Connect Session", "description": "Perform connect operation on session in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.session.connect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.session.connect", "type": "safe_execute", "description": "Safely verify smb.session.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.session.connect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.session.connect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2536", "external_name": "Smb Session Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.session.disconnect", "stable_id": "OSCO-CAP-0552", "name": "Disconnect Session", "description": "Perform disconnect operation on session in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.session.disconnect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.session.disconnect", "type": "safe_execute", "description": "Safely verify smb.session.disconnect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.session.disconnect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.session.disconnect" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2540", "external_name": "Smb Session Disconnect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.session.mount", "stable_id": "OSCO-CAP-0549", "name": "Mount Session", "description": "Perform mount operation on session in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.session.mount" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.session.mount", "type": "safe_execute", "description": "Safely verify smb.session.mount with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.session.mount", "type": "declared", "state": "declared", "description": "Discover declared support for smb.session.mount" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2537", "external_name": "Smb Session Mount", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.session.read", "stable_id": "OSCO-CAP-0550", "name": "Read Session", "description": "Perform read operation on session in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.session.read" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.session.read", "type": "safe_execute", "description": "Safely verify smb.session.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.session.read", "type": "declared", "state": "declared", "description": "Discover declared support for smb.session.read" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2538", "external_name": "Smb Session Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.session.write", "stable_id": "OSCO-CAP-0551", "name": "Write Session", "description": "Perform write operation on session in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.session.write" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "session state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.session.write", "type": "safe_execute", "description": "Safely verify smb.session.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.session.write", "type": "declared", "state": "declared", "description": "Discover declared support for smb.session.write" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2539", "external_name": "Smb Session Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.share.connect", "stable_id": "OSCO-CAP-0543", "name": "Connect Share", "description": "Perform connect operation on share in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.share.connect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "share state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.share.connect", "type": "safe_execute", "description": "Safely verify smb.share.connect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.share.connect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.share.connect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2531", "external_name": "Smb Share Connect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.share.disconnect", "stable_id": "OSCO-CAP-0547", "name": "Disconnect Share", "description": "Perform disconnect operation on share in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.share.disconnect" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "share state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.share.disconnect", "type": "safe_execute", "description": "Safely verify smb.share.disconnect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.share.disconnect", "type": "declared", "state": "declared", "description": "Discover declared support for smb.share.disconnect" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2535", "external_name": "Smb Share Disconnect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.share.mount", "stable_id": "OSCO-CAP-0544", "name": "Mount Share", "description": "Perform mount operation on share in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.share.mount" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "share state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.share.mount", "type": "safe_execute", "description": "Safely verify smb.share.mount with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.share.mount", "type": "declared", "state": "declared", "description": "Discover declared support for smb.share.mount" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2532", "external_name": "Smb Share Mount", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.share.read", "stable_id": "OSCO-CAP-0545", "name": "Read Share", "description": "Perform read operation on share in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.share.read" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "share state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.share.read", "type": "safe_execute", "description": "Safely verify smb.share.read with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.share.read", "type": "declared", "state": "declared", "description": "Discover declared support for smb.share.read" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2533", "external_name": "Smb Share Read", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "smb.share.write", "stable_id": "OSCO-CAP-0546", "name": "Write Share", "description": "Perform write operation on share in the smb domain.", "category": "network", "domain": "smb", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "smb.share.write" ], "preconditions": [ "provider exposes smb capability surface" ], "postconditions": [ "share state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.smb.share.write", "type": "safe_execute", "description": "Safely verify smb.share.write with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.smb.share.write", "type": "declared", "state": "declared", "description": "Discover declared support for smb.share.write" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2534", "external_name": "Smb Share Write", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.collector.disable", "stable_id": "OSCO-CAP-0289", "name": "Disable Collector", "description": "Perform disable operation on collector in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.collector.disable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.collector.disable", "type": "safe_execute", "description": "Safely verify telemetry.collector.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.collector.disable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.collector.disable" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2277", "external_name": "Telemetry Collector Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.collector.enable", "stable_id": "OSCO-CAP-0288", "name": "Enable Collector", "description": "Perform enable operation on collector in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.collector.enable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.collector.enable", "type": "safe_execute", "description": "Safely verify telemetry.collector.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.collector.enable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.collector.enable" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2276", "external_name": "Telemetry Collector Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.collector.query", "stable_id": "OSCO-CAP-0290", "name": "Query Collector", "description": "Perform query operation on collector in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.collector.query" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.collector.query", "type": "safe_execute", "description": "Safely verify telemetry.collector.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.collector.query", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.collector.query" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2278", "external_name": "Telemetry Collector Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.collector.route", "stable_id": "OSCO-CAP-0291", "name": "Route Collector", "description": "Perform route operation on collector in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.collector.route" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.collector.route", "type": "safe_execute", "description": "Safely verify telemetry.collector.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.collector.route", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.collector.route" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2279", "external_name": "Telemetry Collector Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.collector.transform", "stable_id": "OSCO-CAP-0292", "name": "Transform Collector", "description": "Perform transform operation on collector in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.collector.transform" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "collector state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.collector.transform", "type": "safe_execute", "description": "Safely verify telemetry.collector.transform with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.collector.transform", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.collector.transform" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2280", "external_name": "Telemetry Collector Transform", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.pipeline.disable", "stable_id": "OSCO-CAP-0294", "name": "Disable Pipeline", "description": "Perform disable operation on pipeline in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.pipeline.disable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.pipeline.disable", "type": "safe_execute", "description": "Safely verify telemetry.pipeline.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.pipeline.disable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.pipeline.disable" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2282", "external_name": "Telemetry Pipeline Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.pipeline.enable", "stable_id": "OSCO-CAP-0293", "name": "Enable Pipeline", "description": "Perform enable operation on pipeline in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.pipeline.enable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.pipeline.enable", "type": "safe_execute", "description": "Safely verify telemetry.pipeline.