[
  {
    "capability_id": "ai.assistant.classify",
    "stable_id": "OSCO-CAP-0001",
    "name": "Classify Assistant",
    "description": "Perform classify operation on assistant in the ai domain.",
    "category": "ai",
    "domain": "ai",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "ai.assistant.classify"
    ],
    "preconditions": [
      "provider exposes ai capability surface"
    ],
    "postconditions": [
      "assistant state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.ai.assistant.classify",
        "type": "safe_execute",
        "description": "Safely verify ai.assistant.classify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.ai.assistant.classify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for ai.assistant.classify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "ai.assistant.explain",
    "stable_id": "OSCO-CAP-0002",
    "name": "Explain Assistant",
    "description": "Perform explain operation on assistant in the ai domain.",
    "category": "ai",
    "domain": "ai",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "ai.assistant.explain"
    ],
    "preconditions": [
      "provider exposes ai capability surface"
    ],
    "postconditions": [
      "assistant state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.ai.assistant.explain",
        "type": "safe_execute",
        "description": "Safely verify ai.assistant.explain with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.ai.assistant.explain",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for ai.assistant.explain"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "ai.assistant.reason",
    "stable_id": "OSCO-CAP-0003",
    "name": "Reason Assistant",
    "description": "Perform reason operation on assistant in the ai domain.",
    "category": "ai",
    "domain": "ai",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "ai.assistant.reason"
    ],
    "preconditions": [
      "provider exposes ai capability surface"
    ],
    "postconditions": [
      "assistant state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.ai.assistant.reason",
        "type": "safe_execute",
        "description": "Safely verify ai.assistant.reason with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.ai.assistant.reason",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for ai.assistant.reason"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "ai.assistant.suggest",
    "stable_id": "OSCO-CAP-0004",
    "name": "Suggest Assistant",
    "description": "Perform suggest operation on assistant in the ai domain.",
    "category": "ai",
    "domain": "ai",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "ai.assistant.suggest"
    ],
    "preconditions": [
      "provider exposes ai capability surface"
    ],
    "postconditions": [
      "assistant state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.ai.assistant.suggest",
        "type": "safe_execute",
        "description": "Safely verify ai.assistant.suggest with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.ai.assistant.suggest",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for ai.assistant.suggest"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "api.endpoint.create",
    "stable_id": "OSCO-CAP-0005",
    "name": "Create Endpoint",
    "description": "Perform create operation on endpoint in the api domain.",
    "category": "automation",
    "domain": "api",
    "platforms": [
      "cloud",
      "saas",
      "cross_platform"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "api.endpoint.create"
    ],
    "preconditions": [
      "provider exposes api capability surface"
    ],
    "postconditions": [
      "endpoint state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.api.endpoint.create",
        "type": "safe_execute",
        "description": "Safely verify api.endpoint.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.api.endpoint.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for api.endpoint.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "api.endpoint.delete",
    "stable_id": "OSCO-CAP-0006",
    "name": "Delete Endpoint",
    "description": "Perform delete operation on endpoint in the api domain.",
    "category": "automation",
    "domain": "api",
    "platforms": [
      "cloud",
      "saas",
      "cross_platform"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "api.endpoint.delete"
    ],
    "preconditions": [
      "provider exposes api capability surface"
    ],
    "postconditions": [
      "endpoint state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.api.endpoint.delete",
        "type": "safe_execute",
        "description": "Safely verify api.endpoint.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.api.endpoint.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for api.endpoint.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "api.endpoint.read",
    "stable_id": "OSCO-CAP-0007",
    "name": "Read Endpoint",
    "description": "Perform read operation on endpoint in the api domain.",
    "category": "automation",
    "domain": "api",
    "platforms": [
      "cloud",
      "saas",
      "cross_platform"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "api.endpoint.read"
    ],
    "preconditions": [
      "provider exposes api capability surface"
    ],
    "postconditions": [
      "endpoint state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.api.endpoint.read",
        "type": "safe_execute",
        "description": "Safely verify api.endpoint.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.api.endpoint.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for api.endpoint.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "api.endpoint.rotate",
    "stable_id": "OSCO-CAP-0008",
    "name": "Rotate Endpoint",
    "description": "Perform rotate operation on endpoint in the api domain.",
    "category": "automation",
    "domain": "api",
    "platforms": [
      "cloud",
      "saas",
      "cross_platform"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "api.endpoint.rotate"
    ],
    "preconditions": [
      "provider exposes api capability surface"
    ],
    "postconditions": [
      "endpoint state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.api.endpoint.rotate",
        "type": "safe_execute",
        "description": "Safely verify api.endpoint.rotate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.api.endpoint.rotate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for api.endpoint.rotate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.event.disable",
    "stable_id": "OSCO-CAP-0009",
    "name": "Disable Event",
    "description": "Disable Windows audit event logging categories via auditpol or Group Policy, removing the telemetry needed to detect attacker activity.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.event.disable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "event state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.event.disable",
        "type": "safe_execute",
        "description": "Safely verify audit.event.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.event.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.event.disable"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.002",
        "external_name": "Impair Defenses: Disable Windows Event Logging",
        "relation": "maps_to",
        "confidence": 0.95
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_auditpol_usage",
        "external_name": "Suspicious Auditpol Usage",
        "relation": "detected_by",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "audit.event.enable",
    "stable_id": "OSCO-CAP-0010",
    "name": "Enable Event",
    "description": "Enable Windows audit event logging categories to restore security monitoring visibility.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.event.enable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "event state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.event.enable",
        "type": "safe_execute",
        "description": "Safely verify audit.event.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.event.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.event.enable"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.002",
        "external_name": "Impair Defenses: Disable Windows Event Logging",
        "relation": "mitigates",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "audit.event.export",
    "stable_id": "OSCO-CAP-0011",
    "name": "Export Event",
    "description": "Perform export operation on event in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.event.export"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "event state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.event.export",
        "type": "safe_execute",
        "description": "Safely verify audit.event.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.event.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.event.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.event.query",
    "stable_id": "OSCO-CAP-0012",
    "name": "Query Event",
    "description": "Perform query operation on event in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.event.query"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "event state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.event.query",
        "type": "safe_execute",
        "description": "Safely verify audit.event.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.event.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.event.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.event.verify",
    "stable_id": "OSCO-CAP-0013",