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.pipeline.enable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.pipeline.enable" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2281", "external_name": "Telemetry Pipeline Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.pipeline.query", "stable_id": "OSCO-CAP-0295", "name": "Query Pipeline", "description": "Perform query operation on pipeline in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.pipeline.query" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.pipeline.query", "type": "safe_execute", "description": "Safely verify telemetry.pipeline.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.pipeline.query", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.pipeline.query" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2283", "external_name": "Telemetry Pipeline Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.pipeline.route", "stable_id": "OSCO-CAP-0296", "name": "Route Pipeline", "description": "Perform route operation on pipeline in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.pipeline.route" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.pipeline.route", "type": "safe_execute", "description": "Safely verify telemetry.pipeline.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.pipeline.route", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.pipeline.route" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2284", "external_name": "Telemetry Pipeline Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.pipeline.transform", "stable_id": "OSCO-CAP-0297", "name": "Transform Pipeline", "description": "Perform transform operation on pipeline in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.pipeline.transform" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "pipeline state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.pipeline.transform", "type": "safe_execute", "description": "Safely verify telemetry.pipeline.transform with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.pipeline.transform", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.pipeline.transform" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2285", "external_name": "Telemetry Pipeline Transform", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.sink.disable", "stable_id": "OSCO-CAP-0299", "name": "Disable Sink", "description": "Perform disable operation on sink in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.sink.disable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.sink.disable", "type": "safe_execute", "description": "Safely verify telemetry.sink.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.sink.disable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.sink.disable" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2287", "external_name": "Telemetry Sink Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.sink.enable", "stable_id": "OSCO-CAP-0298", "name": "Enable Sink", "description": "Perform enable operation on sink in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.sink.enable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.sink.enable", "type": "safe_execute", "description": "Safely verify telemetry.sink.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.sink.enable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.sink.enable" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2286", "external_name": "Telemetry Sink Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.sink.query", "stable_id": "OSCO-CAP-0300", "name": "Query Sink", "description": "Perform query operation on sink in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.sink.query" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.sink.query", "type": "safe_execute", "description": "Safely verify telemetry.sink.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.sink.query", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.sink.query" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2288", "external_name": "Telemetry Sink Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.sink.route", "stable_id": "OSCO-CAP-0301", "name": "Route Sink", "description": "Perform route operation on sink in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.sink.route" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.sink.route", "type": "safe_execute", "description": "Safely verify telemetry.sink.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.sink.route", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.sink.route" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2289", "external_name": "Telemetry Sink Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.sink.transform", "stable_id": "OSCO-CAP-0302", "name": "Transform Sink", "description": "Perform transform operation on sink in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.sink.transform" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "sink state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.sink.transform", "type": "safe_execute", "description": "Safely verify telemetry.sink.transform with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.sink.transform", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.sink.transform" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2290", "external_name": "Telemetry Sink Transform", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.stream.disable", "stable_id": "OSCO-CAP-0284", "name": "Disable Stream", "description": "Perform disable operation on stream in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.stream.disable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "stream state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.stream.disable", "type": "safe_execute", "description": "Safely verify telemetry.stream.disable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.stream.disable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.stream.disable" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2272", "external_name": "Telemetry Stream Disable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.stream.enable", "stable_id": "OSCO-CAP-0283", "name": "Enable Stream", "description": "Perform enable operation on stream in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.stream.enable" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "stream state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.stream.enable", "type": "safe_execute", "description": "Safely verify telemetry.stream.enable with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.stream.enable", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.stream.enable" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2271", "external_name": "Telemetry Stream Enable", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.stream.query", "stable_id": "OSCO-CAP-0285", "name": "Query Stream", "description": "Perform query operation on stream in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.stream.query" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "stream state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.stream.query", "type": "safe_execute", "description": "Safely verify telemetry.stream.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.stream.query", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.stream.query" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2273", "external_name": "Telemetry Stream Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.stream.route", "stable_id": "OSCO-CAP-0286", "name": "Route Stream", "description": "Perform route operation on stream in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.stream.route" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "stream state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.stream.route", "type": "safe_execute", "description": "Safely verify telemetry.stream.route with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.stream.route", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.stream.route" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2274", "external_name": "Telemetry Stream Route", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "telemetry.stream.transform", "stable_id": "OSCO-CAP-0287", "name": "Transform Stream", "description": "Perform transform operation on stream in the telemetry domain.", "category": "telemetry", "domain": "telemetry", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "safe", "required_privileges": [ "telemetry.stream.transform" ], "preconditions": [ "provider exposes telemetry capability surface" ], "postconditions": [ "stream state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.telemetry.stream.transform", "type": "safe_execute", "description": "Safely verify telemetry.stream.transform with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.telemetry.stream.transform", "type": "declared", "state": "declared", "description": "Discover declared support for telemetry.stream.transform" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2275", "external_name": "Telemetry Stream Transform", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.context.create", "stable_id": "OSCO-CAP-0090", "name": "Create Context", "description": "Perform create operation on context in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.context.create" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.context.create", "type": "safe_execute", "description": "Safely verify thread.context.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.context.create", "type": "declared", "state": "declared", "description": "Discover declared support for thread.context.create" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2078", "external_name": "Thread Context Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.context.inject", "stable_id": "OSCO-CAP-0094", "name": "Inject Context", "description": "Perform inject operation on context in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.context.inject" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.context.inject", "type": "safe_execute", "description": "Safely verify thread.context.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.context.inject", "type": "declared", "state": "declared", "description": "Discover declared support for thread.context.inject" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2082", "external_name": "Thread Context Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.context.inspect", "stable_id": "OSCO-CAP-0093", "name": "Inspect Context", "description": "Perform inspect operation on context in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.context.inspect" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.context.inspect", "type": "safe_execute", "description": "Safely verify thread.context.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.context.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for thread.context.inspect" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2081", "external_name": "Thread Context Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.context.resume", "stable_id": "OSCO-CAP-0092", "name": "Resume Context", "description": "Perform resume operation on context in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.context.resume" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.context.resume", "type": "safe_execute", "description": "Safely verify thread.context.resume with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.context.resume", "type": "declared", "state": "declared", "description": "Discover declared support for thread.context.resume" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2080", "external_name": "Thread Context Resume", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.context.suspend", "stable_id": "OSCO-CAP-0091", "name": "Suspend Context", "description": "Perform suspend operation on context in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.context.suspend" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "context state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.context.suspend", "type": "safe_execute", "description": "Safely verify thread.context.suspend with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.context.suspend", "type": "declared", "state": "declared", "description": "Discover declared support for thread.context.suspend" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2079", "external_name": "Thread Context Suspend", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.stack.create", "stable_id": "OSCO-CAP-0095", "name": "Create Stack", "description": "Perform create operation on stack in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.stack.create" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "stack state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.stack.create", "type": "safe_execute", "description": "Safely verify thread.stack.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.stack.create", "type": "declared", "state": "declared", "description": "Discover declared support for thread.stack.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2083", "external_name": "Thread Stack Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.stack.inject", "stable_id": "OSCO-CAP-0099", "name": "Inject Stack", "description": "Perform inject operation on stack in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.stack.inject" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "stack state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.stack.inject", "type": "safe_execute", "description": "Safely verify thread.stack.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.stack.inject", "type": "declared", "state": "declared", "description": "Discover declared support for thread.stack.inject" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2087", "external_name": "Thread Stack Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.stack.inspect", "stable_id": "OSCO-CAP-0098", "name": "Inspect Stack", "description": "Perform inspect operation on stack in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.stack.inspect" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "stack state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.stack.inspect", "type": "safe_execute", "description": "Safely verify thread.stack.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.stack.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for thread.stack.inspect" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2086", "external_name": "Thread Stack Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.stack.resume", "stable_id": "OSCO-CAP-0097", "name": "Resume Stack", "description": "Perform resume operation on stack in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.stack.resume" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "stack state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.stack.resume", "type": "safe_execute", "description": "Safely verify thread.stack.resume with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.stack.resume", "type": "declared", "state": "declared", "description": "Discover declared support for thread.stack.resume" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2085", "external_name": "Thread Stack Resume", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.stack.suspend", "stable_id": "OSCO-CAP-0096", "name": "Suspend Stack", "description": "Perform suspend operation on stack in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.stack.suspend" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "stack state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.stack.suspend", "type": "safe_execute", "description": "Safely verify thread.stack.suspend with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.stack.suspend", "type": "declared", "state": "declared", "description": "Discover declared support for thread.stack.suspend" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2084", "external_name": "Thread Stack Suspend", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.thread.create", "stable_id": "OSCO-CAP-0085", "name": "Create Thread", "description": "Perform create operation on thread in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.thread.create" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "thread state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.thread.create", "type": "safe_execute", "description": "Safely verify thread.thread.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.thread.create", "type": "declared", "state": "declared", "description": "Discover declared support for thread.thread.create" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2073", "external_name": "Thread Thread Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.thread.inject", "stable_id": "OSCO-CAP-0089", "name": "Inject Thread", "description": "Perform inject operation on thread in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.thread.inject" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "thread state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.thread.inject", "type": "safe_execute", "description": "Safely verify thread.thread.inject with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.thread.inject", "type": "declared", "state": "declared", "description": "Discover declared support for thread.thread.inject" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2077", "external_name": "Thread Thread Inject", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.thread.inspect", "stable_id": "OSCO-CAP-0088", "name": "Inspect Thread", "description": "Perform inspect operation on thread in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.thread.inspect" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "thread state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.thread.inspect", "type": "safe_execute", "description": "Safely verify thread.thread.inspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.thread.inspect", "type": "declared", "state": "declared", "description": "Discover declared support for thread.thread.inspect" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2076", "external_name": "Thread Thread Inspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.thread.resume", "stable_id": "OSCO-CAP-0087", "name": "Resume Thread", "description": "Perform resume operation on thread in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.thread.resume" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "thread state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.thread.resume", "type": "safe_execute", "description": "Safely verify thread.thread.resume with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.thread.resume", "type": "declared", "state": "declared", "description": "Discover declared support for thread.thread.resume" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2075", "external_name": "Thread Thread Resume", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "thread.thread.suspend", "stable_id": "OSCO-CAP-0086", "name": "Suspend Thread", "description": "Perform suspend operation on thread in the thread domain.", "category": "endpoint", "domain": "thread", "platforms": [ "windows", "linux", "macos" ], "providers": [ "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "thread.thread.suspend" ], "preconditions": [ "provider exposes thread capability surface" ], "postconditions": [ "thread state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.thread.thread.suspend", "type": "safe_execute", "description": "Safely verify thread.thread.suspend with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.thread.thread.suspend", "type": "declared", "state": "declared", "description": "Discover declared support for thread.thread.suspend" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2074", "external_name": "Thread Thread Suspend", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.access_token.exchange", "stable_id": "OSCO-CAP-0406", "name": "Exchange Access Token", "description": "Perform exchange operation on access token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.access_token.exchange" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "access token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.access_token.exchange", "type": "safe_execute", "description": "Safely verify token.access_token.exchange with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.access_token.exchange", "type": "declared", "state": "declared", "description": "Discover declared support for token.access_token.exchange" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2394", "external_name": "Token Access Token Exchange", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.access_token.introspect", "stable_id": "OSCO-CAP-0407", "name": "Introspect Access Token", "description": "Perform introspect operation on access token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.access_token.introspect" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "access token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.access_token.introspect", "type": "safe_execute", "description": "Safely verify token.access_token.introspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.access_token.introspect", "type": "declared", "state": "declared", "description": "Discover declared support for token.access_token.introspect" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2395", "external_name": "Token Access Token Introspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.access_token.issue", "stable_id": "OSCO-CAP-0403", "name": "Issue Access Token", "description": "Perform issue operation on access token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.access_token.issue" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "access token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.access_token.issue", "type": "safe_execute", "description": "Safely verify token.access_token.issue with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.access_token.issue", "type": "declared", "state": "declared", "description": "Discover declared support for token.access_token.issue" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2391", "external_name": "Token Access Token Issue", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.access_token.revoke", "stable_id": "OSCO-CAP-0405", "name": "Revoke Access Token", "description": "Perform revoke operation on access token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.access_token.revoke" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "access token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.access_token.revoke", "type": "safe_execute", "description": "Safely verify token.access_token.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.access_token.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for token.access_token.revoke" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2393", "external_name": "Token Access Token Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.access_token.validate", "stable_id": "OSCO-CAP-0404", "name": "Validate Access Token", "description": "Perform validate operation on access token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.access_token.validate" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "access token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.access_token.validate", "type": "safe_execute", "description": "Safely verify token.access_token.