    "name": "Verify Event",
    "description": "Perform verify operation on event in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.event.verify"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "event state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.event.verify",
        "type": "safe_execute",
        "description": "Safely verify audit.event.verify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.event.verify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.event.verify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.policy.disable",
    "stable_id": "OSCO-CAP-0014",
    "name": "Disable Policy",
    "description": "Perform disable operation on policy in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.policy.disable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.policy.disable",
        "type": "safe_execute",
        "description": "Safely verify audit.policy.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.policy.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.policy.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.policy.enable",
    "stable_id": "OSCO-CAP-0015",
    "name": "Enable Policy",
    "description": "Perform enable operation on policy in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.policy.enable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.policy.enable",
        "type": "safe_execute",
        "description": "Safely verify audit.policy.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.policy.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.policy.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.policy.export",
    "stable_id": "OSCO-CAP-0016",
    "name": "Export Policy",
    "description": "Perform export operation on policy in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.policy.export"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.policy.export",
        "type": "safe_execute",
        "description": "Safely verify audit.policy.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.policy.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.policy.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.policy.query",
    "stable_id": "OSCO-CAP-0017",
    "name": "Query Policy",
    "description": "Perform query operation on policy in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.policy.query"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.policy.query",
        "type": "safe_execute",
        "description": "Safely verify audit.policy.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.policy.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.policy.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.policy.verify",
    "stable_id": "OSCO-CAP-0018",
    "name": "Verify Policy",
    "description": "Perform verify operation on policy in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.policy.verify"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.policy.verify",
        "type": "safe_execute",
        "description": "Safely verify audit.policy.verify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.policy.verify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.policy.verify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.retention.disable",
    "stable_id": "OSCO-CAP-0019",
    "name": "Disable Retention",
    "description": "Perform disable operation on retention in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.retention.disable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "retention state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.retention.disable",
        "type": "safe_execute",
        "description": "Safely verify audit.retention.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.retention.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.retention.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.retention.enable",
    "stable_id": "OSCO-CAP-0020",
    "name": "Enable Retention",
    "description": "Perform enable operation on retention in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.retention.enable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "retention state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.retention.enable",
        "type": "safe_execute",
        "description": "Safely verify audit.retention.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.retention.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.retention.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.retention.export",
    "stable_id": "OSCO-CAP-0021",
    "name": "Export Retention",
    "description": "Perform export operation on retention in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.retention.export"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "retention state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.retention.export",
        "type": "safe_execute",
        "description": "Safely verify audit.retention.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.retention.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.retention.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.retention.query",
    "stable_id": "OSCO-CAP-0022",
    "name": "Query Retention",
    "description": "Perform query operation on retention in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.retention.query"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "retention state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.retention.query",
        "type": "safe_execute",
        "description": "Safely verify audit.retention.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.retention.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.retention.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.retention.verify",
    "stable_id": "OSCO-CAP-0023",
    "name": "Verify Retention",
    "description": "Perform verify operation on retention in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.retention.verify"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "retention state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.retention.verify",
        "type": "safe_execute",
        "description": "Safely verify audit.retention.verify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.retention.verify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.retention.verify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.trail.disable",
    "stable_id": "OSCO-CAP-0024",
    "name": "Disable Trail",
    "description": "Perform disable operation on trail in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.trail.disable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "trail state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.trail.disable",
        "type": "safe_execute",
        "description": "Safely verify audit.trail.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.trail.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.trail.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.trail.enable",
    "stable_id": "OSCO-CAP-0025",
    "name": "Enable Trail",
    "description": "Perform enable operation on trail in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.trail.enable"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "trail state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.trail.enable",
        "type": "safe_execute",
        "description": "Safely verify audit.trail.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.trail.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.trail.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.trail.export",
    "stable_id": "OSCO-CAP-0026",
    "name": "Export Trail",
    "description": "Perform export operation on trail in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.trail.export"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "trail state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.trail.export",
        "type": "safe_execute",
        "description": "Safely verify audit.trail.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.trail.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.trail.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.trail.query",
    "stable_id": "OSCO-CAP-0027",
    "name": "Query Trail",
    "description": "Perform query operation on trail in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.trail.query"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "trail state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.trail.query",
        "type": "safe_execute",
        "description": "Safely verify audit.trail.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.trail.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.trail.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "audit.trail.verify",
    "stable_id": "OSCO-CAP-0028",
    "name": "Verify Trail",
    "description": "Perform verify operation on trail in the audit domain.",
    "category": "telemetry",
    "domain": "audit",
    "platforms": [
      "cloud",
      "saas",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.linux",
      "provider.macos",
      "provider.microsoft365",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "audit.trail.verify"
    ],
    "preconditions": [
      "provider exposes audit capability surface"
    ],
    "postconditions": [
      "trail state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.audit.trail.verify",
        "type": "safe_execute",
        "description": "Safely verify audit.trail.verify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.audit.trail.verify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for audit.trail.verify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authentication.challenge.enforce",
    "stable_id": "OSCO-CAP-0029",
    "name": "Enforce Challenge",
    "description": "Perform enforce operation on challenge in the authentication domain.",
    "category": "identity",
    "domain": "authentication",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authentication.challenge.enforce"
    ],
    "preconditions": [
      "provider exposes authentication capability surface"
    ],
    "postconditions": [
      "challenge state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authentication.challenge.enforce",
        "type": "safe_execute",
        "description": "Safely verify authentication.challenge.enforce with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authentication.challenge.enforce",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authentication.challenge.enforce"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authentication.challenge.refresh",
    "stable_id": "OSCO-CAP-0030",
    "name": "Refresh Challenge",
    "description": "Perform refresh operation on challenge in the authentication domain.",
    "category": "identity",
    "domain": "authentication",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authentication.challenge.refresh"
    ],
    "preconditions": [
      "provider exposes authentication capability surface"
    ],
    "postconditions": [
      "challenge state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authentication.challenge.refresh",
        "type": "safe_execute",
        "description": "Safely verify authentication.challenge.refresh with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authentication.challenge.refresh",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authentication.challenge.refresh"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authentication.challenge.request",
    "stable_id": "OSCO-CAP-0031",
    "name": "Request Challenge",
    "description": "Perform request operation on challenge in the authentication domain.",
    "category": "identity",
    "domain": "authentication",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authentication.challenge.request"
    ],
    "preconditions": [
      "provider exposes authentication capability surface"
    ],
    "postconditions": [
      "challenge state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authentication.challenge.request",
        "type": "safe_execute",
        "description": "Safely verify authentication.challenge.request with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authentication.challenge.request",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authentication.challenge.request"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1110",
        "external_name": "Brute Force",
        "relation": "enables",
        "confidence": 0.65
      }
    ]
  },
  {
    "capability_id": "authentication.challenge.revoke",
    "stable_id": "OSCO-CAP-0032",
    "name": "Revoke Challenge",
    "description": "Perform revoke operation on challenge in the authentication domain.",
    "category": "identity",
    "domain": "authentication",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authentication.challenge.revoke"
    ],
    "preconditions": [
      "provider exposes authentication capability surface"
    ],
    "postconditions": [
      "challenge state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authentication.challenge.revoke",
        "type": "safe_execute",
        "description": "Safely verify authentication.challenge.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authentication.challenge.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authentication.challenge.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.binding.attach",
    "stable_id": "OSCO-CAP-0033",
    "name": "Attach Binding",
    "description": "Perform attach operation on binding in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.binding.attach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.binding.attach",
        "type": "safe_execute",
        "description": "Safely verify authorization.binding.attach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.binding.attach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.binding.attach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.binding.detach",
    "stable_id": "OSCO-CAP-0034",
    "name": "Detach Binding",
    "description": "Perform detach operation on binding in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.binding.detach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.binding.detach",
        "type": "safe_execute",
        "description": "Safely verify authorization.binding.detach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.binding.detach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.binding.detach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.binding.evaluate",
    "stable_id": "OSCO-CAP-0035",
    "name": "Evaluate Binding",
    "description": "Perform evaluate operation on binding in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.binding.evaluate"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.binding.evaluate",
        "type": "safe_execute",
        "description": "Safely verify authorization.binding.evaluate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.binding.evaluate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.binding.evaluate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.binding.grant",
    "stable_id": "OSCO-CAP-0036",
    "name": "Grant Binding",
    "description": "Perform grant operation on binding in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.binding.grant"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.binding.grant",
        "type": "safe_execute",
        "description": "Safely verify authorization.binding.grant with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.binding.grant",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.binding.grant"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.binding.revoke",
    "stable_id": "OSCO-CAP-0037",
    "name": "Revoke Binding",
    "description": "Perform revoke operation on binding in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.binding.revoke"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.binding.revoke",
        "type": "safe_execute",
        "description": "Safely verify authorization.binding.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.binding.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.binding.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.permission.attach",
    "stable_id": "OSCO-CAP-0038",
    "name": "Attach Permission",
    "description": "Perform attach operation on permission in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.permission.attach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "permission state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.permission.attach",
        "type": "safe_execute",
        "description": "Safely verify authorization.permission.attach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.permission.attach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.permission.attach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.permission.detach",
    "stable_id": "OSCO-CAP-0039",
    "name": "Detach Permission",
    "description": "Perform detach operation on permission in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.permission.detach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "permission state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.permission.detach",
        "type": "safe_execute",
        "description": "Safely verify authorization.permission.detach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.permission.detach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.permission.detach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.permission.evaluate",
    "stable_id": "OSCO-CAP-0040",
    "name": "Evaluate Permission",
    "description": "Perform evaluate operation on permission in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.permission.evaluate"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "permission state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.permission.evaluate",
        "type": "safe_execute",
        "description": "Safely verify authorization.permission.evaluate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.permission.evaluate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.permission.evaluate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.permission.grant",
    "stable_id": "OSCO-CAP-0041",
    "name": "Grant Permission",
    "description": "Perform grant operation on permission in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.permission.grant"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "permission state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.permission.grant",
        "type": "safe_execute",
        "description": "Safely verify authorization.permission.grant with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.permission.grant",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.permission.grant"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.permission.revoke",
    "stable_id": "OSCO-CAP-0042",
    "name": "Revoke Permission",
    "description": "Perform revoke operation on permission in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.permission.revoke"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "permission state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.permission.revoke",
        "type": "safe_execute",