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.access_token.validate", "type": "declared", "state": "declared", "description": "Discover declared support for token.access_token.validate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2392", "external_name": "Token Access Token Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.api_token.exchange", "stable_id": "OSCO-CAP-0421", "name": "Exchange Api Token", "description": "Perform exchange operation on api token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.api_token.exchange" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "api token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.api_token.exchange", "type": "safe_execute", "description": "Safely verify token.api_token.exchange with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.api_token.exchange", "type": "declared", "state": "declared", "description": "Discover declared support for token.api_token.exchange" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2409", "external_name": "Token Api Token Exchange", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.api_token.introspect", "stable_id": "OSCO-CAP-0422", "name": "Introspect Api Token", "description": "Perform introspect operation on api token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.api_token.introspect" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "api token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.api_token.introspect", "type": "safe_execute", "description": "Safely verify token.api_token.introspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.api_token.introspect", "type": "declared", "state": "declared", "description": "Discover declared support for token.api_token.introspect" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2410", "external_name": "Token Api Token Introspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.api_token.issue", "stable_id": "OSCO-CAP-0418", "name": "Issue Api Token", "description": "Perform issue operation on api token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.api_token.issue" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "api token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.api_token.issue", "type": "safe_execute", "description": "Safely verify token.api_token.issue with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.api_token.issue", "type": "declared", "state": "declared", "description": "Discover declared support for token.api_token.issue" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2406", "external_name": "Token Api Token Issue", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.api_token.revoke", "stable_id": "OSCO-CAP-0420", "name": "Revoke Api Token", "description": "Perform revoke operation on api token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.api_token.revoke" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "api token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.api_token.revoke", "type": "safe_execute", "description": "Safely verify token.api_token.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.api_token.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for token.api_token.revoke" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2408", "external_name": "Token Api Token Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.api_token.validate", "stable_id": "OSCO-CAP-0419", "name": "Validate Api Token", "description": "Perform validate operation on api token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.api_token.validate" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "api token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.api_token.validate", "type": "safe_execute", "description": "Safely verify token.api_token.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.api_token.validate", "type": "declared", "state": "declared", "description": "Discover declared support for token.api_token.validate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2407", "external_name": "Token Api Token Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.id_token.exchange", "stable_id": "OSCO-CAP-0416", "name": "Exchange Id Token", "description": "Perform exchange operation on id token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.id_token.exchange" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "id token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.id_token.exchange", "type": "safe_execute", "description": "Safely verify token.id_token.exchange with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.id_token.exchange", "type": "declared", "state": "declared", "description": "Discover declared support for token.id_token.exchange" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2404", "external_name": "Token Id Token Exchange", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.id_token.introspect", "stable_id": "OSCO-CAP-0417", "name": "Introspect Id Token", "description": "Perform introspect operation on id token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.id_token.introspect" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "id token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.id_token.introspect", "type": "safe_execute", "description": "Safely verify token.id_token.introspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.id_token.introspect", "type": "declared", "state": "declared", "description": "Discover declared support for token.id_token.introspect" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2405", "external_name": "Token Id Token Introspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.id_token.issue", "stable_id": "OSCO-CAP-0413", "name": "Issue Id Token", "description": "Perform issue operation on id token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.id_token.issue" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "id token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.id_token.issue", "type": "safe_execute", "description": "Safely verify token.id_token.issue with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.id_token.issue", "type": "declared", "state": "declared", "description": "Discover declared support for token.id_token.issue" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2401", "external_name": "Token Id Token Issue", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.id_token.revoke", "stable_id": "OSCO-CAP-0415", "name": "Revoke Id Token", "description": "Perform revoke operation on id token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.id_token.revoke" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "id token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.id_token.revoke", "type": "safe_execute", "description": "Safely verify token.id_token.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.id_token.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for token.id_token.revoke" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2403", "external_name": "Token Id Token Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.id_token.validate", "stable_id": "OSCO-CAP-0414", "name": "Validate Id Token", "description": "Perform validate operation on id token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.id_token.validate" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "id token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.id_token.validate", "type": "safe_execute", "description": "Safely verify token.id_token.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.id_token.validate", "type": "declared", "state": "declared", "description": "Discover declared support for token.id_token.validate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2402", "external_name": "Token Id Token Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.refresh_token.exchange", "stable_id": "OSCO-CAP-0411", "name": "Exchange Refresh Token", "description": "Perform exchange operation on refresh token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.refresh_token.exchange" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "refresh token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.refresh_token.exchange", "type": "safe_execute", "description": "Safely verify token.refresh_token.exchange with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.refresh_token.exchange", "type": "declared", "state": "declared", "description": "Discover declared support for token.refresh_token.exchange" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2399", "external_name": "Token Refresh Token Exchange", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.refresh_token.introspect", "stable_id": "OSCO-CAP-0412", "name": "Introspect Refresh Token", "description": "Perform introspect operation on refresh token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.refresh_token.introspect" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "refresh token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.refresh_token.introspect", "type": "safe_execute", "description": "Safely verify token.refresh_token.introspect with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.refresh_token.introspect", "type": "declared", "state": "declared", "description": "Discover declared support for token.refresh_token.introspect" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2400", "external_name": "Token Refresh Token Introspect", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.refresh_token.issue", "stable_id": "OSCO-CAP-0408", "name": "Issue Refresh Token", "description": "Perform issue operation on refresh token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.refresh_token.issue" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "refresh token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.refresh_token.issue", "type": "safe_execute", "description": "Safely verify token.refresh_token.issue with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.refresh_token.issue", "type": "declared", "state": "declared", "description": "Discover declared support for token.refresh_token.issue" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2396", "external_name": "Token Refresh Token Issue", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.refresh_token.revoke", "stable_id": "OSCO-CAP-0410", "name": "Revoke Refresh Token", "description": "Perform revoke operation on refresh token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.refresh_token.revoke" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "refresh token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.refresh_token.revoke", "type": "safe_execute", "description": "Safely verify token.refresh_token.revoke with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.refresh_token.revoke", "type": "declared", "state": "declared", "description": "Discover declared support for token.refresh_token.revoke" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2398", "external_name": "Token Refresh Token Revoke", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "token.refresh_token.validate", "stable_id": "OSCO-CAP-0409", "name": "Validate Refresh Token", "description": "Perform validate operation on refresh token in the token domain.", "category": "identity", "domain": "token", "platforms": [ "identity", "cloud", "saas" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp", "provider.github", "provider.google_workspace", "provider.microsoft365", "provider.okta" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "token.refresh_token.validate" ], "preconditions": [ "provider exposes token capability surface" ], "postconditions": [ "refresh token state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.token.refresh_token.validate", "type": "safe_execute", "description": "Safely verify token.refresh_token.