        "description": "Safely verify authorization.permission.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.permission.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.permission.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.policy.attach",
    "stable_id": "OSCO-CAP-0043",
    "name": "Attach Policy",
    "description": "Perform attach operation on policy in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.policy.attach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.policy.attach",
        "type": "safe_execute",
        "description": "Safely verify authorization.policy.attach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.policy.attach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.policy.attach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.policy.detach",
    "stable_id": "OSCO-CAP-0044",
    "name": "Detach Policy",
    "description": "Perform detach operation on policy in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.policy.detach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.policy.detach",
        "type": "safe_execute",
        "description": "Safely verify authorization.policy.detach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.policy.detach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.policy.detach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.policy.evaluate",
    "stable_id": "OSCO-CAP-0045",
    "name": "Evaluate Policy",
    "description": "Perform evaluate operation on policy in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.policy.evaluate"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.policy.evaluate",
        "type": "safe_execute",
        "description": "Safely verify authorization.policy.evaluate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.policy.evaluate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.policy.evaluate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.policy.grant",
    "stable_id": "OSCO-CAP-0046",
    "name": "Grant Policy",
    "description": "Perform grant operation on policy in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.policy.grant"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.policy.grant",
        "type": "safe_execute",
        "description": "Safely verify authorization.policy.grant with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.policy.grant",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.policy.grant"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.policy.revoke",
    "stable_id": "OSCO-CAP-0047",
    "name": "Revoke Policy",
    "description": "Perform revoke operation on policy in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.policy.revoke"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "policy state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.policy.revoke",
        "type": "safe_execute",
        "description": "Safely verify authorization.policy.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.policy.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.policy.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.role.attach",
    "stable_id": "OSCO-CAP-0048",
    "name": "Attach Role",
    "description": "Perform attach operation on role in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.role.attach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "role state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.role.attach",
        "type": "safe_execute",
        "description": "Safely verify authorization.role.attach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.role.attach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.role.attach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.role.detach",
    "stable_id": "OSCO-CAP-0049",
    "name": "Detach Role",
    "description": "Perform detach operation on role in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.role.detach"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "role state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.role.detach",
        "type": "safe_execute",
        "description": "Safely verify authorization.role.detach with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.role.detach",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.role.detach"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.role.evaluate",
    "stable_id": "OSCO-CAP-0050",
    "name": "Evaluate Role",
    "description": "Perform evaluate operation on role in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.role.evaluate"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "role state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.role.evaluate",
        "type": "safe_execute",
        "description": "Safely verify authorization.role.evaluate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.role.evaluate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.role.evaluate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.role.grant",
    "stable_id": "OSCO-CAP-0051",
    "name": "Grant Role",
    "description": "Perform grant operation on role in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.role.grant"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "role state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.role.grant",
        "type": "safe_execute",
        "description": "Safely verify authorization.role.grant with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.role.grant",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.role.grant"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "authorization.role.revoke",
    "stable_id": "OSCO-CAP-0052",
    "name": "Revoke Role",
    "description": "Perform revoke operation on role in the authorization domain.",
    "category": "identity",
    "domain": "authorization",
    "platforms": [
      "identity",
      "cloud",
      "saas",
      "database"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.okta",
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "authorization.role.revoke"
    ],
    "preconditions": [
      "provider exposes authorization capability surface"
    ],
    "postconditions": [
      "role state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.authorization.role.revoke",
        "type": "safe_execute",
        "description": "Safely verify authorization.role.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.authorization.role.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for authorization.role.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "automation.orchestration.monitor",
    "stable_id": "OSCO-CAP-0053",
    "name": "Monitor Orchestration",
    "description": "Perform monitor operation on orchestration in the automation domain.",
    "category": "automation",
    "domain": "automation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "automation.orchestration.monitor"
    ],
    "preconditions": [
      "provider exposes automation capability surface"
    ],
    "postconditions": [
      "orchestration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.automation.orchestration.monitor",
        "type": "safe_execute",
        "description": "Safely verify automation.orchestration.monitor with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.automation.orchestration.monitor",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for automation.orchestration.monitor"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "automation.orchestration.orchestrate",
    "stable_id": "OSCO-CAP-0054",
    "name": "Orchestrate Orchestration",
    "description": "Perform orchestrate operation on orchestration in the automation domain.",
    "category": "automation",
    "domain": "automation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "automation.orchestration.orchestrate"
    ],
    "preconditions": [
      "provider exposes automation capability surface"
    ],
    "postconditions": [
      "orchestration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.automation.orchestration.orchestrate",
        "type": "safe_execute",
        "description": "Safely verify automation.orchestration.orchestrate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.automation.orchestration.orchestrate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for automation.orchestration.orchestrate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "automation.orchestration.rollback",
    "stable_id": "OSCO-CAP-0055",
    "name": "Rollback Orchestration",
    "description": "Perform rollback operation on orchestration in the automation domain.",
    "category": "automation",
    "domain": "automation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "automation.orchestration.rollback"
    ],
    "preconditions": [
      "provider exposes automation capability surface"
    ],
    "postconditions": [
      "orchestration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.automation.orchestration.rollback",
        "type": "safe_execute",
        "description": "Safely verify automation.orchestration.rollback with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.automation.orchestration.rollback",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for automation.orchestration.rollback"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "automation.orchestration.schedule",
    "stable_id": "OSCO-CAP-0056",
    "name": "Schedule Orchestration",
    "description": "Perform schedule operation on orchestration in the automation domain.",
    "category": "automation",
    "domain": "automation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "automation.orchestration.schedule"
    ],
    "preconditions": [
      "provider exposes automation capability surface"
    ],
    "postconditions": [
      "orchestration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.automation.orchestration.schedule",
        "type": "safe_execute",
        "description": "Safely verify automation.orchestration.schedule with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.automation.orchestration.schedule",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for automation.orchestration.schedule"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "browser.cookie.delete",
    "stable_id": "OSCO-CAP-0057",
    "name": "Delete Cookie",
    "description": "Perform delete operation on cookie in the browser domain.",
    "category": "browser",
    "domain": "browser",
    "platforms": [
      "browser",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.chrome",
      "provider.firefox"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "browser.cookie.delete"
    ],
    "preconditions": [
      "provider exposes browser capability surface"
    ],
    "postconditions": [
      "cookie state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.browser.cookie.delete",
        "type": "safe_execute",
        "description": "Safely verify browser.cookie.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.browser.cookie.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for browser.cookie.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "browser.cookie.export",
    "stable_id": "OSCO-CAP-0058",
    "name": "Export Cookie",
    "description": "Perform export operation on cookie in the browser domain.",
    "category": "browser",
    "domain": "browser",
    "platforms": [
      "browser",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.chrome",
      "provider.firefox"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "browser.cookie.export"
    ],
    "preconditions": [
      "provider exposes browser capability surface"
    ],
    "postconditions": [
      "cookie state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.browser.cookie.export",
        "type": "safe_execute",
        "description": "Safely verify browser.cookie.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.browser.cookie.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for browser.cookie.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "browser.cookie.import",
    "stable_id": "OSCO-CAP-0059",
    "name": "Import Cookie",
    "description": "Perform import operation on cookie in the browser domain.",
    "category": "browser",
    "domain": "browser",
    "platforms": [
      "browser",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.chrome",
      "provider.firefox"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "browser.cookie.import"
    ],
    "preconditions": [
      "provider exposes browser capability surface"
    ],
    "postconditions": [
      "cookie state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.browser.cookie.import",
        "type": "safe_execute",
        "description": "Safely verify browser.cookie.import with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.browser.cookie.import",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for browser.cookie.import"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "browser.cookie.read",
    "stable_id": "OSCO-CAP-0060",
    "name": "Read Browser Cookie Store",
    "description": "Read browser cookie records from storage.",
    "category": "browser",
    "domain": "browser",
    "platforms": [
      "browser",
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.chrome",
      "provider.firefox"
    ],
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1539",
        "external_name": "Steal Web Session Cookie",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "certificate.certificate.create",
    "stable_id": "OSCO-CAP-0061",
    "name": "Create Certificate",
    "description": "Perform create operation on certificate in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.certificate.create"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "certificate state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.certificate.create",
        "type": "safe_execute",
        "description": "Safely verify certificate.certificate.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.certificate.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.certificate.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.certificate.delete",
    "stable_id": "OSCO-CAP-0062",
    "name": "Delete Certificate",
    "description": "Perform delete operation on certificate in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.certificate.delete"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "certificate state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.certificate.delete",
        "type": "safe_execute",
        "description": "Safely verify certificate.certificate.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.certificate.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.certificate.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.certificate.import",
    "stable_id": "OSCO-CAP-0063",
    "name": "Import Certificate",
    "description": "Perform import operation on certificate in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.certificate.import"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "certificate state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.certificate.import",
        "type": "safe_execute",
        "description": "Safely verify certificate.certificate.import with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.certificate.import",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.certificate.import"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.certificate.read",
    "stable_id": "OSCO-CAP-0064",
    "name": "Read Certificate",
    "description": "Perform read operation on certificate in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.certificate.read"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "certificate state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.certificate.read",
        "type": "safe_execute",
        "description": "Safely verify certificate.certificate.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.certificate.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.certificate.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.certificate.revoke",
    "stable_id": "OSCO-CAP-0065",
    "name": "Revoke Certificate",
    "description": "Perform revoke operation on certificate in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.certificate.revoke"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "certificate state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.certificate.revoke",
        "type": "safe_execute",
        "description": "Safely verify certificate.certificate.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.certificate.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.certificate.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.private_key.create",
    "stable_id": "OSCO-CAP-0066",
    "name": "Create Private Key",
    "description": "Perform create operation on private key in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.private_key.create"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "private key state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.private_key.create",
        "type": "safe_execute",
        "description": "Safely verify certificate.private_key.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.private_key.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.private_key.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.private_key.delete",
    "stable_id": "OSCO-CAP-0067",
    "name": "Delete Private Key",
    "description": "Perform delete operation on private key in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.private_key.delete"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "private key state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.private_key.delete",
        "type": "safe_execute",
        "description": "Safely verify certificate.private_key.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.private_key.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.private_key.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.private_key.import",
    "stable_id": "OSCO-CAP-0068",
    "name": "Import Private Key",
    "description": "Perform import operation on private key in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.private_key.import"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "private key state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.private_key.import",
        "type": "safe_execute",
        "description": "Safely verify certificate.private_key.import with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.private_key.import",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.private_key.import"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.private_key.read",
    "stable_id": "OSCO-CAP-0069",
    "name": "Read Private Key",
    "description": "Perform read operation on private key in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.private_key.read"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "private key state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.private_key.read",
        "type": "safe_execute",
        "description": "Safely verify certificate.private_key.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.private_key.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.private_key.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.private_key.revoke",
    "stable_id": "OSCO-CAP-0070",
    "name": "Revoke Private Key",