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.token.refresh_token.validate", "type": "declared", "state": "declared", "description": "Discover declared support for token.refresh_token.validate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2397", "external_name": "Token Refresh Token Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.atomic.cleanup", "stable_id": "OSCO-CAP-0964", "name": "Cleanup Atomic", "description": "Perform cleanup operation on atomic in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.atomic.cleanup" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "atomic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.atomic.cleanup", "type": "safe_execute", "description": "Safely verify validation.atomic.cleanup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.atomic.cleanup", "type": "declared", "state": "declared", "description": "Discover declared support for validation.atomic.cleanup" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2952", "external_name": "Validation Atomic Cleanup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.atomic.execute", "stable_id": "OSCO-CAP-0962", "name": "Execute Atomic", "description": "Perform execute operation on atomic in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.atomic.execute" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "atomic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.atomic.execute", "type": "safe_execute", "description": "Safely verify validation.atomic.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.atomic.execute", "type": "declared", "state": "declared", "description": "Discover declared support for validation.atomic.execute" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2950", "external_name": "Validation Atomic Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.atomic.measure", "stable_id": "OSCO-CAP-0963", "name": "Measure Atomic", "description": "Perform measure operation on atomic in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.atomic.measure" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "atomic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.atomic.measure", "type": "safe_execute", "description": "Safely verify validation.atomic.measure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.atomic.measure", "type": "declared", "state": "declared", "description": "Discover declared support for validation.atomic.measure" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2951", "external_name": "Validation Atomic Measure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.atomic.report", "stable_id": "OSCO-CAP-0965", "name": "Report Atomic", "description": "Perform report operation on atomic in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.atomic.report" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "atomic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.atomic.report", "type": "safe_execute", "description": "Safely verify validation.atomic.report with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.atomic.report", "type": "declared", "state": "declared", "description": "Discover declared support for validation.atomic.report" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2953", "external_name": "Validation Atomic Report", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.atomic.validate", "stable_id": "OSCO-CAP-0961", "name": "Validate Atomic", "description": "Perform validate operation on atomic in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.atomic.validate" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "atomic state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.atomic.validate", "type": "safe_execute", "description": "Safely verify validation.atomic.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.atomic.validate", "type": "declared", "state": "declared", "description": "Discover declared support for validation.atomic.validate" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2949", "external_name": "Validation Atomic Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.coverage.cleanup", "stable_id": "OSCO-CAP-0969", "name": "Cleanup Coverage", "description": "Perform cleanup operation on coverage in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.coverage.cleanup" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "coverage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.coverage.cleanup", "type": "safe_execute", "description": "Safely verify validation.coverage.cleanup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.coverage.cleanup", "type": "declared", "state": "declared", "description": "Discover declared support for validation.coverage.cleanup" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2957", "external_name": "Validation Coverage Cleanup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.coverage.execute", "stable_id": "OSCO-CAP-0967", "name": "Execute Coverage", "description": "Perform execute operation on coverage in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.coverage.execute" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "coverage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.coverage.execute", "type": "safe_execute", "description": "Safely verify validation.coverage.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.coverage.execute", "type": "declared", "state": "declared", "description": "Discover declared support for validation.coverage.execute" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2955", "external_name": "Validation Coverage Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.coverage.measure", "stable_id": "OSCO-CAP-0968", "name": "Measure Coverage", "description": "Perform measure operation on coverage in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.coverage.measure" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "coverage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.coverage.measure", "type": "safe_execute", "description": "Safely verify validation.coverage.measure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.coverage.measure", "type": "declared", "state": "declared", "description": "Discover declared support for validation.coverage.measure" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2956", "external_name": "Validation Coverage Measure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.coverage.report", "stable_id": "OSCO-CAP-0970", "name": "Report Coverage", "description": "Perform report operation on coverage in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.coverage.report" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "coverage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.coverage.report", "type": "safe_execute", "description": "Safely verify validation.coverage.report with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.coverage.report", "type": "declared", "state": "declared", "description": "Discover declared support for validation.coverage.report" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2958", "external_name": "Validation Coverage Report", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.coverage.validate", "stable_id": "OSCO-CAP-0966", "name": "Validate Coverage", "description": "Perform validate operation on coverage in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.coverage.validate" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "coverage state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.coverage.validate", "type": "safe_execute", "description": "Safely verify validation.coverage.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.coverage.validate", "type": "declared", "state": "declared", "description": "Discover declared support for validation.coverage.validate" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2954", "external_name": "Validation Coverage Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.persistence.endpoint.validate", "stable_id": "OSCO-CAP-0012", "name": "Validate Endpoint Persistence", "description": "Run safe endpoint persistence validation workflows.", "category": "validation", "domain": "validation", "platforms": [ "windows", "linux", "macos", "cross_platform" ], "providers": [ "provider.windows", "provider.linux", "provider.macos" ], "status": "stable", "confidence": 0.9, "safety": "caution", "verification_methods": [ { "method_id": "verify.atomic.persistence", "type": "atomic_test", "description": "Execute safe atomic persistence checks", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "T1053.005", "external_name": "Scheduled Task", "relation": "validates", "confidence": 0.9 } ] }, { "capability_id": "validation.result.cleanup", "stable_id": "OSCO-CAP-0974", "name": "Cleanup Result", "description": "Perform cleanup operation on result in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.result.cleanup" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "result state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.result.cleanup", "type": "safe_execute", "description": "Safely verify validation.result.cleanup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.result.cleanup", "type": "declared", "state": "declared", "description": "Discover declared support for validation.result.cleanup" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2962", "external_name": "Validation Result Cleanup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.result.execute", "stable_id": "OSCO-CAP-0972", "name": "Execute Result", "description": "Perform execute operation on result in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.result.execute" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "result state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.result.execute", "type": "safe_execute", "description": "Safely verify validation.result.