    "description": "Perform revoke operation on private key in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.private_key.revoke"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "private key state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.private_key.revoke",
        "type": "safe_execute",
        "description": "Safely verify certificate.private_key.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.private_key.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.private_key.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.store.create",
    "stable_id": "OSCO-CAP-0071",
    "name": "Create Store",
    "description": "Perform create operation on store in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.store.create"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "store state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.store.create",
        "type": "safe_execute",
        "description": "Safely verify certificate.store.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.store.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.store.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.store.delete",
    "stable_id": "OSCO-CAP-0072",
    "name": "Delete Store",
    "description": "Perform delete operation on store in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.store.delete"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "store state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.store.delete",
        "type": "safe_execute",
        "description": "Safely verify certificate.store.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.store.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.store.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.store.import",
    "stable_id": "OSCO-CAP-0073",
    "name": "Import Store",
    "description": "Perform import operation on store in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.store.import"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "store state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.store.import",
        "type": "safe_execute",
        "description": "Safely verify certificate.store.import with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.store.import",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.store.import"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.store.read",
    "stable_id": "OSCO-CAP-0074",
    "name": "Read Store",
    "description": "Perform read operation on store in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.store.read"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "store state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.store.read",
        "type": "safe_execute",
        "description": "Safely verify certificate.store.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.store.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.store.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.store.revoke",
    "stable_id": "OSCO-CAP-0075",
    "name": "Revoke Store",
    "description": "Perform revoke operation on store in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.store.revoke"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "store state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.store.revoke",
        "type": "safe_execute",
        "description": "Safely verify certificate.store.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.store.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.store.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.trust_anchor.create",
    "stable_id": "OSCO-CAP-0076",
    "name": "Create Trust Anchor",
    "description": "Perform create operation on trust anchor in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.trust_anchor.create"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "trust anchor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.trust_anchor.create",
        "type": "safe_execute",
        "description": "Safely verify certificate.trust_anchor.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.trust_anchor.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.trust_anchor.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.trust_anchor.delete",
    "stable_id": "OSCO-CAP-0077",
    "name": "Delete Trust Anchor",
    "description": "Perform delete operation on trust anchor in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.trust_anchor.delete"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "trust anchor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.trust_anchor.delete",
        "type": "safe_execute",
        "description": "Safely verify certificate.trust_anchor.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.trust_anchor.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.trust_anchor.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.trust_anchor.import",
    "stable_id": "OSCO-CAP-0078",
    "name": "Import Trust Anchor",
    "description": "Perform import operation on trust anchor in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.trust_anchor.import"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "trust anchor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.trust_anchor.import",
        "type": "safe_execute",
        "description": "Safely verify certificate.trust_anchor.import with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.trust_anchor.import",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.trust_anchor.import"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.trust_anchor.read",
    "stable_id": "OSCO-CAP-0079",
    "name": "Read Trust Anchor",
    "description": "Perform read operation on trust anchor in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.trust_anchor.read"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "trust anchor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.trust_anchor.read",
        "type": "safe_execute",
        "description": "Safely verify certificate.trust_anchor.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.trust_anchor.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.trust_anchor.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "certificate.trust_anchor.revoke",
    "stable_id": "OSCO-CAP-0080",
    "name": "Revoke Trust Anchor",
    "description": "Perform revoke operation on trust anchor in the certificate domain.",
    "category": "identity",
    "domain": "certificate",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "certificate.trust_anchor.revoke"
    ],
    "preconditions": [
      "provider exposes certificate capability surface"
    ],
    "postconditions": [
      "trust anchor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.certificate.trust_anchor.revoke",
        "type": "safe_execute",
        "description": "Safely verify certificate.trust_anchor.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.certificate.trust_anchor.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for certificate.trust_anchor.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "cloud.bucket.create",
    "stable_id": "OSCO-CAP-0081",
    "name": "Create Bucket",
    "description": "Create a cloud storage bucket (S3, GCS, Azure Blob), which may be used to stage data for exfiltration.",
    "category": "cloud",
    "domain": "cloud",
    "platforms": [
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "cloud.bucket.create"
    ],
    "preconditions": [
      "provider exposes cloud capability surface"
    ],
    "postconditions": [
      "bucket state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.cloud.bucket.create",
        "type": "safe_execute",
        "description": "Safely verify cloud.bucket.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.cloud.bucket.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for cloud.bucket.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1537",
        "external_name": "Transfer Data to Cloud Account",
        "relation": "enables",
        "confidence": 0.72
      }
    ]
  },
  {
    "capability_id": "cloud.bucket.delete",
    "stable_id": "OSCO-CAP-0082",
    "name": "Delete Bucket",
    "description": "Perform delete operation on bucket in the cloud domain.",
    "category": "cloud",
    "domain": "cloud",
    "platforms": [
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "cloud.bucket.delete"
    ],
    "preconditions": [
      "provider exposes cloud capability surface"
    ],
    "postconditions": [
      "bucket state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.cloud.bucket.delete",
        "type": "safe_execute",
        "description": "Safely verify cloud.bucket.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.cloud.bucket.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for cloud.bucket.delete"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1485",
        "external_name": "Data Destruction",
        "relation": "maps_to",
        "confidence": 0.7
      }
    ]
  },
  {
    "capability_id": "cloud.bucket.read",
    "stable_id": "OSCO-CAP-0083",
    "name": "Read Bucket",
    "description": "Read objects from a cloud storage bucket (S3, GCS, Azure Blob). Commonly used for data exfiltration or discovery of sensitive stored data.",
    "category": "cloud",
    "domain": "cloud",
    "platforms": [
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "cloud.bucket.read"
    ],
    "preconditions": [
      "provider exposes cloud capability surface"
    ],
    "postconditions": [
      "bucket state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.cloud.bucket.read",
        "type": "safe_execute",