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.result.execute", "type": "declared", "state": "declared", "description": "Discover declared support for validation.result.execute" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2960", "external_name": "Validation Result Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.result.measure", "stable_id": "OSCO-CAP-0973", "name": "Measure Result", "description": "Perform measure operation on result in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.result.measure" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "result state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.result.measure", "type": "safe_execute", "description": "Safely verify validation.result.measure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.result.measure", "type": "declared", "state": "declared", "description": "Discover declared support for validation.result.measure" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2961", "external_name": "Validation Result Measure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.result.report", "stable_id": "OSCO-CAP-0975", "name": "Report Result", "description": "Perform report operation on result in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.result.report" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "result state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.result.report", "type": "safe_execute", "description": "Safely verify validation.result.report with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.result.report", "type": "declared", "state": "declared", "description": "Discover declared support for validation.result.report" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2963", "external_name": "Validation Result Report", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.result.validate", "stable_id": "OSCO-CAP-0971", "name": "Validate Result", "description": "Perform validate operation on result in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.result.validate" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "result state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.result.validate", "type": "safe_execute", "description": "Safely verify validation.result.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.result.validate", "type": "declared", "state": "declared", "description": "Discover declared support for validation.result.validate" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2959", "external_name": "Validation Result Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.scenario.cleanup", "stable_id": "OSCO-CAP-0959", "name": "Cleanup Scenario", "description": "Perform cleanup operation on scenario in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.scenario.cleanup" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "scenario state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.scenario.cleanup", "type": "safe_execute", "description": "Safely verify validation.scenario.cleanup with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.scenario.cleanup", "type": "declared", "state": "declared", "description": "Discover declared support for validation.scenario.cleanup" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2947", "external_name": "Validation Scenario Cleanup", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.scenario.execute", "stable_id": "OSCO-CAP-0957", "name": "Execute Scenario", "description": "Perform execute operation on scenario in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.scenario.execute" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "scenario state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.scenario.execute", "type": "safe_execute", "description": "Safely verify validation.scenario.execute with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.scenario.execute", "type": "declared", "state": "declared", "description": "Discover declared support for validation.scenario.execute" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2945", "external_name": "Validation Scenario Execute", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.scenario.measure", "stable_id": "OSCO-CAP-0958", "name": "Measure Scenario", "description": "Perform measure operation on scenario in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.scenario.measure" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "scenario state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.scenario.measure", "type": "safe_execute", "description": "Safely verify validation.scenario.measure with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.scenario.measure", "type": "declared", "state": "declared", "description": "Discover declared support for validation.scenario.measure" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2946", "external_name": "Validation Scenario Measure", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.scenario.report", "stable_id": "OSCO-CAP-0960", "name": "Report Scenario", "description": "Perform report operation on scenario in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.scenario.report" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "scenario state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.scenario.report", "type": "safe_execute", "description": "Safely verify validation.scenario.report with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.scenario.report", "type": "declared", "state": "declared", "description": "Discover declared support for validation.scenario.report" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2948", "external_name": "Validation Scenario Report", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "validation.scenario.validate", "stable_id": "OSCO-CAP-0956", "name": "Validate Scenario", "description": "Perform validate operation on scenario in the validation domain.", "category": "validation", "domain": "validation", "platforms": [ "cross_platform", "cloud", "saas" ], "providers": [ "provider.github", "provider.kubernetes", "provider.linux", "provider.macos", "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "validation.scenario.validate" ], "preconditions": [ "provider exposes validation capability surface" ], "postconditions": [ "scenario state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.validation.scenario.validate", "type": "safe_execute", "description": "Safely verify validation.scenario.validate with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.validation.scenario.validate", "type": "declared", "state": "declared", "description": "Discover declared support for validation.scenario.validate" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2944", "external_name": "Validation Scenario Validate", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.hypervisor.clone", "stable_id": "OSCO-CAP-0740", "name": "Clone Hypervisor", "description": "Perform clone operation on hypervisor in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.hypervisor.clone" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "hypervisor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.hypervisor.clone", "type": "safe_execute", "description": "Safely verify virtualization.hypervisor.clone with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.hypervisor.clone", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.hypervisor.clone" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2728", "external_name": "Virtualization Hypervisor Clone", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.hypervisor.create", "stable_id": "OSCO-CAP-0737", "name": "Create Hypervisor", "description": "Perform create operation on hypervisor in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.hypervisor.create" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "hypervisor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.hypervisor.create", "type": "safe_execute", "description": "Safely verify virtualization.hypervisor.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.hypervisor.create", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.hypervisor.create" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2725", "external_name": "Virtualization Hypervisor Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.hypervisor.delete", "stable_id": "OSCO-CAP-0741", "name": "Delete Hypervisor", "description": "Perform delete operation on hypervisor in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.hypervisor.delete" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "hypervisor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.hypervisor.delete", "type": "safe_execute", "description": "Safely verify virtualization.hypervisor.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.hypervisor.delete", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.hypervisor.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2729", "external_name": "Virtualization Hypervisor Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.hypervisor.start", "stable_id": "OSCO-CAP-0738", "name": "Start Hypervisor", "description": "Perform start operation on hypervisor in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.hypervisor.start" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "hypervisor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.hypervisor.start", "type": "safe_execute", "description": "Safely verify virtualization.hypervisor.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.hypervisor.start", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.hypervisor.start" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2726", "external_name": "Virtualization Hypervisor Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.hypervisor.stop", "stable_id": "OSCO-CAP-0739", "name": "Stop Hypervisor", "description": "Perform stop operation on hypervisor in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.hypervisor.stop" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "hypervisor state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.hypervisor.stop", "type": "safe_execute", "description": "Safely verify virtualization.hypervisor.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.hypervisor.stop", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.hypervisor.stop" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2727", "external_name": "Virtualization Hypervisor Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.snapshot.clone", "stable_id": "OSCO-CAP-0735", "name": "Clone Snapshot", "description": "Perform clone operation on snapshot in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.snapshot.clone" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.snapshot.clone", "type": "safe_execute", "description": "Safely verify virtualization.snapshot.clone with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.snapshot.clone", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.snapshot.clone" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2723", "external_name": "Virtualization Snapshot Clone", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.snapshot.create", "stable_id": "OSCO-CAP-0732", "name": "Create Snapshot", "description": "Perform create operation on snapshot in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.snapshot.create" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.snapshot.create", "type": "safe_execute", "description": "Safely verify virtualization.snapshot.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.snapshot.create", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.snapshot.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2720", "external_name": "Virtualization Snapshot Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.snapshot.delete", "stable_id": "OSCO-CAP-0736", "name": "Delete Snapshot", "description": "Perform delete operation on snapshot in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.snapshot.delete" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.snapshot.delete", "type": "safe_execute", "description": "Safely verify virtualization.snapshot.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.snapshot.delete", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.snapshot.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2724", "external_name": "Virtualization Snapshot Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.snapshot.start", "stable_id": "OSCO-CAP-0733", "name": "Start Snapshot", "description": "Perform start operation on snapshot in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.snapshot.start" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.snapshot.start", "type": "safe_execute", "description": "Safely verify virtualization.snapshot.