        "description": "Safely verify cloud.bucket.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.cloud.bucket.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for cloud.bucket.read"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1530",
        "external_name": "Data from Cloud Storage",
        "relation": "maps_to",
        "confidence": 0.95
      },
      {
        "framework": "aws_security_hub",
        "external_id": "S3.1",
        "external_name": "S3 Block Public Access Settings",
        "relation": "maps_to",
        "confidence": 0.75
      }
    ]
  },
  {
    "capability_id": "cloud.bucket.tag",
    "stable_id": "OSCO-CAP-0084",
    "name": "Tag Bucket",
    "description": "Perform tag operation on bucket in the cloud domain.",
    "category": "cloud",
    "domain": "cloud",
    "platforms": [
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "cloud.bucket.tag"
    ],
    "preconditions": [
      "provider exposes cloud capability surface"
    ],
    "postconditions": [
      "bucket state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.cloud.bucket.tag",
        "type": "safe_execute",
        "description": "Safely verify cloud.bucket.tag with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.cloud.bucket.tag",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for cloud.bucket.tag"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "cloud.iam.role.create",
    "stable_id": "OSCO-CAP-0085",
    "name": "Create IAM Role",
    "description": "Create a cloud IAM role.",
    "category": "cloud",
    "domain": "identity",
    "platforms": [
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "status": "stable",
    "confidence": 0.93,
    "safety": "caution",
    "required_privileges": [
      "iam.role.create"
    ],
    "produced_telemetry": [
      {
        "telemetry_id": "tm.cloudtrail.createrole",
        "source": "cloudtrail",
        "event_type": "CreateRole",
        "description": "AWS CloudTrail CreateRole event"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1098",
        "external_name": "Account Manipulation",
        "confidence": 0.82
      },
      {
        "framework": "ecs",
        "external_id": "iam",
        "external_name": "Identity and Access",
        "confidence": 0.77
      }
    ]
  },
  {
    "capability_id": "collaboration.channel.audit",
    "stable_id": "OSCO-CAP-0086",
    "name": "Audit Channel",
    "description": "Perform audit operation on channel in the collaboration domain.",
    "category": "saas",
    "domain": "collaboration",
    "platforms": [
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "collaboration.channel.audit"
    ],
    "preconditions": [
      "provider exposes collaboration capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collaboration.channel.audit",
        "type": "safe_execute",
        "description": "Safely verify collaboration.channel.audit with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collaboration.channel.audit",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collaboration.channel.audit"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collaboration.channel.create",
    "stable_id": "OSCO-CAP-0087",
    "name": "Create Channel",
    "description": "Perform create operation on channel in the collaboration domain.",
    "category": "saas",
    "domain": "collaboration",
    "platforms": [
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "collaboration.channel.create"
    ],
    "preconditions": [
      "provider exposes collaboration capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collaboration.channel.create",
        "type": "safe_execute",
        "description": "Safely verify collaboration.channel.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collaboration.channel.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collaboration.channel.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collaboration.channel.delete",
    "stable_id": "OSCO-CAP-0088",
    "name": "Delete Channel",
    "description": "Perform delete operation on channel in the collaboration domain.",
    "category": "saas",
    "domain": "collaboration",
    "platforms": [
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "collaboration.channel.delete"
    ],
    "preconditions": [
      "provider exposes collaboration capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collaboration.channel.delete",
        "type": "safe_execute",
        "description": "Safely verify collaboration.channel.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collaboration.channel.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collaboration.channel.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collaboration.channel.read",
    "stable_id": "OSCO-CAP-0089",
    "name": "Read Channel",
    "description": "Perform read operation on channel in the collaboration domain.",
    "category": "saas",
    "domain": "collaboration",
    "platforms": [
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "collaboration.channel.read"
    ],
    "preconditions": [
      "provider exposes collaboration capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collaboration.channel.read",
        "type": "safe_execute",
        "description": "Safely verify collaboration.channel.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collaboration.channel.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collaboration.channel.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.artifact.collect",
    "stable_id": "OSCO-CAP-0090",
    "name": "Collect Artifact",
    "description": "Perform collect operation on artifact in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.artifact.collect"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "artifact state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.artifact.collect",
        "type": "safe_execute",
        "description": "Safely verify collection.artifact.collect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.artifact.collect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.artifact.collect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.artifact.enrich",
    "stable_id": "OSCO-CAP-0091",
    "name": "Enrich Artifact",
    "description": "Perform enrich operation on artifact in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.artifact.enrich"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "artifact state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.artifact.enrich",
        "type": "safe_execute",
        "description": "Safely verify collection.artifact.enrich with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.artifact.enrich",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.artifact.enrich"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.artifact.export",
    "stable_id": "OSCO-CAP-0092",
    "name": "Export Artifact",
    "description": "Perform export operation on artifact in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.artifact.export"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "artifact state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.artifact.export",
        "type": "safe_execute",
        "description": "Safely verify collection.artifact.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.artifact.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.artifact.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.artifact.normalize",
    "stable_id": "OSCO-CAP-0093",
    "name": "Normalize Artifact",
    "description": "Perform normalize operation on artifact in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.artifact.normalize"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "artifact state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.artifact.normalize",
        "type": "safe_execute",
        "description": "Safely verify collection.artifact.normalize with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.artifact.normalize",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.artifact.normalize"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.artifact.store",
    "stable_id": "OSCO-CAP-0094",
    "name": "Store Artifact",
    "description": "Perform store operation on artifact in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.artifact.store"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "artifact state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.artifact.store",
        "type": "safe_execute",
        "description": "Safely verify collection.artifact.store with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.artifact.store",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.artifact.store"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.evidence.collect",
    "stable_id": "OSCO-CAP-0095",
    "name": "Collect Evidence",
    "description": "Perform collect operation on evidence in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.evidence.collect"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "evidence state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.evidence.collect",
        "type": "safe_execute",
        "description": "Safely verify collection.evidence.collect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.evidence.collect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.evidence.collect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.evidence.enrich",
    "stable_id": "OSCO-CAP-0096",
    "name": "Enrich Evidence",
    "description": "Perform enrich operation on evidence in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.evidence.enrich"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "evidence state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.evidence.enrich",
        "type": "safe_execute",