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.snapshot.start", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.snapshot.start" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2721", "external_name": "Virtualization Snapshot Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.snapshot.stop", "stable_id": "OSCO-CAP-0734", "name": "Stop Snapshot", "description": "Perform stop operation on snapshot in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.snapshot.stop" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "snapshot state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.snapshot.stop", "type": "safe_execute", "description": "Safely verify virtualization.snapshot.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.snapshot.stop", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.snapshot.stop" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2722", "external_name": "Virtualization Snapshot Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.template.clone", "stable_id": "OSCO-CAP-0745", "name": "Clone Template", "description": "Perform clone operation on template in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.template.clone" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.template.clone", "type": "safe_execute", "description": "Safely verify virtualization.template.clone with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.template.clone", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.template.clone" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2733", "external_name": "Virtualization Template Clone", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.template.create", "stable_id": "OSCO-CAP-0742", "name": "Create Template", "description": "Perform create operation on template in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.template.create" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.template.create", "type": "safe_execute", "description": "Safely verify virtualization.template.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.template.create", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.template.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2730", "external_name": "Virtualization Template Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.template.delete", "stable_id": "OSCO-CAP-0746", "name": "Delete Template", "description": "Perform delete operation on template in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.template.delete" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.template.delete", "type": "safe_execute", "description": "Safely verify virtualization.template.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.template.delete", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.template.delete" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2734", "external_name": "Virtualization Template Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.template.start", "stable_id": "OSCO-CAP-0743", "name": "Start Template", "description": "Perform start operation on template in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.template.start" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.template.start", "type": "safe_execute", "description": "Safely verify virtualization.template.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.template.start", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.template.start" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2731", "external_name": "Virtualization Template Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.template.stop", "stable_id": "OSCO-CAP-0744", "name": "Stop Template", "description": "Perform stop operation on template in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.template.stop" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "template state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.template.stop", "type": "safe_execute", "description": "Safely verify virtualization.template.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.template.stop", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.template.stop" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2732", "external_name": "Virtualization Template Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.vm.clone", "stable_id": "OSCO-CAP-0730", "name": "Clone Vm", "description": "Perform clone operation on vm in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.vm.clone" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "vm state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.vm.clone", "type": "safe_execute", "description": "Safely verify virtualization.vm.clone with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.vm.clone", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.vm.clone" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2718", "external_name": "Virtualization Vm Clone", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.vm.create", "stable_id": "OSCO-CAP-0727", "name": "Create Vm", "description": "Perform create operation on vm in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.vm.create" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "vm state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.vm.create", "type": "safe_execute", "description": "Safely verify virtualization.vm.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.vm.create", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.vm.create" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2715", "external_name": "Virtualization Vm Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.vm.delete", "stable_id": "OSCO-CAP-0731", "name": "Delete Vm", "description": "Perform delete operation on vm in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.vm.delete" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "vm state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.vm.delete", "type": "safe_execute", "description": "Safely verify virtualization.vm.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.vm.delete", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.vm.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2719", "external_name": "Virtualization Vm Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.vm.start", "stable_id": "OSCO-CAP-0728", "name": "Start Vm", "description": "Perform start operation on vm in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.vm.start" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "vm state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.vm.start", "type": "safe_execute", "description": "Safely verify virtualization.vm.start with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.vm.start", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.vm.start" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2716", "external_name": "Virtualization Vm Start", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "virtualization.vm.stop", "stable_id": "OSCO-CAP-0729", "name": "Stop Vm", "description": "Perform stop operation on vm in the virtualization domain.", "category": "cloud", "domain": "virtualization", "platforms": [ "cloud", "container" ], "providers": [ "provider.aws", "provider.azure", "provider.gcp" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "virtualization.vm.stop" ], "preconditions": [ "provider exposes virtualization capability surface" ], "postconditions": [ "vm state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.virtualization.vm.stop", "type": "safe_execute", "description": "Safely verify virtualization.vm.stop with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.virtualization.vm.stop", "type": "declared", "state": "declared", "description": "Discover declared support for virtualization.vm.stop" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2717", "external_name": "Virtualization Vm Stop", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "windows.task.create", "stable_id": "OSCO-CAP-0003", "name": "Create Scheduled Task", "description": "Create a Windows scheduled task.", "category": "endpoint", "domain": "scheduled_task", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "status": "stable", "confidence": 0.97, "safety": "caution", "parent_capability": "persistence.maintain", "required_privileges": [ "task_scheduler_write" ], "inputs": [ "name", "trigger", "action" ], "outputs": [ "task_id" ], "discovery_methods": [ { "method_id": "discover.tasks.api", "type": "api", "state": "verified", "description": "Enumerate task scheduler API and cmdlets" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "T1053.005", "external_name": "Scheduled Task/Job: Scheduled Task", "confidence": 0.98 }, { "framework": "atomic_red_team", "external_id": "T1053.005", "external_name": "Scheduled Task", "relation": "validates", "confidence": 0.94 } ] }, { "capability_id": "wmi.class.create", "stable_id": "OSCO-CAP-0609", "name": "Create Class", "description": "Perform create operation on class in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.class.create" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.class.create", "type": "safe_execute", "description": "Safely verify wmi.class.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.class.create", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.class.create" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2597", "external_name": "Wmi Class Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.class.delete", "stable_id": "OSCO-CAP-0611", "name": "Delete Class", "description": "Perform delete operation on class in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.class.delete" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.class.delete", "type": "safe_execute", "description": "Safely verify wmi.class.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.class.delete", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.class.delete" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2599", "external_name": "Wmi Class Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.class.modify", "stable_id": "OSCO-CAP-0610", "name": "Modify Class", "description": "Perform modify operation on class in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.class.modify" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.class.modify", "type": "safe_execute", "description": "Safely verify wmi.class.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.class.modify", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.class.modify" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2598", "external_name": "Wmi Class Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.class.query", "stable_id": "OSCO-CAP-0608", "name": "Query Class", "description": "Perform query operation on class in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.class.query" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.class.query", "type": "safe_execute", "description": "Safely verify wmi.class.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.class.query", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.class.query" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2596", "external_name": "Wmi Class Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.class.subscribe", "stable_id": "OSCO-CAP-0612", "name": "Subscribe Class", "description": "Perform subscribe operation on class in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.class.subscribe" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "class state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.class.subscribe", "type": "safe_execute", "description": "Safely verify wmi.class.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.class.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.class.subscribe" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2600", "external_name": "Wmi Class Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.instance.create", "stable_id": "OSCO-CAP-0614", "name": "Create Instance", "description": "Perform create operation on instance in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.instance.create" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.instance.create", "type": "safe_execute", "description": "Safely verify wmi.instance.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.instance.create", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.instance.create" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2602", "external_name": "Wmi Instance Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.instance.delete", "stable_id": "OSCO-CAP-0616", "name": "Delete Instance", "description": "Perform delete operation on instance in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.instance.delete" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.instance.delete", "type": "safe_execute", "description": "Safely verify wmi.instance.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.instance.delete", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.instance.delete" } ], "mappings": [ { "framework": "atomic_red_team", "external_id": "atomic_red_team-2604", "external_name": "Wmi Instance Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.instance.modify", "stable_id": "OSCO-CAP-0615", "name": "Modify Instance", "description": "Perform modify operation on instance in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.instance.modify" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.instance.modify", "type": "safe_execute", "description": "Safely verify wmi.instance.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.instance.modify", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.instance.modify" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2603", "external_name": "Wmi Instance Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.instance.query", "stable_id": "OSCO-CAP-0613", "name": "Query Instance", "description": "Perform query operation on instance in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.instance.query" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.instance.query", "type": "safe_execute", "description": "Safely verify wmi.instance.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.instance.query", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.instance.query" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2601", "external_name": "Wmi Instance Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.instance.subscribe", "stable_id": "OSCO-CAP-0617", "name": "Subscribe Instance", "description": "Perform subscribe operation on instance in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.instance.subscribe" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "instance state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.instance.subscribe", "type": "safe_execute", "description": "Safely verify wmi.instance.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.instance.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.instance.subscribe" } ], "mappings": [ { "framework": "velociraptor", "external_id": "velociraptor-2605", "external_name": "Wmi Instance Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.namespace.create", "stable_id": "OSCO-CAP-0604", "name": "Create Namespace", "description": "Perform create operation on namespace in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.namespace.create" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "namespace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.namespace.create", "type": "safe_execute", "description": "Safely verify wmi.namespace.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.namespace.create", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.namespace.create" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2592", "external_name": "Wmi Namespace Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.namespace.delete", "stable_id": "OSCO-CAP-0606", "name": "Delete Namespace", "description": "Perform delete operation on namespace in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.namespace.delete" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "namespace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.namespace.delete", "type": "safe_execute", "description": "Safely verify wmi.namespace.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.namespace.delete", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.namespace.delete" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2594", "external_name": "Wmi Namespace Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.namespace.modify", "stable_id": "OSCO-CAP-0605", "name": "Modify Namespace", "description": "Perform modify operation on namespace in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.namespace.modify" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "namespace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.namespace.modify", "type": "safe_execute", "description": "Safely verify wmi.namespace.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.namespace.modify", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.namespace.modify" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2593", "external_name": "Wmi Namespace Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.namespace.query", "stable_id": "OSCO-CAP-0603", "name": "Query Namespace", "description": "Perform query operation on namespace in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.namespace.query" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "namespace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.namespace.query", "type": "safe_execute", "description": "Safely verify wmi.namespace.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.namespace.query", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.namespace.query" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2591", "external_name": "Wmi Namespace Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.namespace.subscribe", "stable_id": "OSCO-CAP-0607", "name": "Subscribe Namespace", "description": "Perform subscribe operation on namespace in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.namespace.subscribe" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "namespace state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.namespace.subscribe", "type": "safe_execute", "description": "Safely verify wmi.namespace.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.namespace.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.namespace.subscribe" } ], "mappings": [ { "framework": "ecs", "external_id": "ecs-2595", "external_name": "Wmi Namespace Subscribe", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.subscription.create", "stable_id": "OSCO-CAP-0619", "name": "Create Subscription", "description": "Perform create operation on subscription in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.subscription.create" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.subscription.create", "type": "safe_execute", "description": "Safely verify wmi.subscription.create with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.subscription.create", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.subscription.create" } ], "mappings": [ { "framework": "event_maturity_matrix", "external_id": "event_maturity_matrix-2607", "external_name": "Wmi Subscription Create", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.subscription.delete", "stable_id": "OSCO-CAP-0621", "name": "Delete Subscription", "description": "Perform delete operation on subscription in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.subscription.delete" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.subscription.delete", "type": "safe_execute", "description": "Safely verify wmi.subscription.delete with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.subscription.delete", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.subscription.delete" } ], "mappings": [ { "framework": "sigma", "external_id": "sigma-2609", "external_name": "Wmi Subscription Delete", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.subscription.modify", "stable_id": "OSCO-CAP-0620", "name": "Modify Subscription", "description": "Perform modify operation on subscription in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.subscription.modify" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.subscription.modify", "type": "safe_execute", "description": "Safely verify wmi.subscription.modify with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.subscription.modify", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.subscription.modify" } ], "mappings": [ { "framework": "mitre_attack", "external_id": "mitre_attack-2608", "external_name": "Wmi Subscription Modify", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.subscription.query", "stable_id": "OSCO-CAP-0618", "name": "Query Subscription", "description": "Perform query operation on subscription in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.subscription.query" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.subscription.query", "type": "safe_execute", "description": "Safely verify wmi.subscription.query with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.subscription.query", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.subscription.query" } ], "mappings": [ { "framework": "osquery", "external_id": "osquery-2606", "external_name": "Wmi Subscription Query", "relation": "maps_to", "confidence": 0.72 } ] }, { "capability_id": "wmi.subscription.subscribe", "stable_id": "OSCO-CAP-0622", "name": "Subscribe Subscription", "description": "Perform subscribe operation on subscription in the wmi domain.", "category": "endpoint", "domain": "wmi", "platforms": [ "windows" ], "providers": [ "provider.windows" ], "version": "0.1.0", "status": "stable", "confidence": 0.86, "safety": "caution", "required_privileges": [ "wmi.subscription.subscribe" ], "preconditions": [ "provider exposes wmi capability surface" ], "postconditions": [ "subscription state may change based on action" ], "inputs": [ "target", "context" ], "outputs": [ "result" ], "cleanup_supported": true, "verification_methods": [ { "method_id": "verify.wmi.subscription.subscribe", "type": "safe_execute", "description": "Safely verify wmi.subscription.subscribe with dry run and cleanup support", "supports_dry_run": true, "supports_safe_mode": true, "supports_cleanup": true, "supports_rollback": true } ], "discovery_methods": [ { "method_id": "discover.wmi.subscription.subscribe", "type": "declared", "state": "declared", "description": "Discover declared support for wmi.subscription.subscribe" } ], "mappings": [ { "framework": "ocsf", "external_id": "ocsf-2610", "external_name": "Wmi Subscription Subscribe", "relation": "maps_to", "confidence": 0.72 } ] } ]