        "description": "Safely verify collection.evidence.enrich with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.evidence.enrich",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.evidence.enrich"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.evidence.export",
    "stable_id": "OSCO-CAP-0097",
    "name": "Export Evidence",
    "description": "Perform export operation on evidence in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.evidence.export"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "evidence state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.evidence.export",
        "type": "safe_execute",
        "description": "Safely verify collection.evidence.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.evidence.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.evidence.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.evidence.normalize",
    "stable_id": "OSCO-CAP-0098",
    "name": "Normalize Evidence",
    "description": "Perform normalize operation on evidence in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.evidence.normalize"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "evidence state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.evidence.normalize",
        "type": "safe_execute",
        "description": "Safely verify collection.evidence.normalize with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.evidence.normalize",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.evidence.normalize"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.evidence.store",
    "stable_id": "OSCO-CAP-0099",
    "name": "Store Evidence",
    "description": "Perform store operation on evidence in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.evidence.store"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "evidence state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.evidence.store",
        "type": "safe_execute",
        "description": "Safely verify collection.evidence.store with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.evidence.store",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.evidence.store"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.persistence.evidence.collect",
    "stable_id": "OSCO-CAP-0100",
    "name": "Collect Persistence Evidence",
    "description": "Collect persistence evidence artifacts across providers.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform"
    ],
    "providers": [
      "provider.windows",
      "provider.linux",
      "provider.macos",
      "provider.aws",
      "provider.kubernetes"
    ],
    "status": "stable",
    "confidence": 0.89,
    "safety": "safe",
    "child_capabilities": [
      "registry.key.set",
      "windows.task.create"
    ],
    "mappings": [
      {
        "framework": "velociraptor",
        "external_id": "Windows.Registry.RunKeys",
        "external_name": "Registry Run Keys Artifact",
        "relation": "maps_to",
        "confidence": 0.9
      },
      {
        "framework": "osquery",
        "external_id": "startup_items",
        "external_name": "Startup Items Table",
        "relation": "maps_to",
        "confidence": 0.83
      }
    ]
  },
  {
    "capability_id": "collection.snapshot.collect",
    "stable_id": "OSCO-CAP-0101",
    "name": "Collect Snapshot",
    "description": "Perform collect operation on snapshot in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.snapshot.collect"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "snapshot state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.snapshot.collect",
        "type": "safe_execute",
        "description": "Safely verify collection.snapshot.collect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.snapshot.collect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.snapshot.collect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.snapshot.enrich",
    "stable_id": "OSCO-CAP-0102",
    "name": "Enrich Snapshot",
    "description": "Perform enrich operation on snapshot in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.snapshot.enrich"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "snapshot state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.snapshot.enrich",
        "type": "safe_execute",
        "description": "Safely verify collection.snapshot.enrich with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.snapshot.enrich",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.snapshot.enrich"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.snapshot.export",
    "stable_id": "OSCO-CAP-0103",
    "name": "Export Snapshot",
    "description": "Perform export operation on snapshot in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.snapshot.export"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "snapshot state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.snapshot.export",
        "type": "safe_execute",
        "description": "Safely verify collection.snapshot.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.snapshot.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.snapshot.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.snapshot.normalize",
    "stable_id": "OSCO-CAP-0104",
    "name": "Normalize Snapshot",
    "description": "Perform normalize operation on snapshot in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.snapshot.normalize"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "snapshot state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.snapshot.normalize",
        "type": "safe_execute",
        "description": "Safely verify collection.snapshot.normalize with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.snapshot.normalize",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.snapshot.normalize"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.snapshot.store",
    "stable_id": "OSCO-CAP-0105",
    "name": "Store Snapshot",
    "description": "Perform store operation on snapshot in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.snapshot.store"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "snapshot state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.snapshot.store",
        "type": "safe_execute",
        "description": "Safely verify collection.snapshot.store with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.snapshot.store",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.snapshot.store"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.timeline.collect",
    "stable_id": "OSCO-CAP-0106",
    "name": "Collect Timeline",
    "description": "Perform collect operation on timeline in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.timeline.collect"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "timeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.timeline.collect",
        "type": "safe_execute",
        "description": "Safely verify collection.timeline.collect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.timeline.collect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.timeline.collect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.timeline.enrich",
    "stable_id": "OSCO-CAP-0107",
    "name": "Enrich Timeline",
    "description": "Perform enrich operation on timeline in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.timeline.enrich"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "timeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.timeline.enrich",
        "type": "safe_execute",
        "description": "Safely verify collection.timeline.enrich with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.timeline.enrich",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.timeline.enrich"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.timeline.export",
    "stable_id": "OSCO-CAP-0108",
    "name": "Export Timeline",
    "description": "Perform export operation on timeline in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.timeline.export"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "timeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.timeline.export",
        "type": "safe_execute",
        "description": "Safely verify collection.timeline.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.timeline.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.timeline.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.timeline.normalize",
    "stable_id": "OSCO-CAP-0109",
    "name": "Normalize Timeline",
    "description": "Perform normalize operation on timeline in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.timeline.normalize"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "timeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.timeline.normalize",
        "type": "safe_execute",
        "description": "Safely verify collection.timeline.normalize with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.timeline.normalize",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.timeline.normalize"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "collection.timeline.store",
    "stable_id": "OSCO-CAP-0110",
    "name": "Store Timeline",
    "description": "Perform store operation on timeline in the collection domain.",
    "category": "collection",
    "domain": "collection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "collection.timeline.store"
    ],
    "preconditions": [
      "provider exposes collection capability surface"
    ],
    "postconditions": [
      "timeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.collection.timeline.store",
        "type": "safe_execute",
        "description": "Safely verify collection.timeline.store with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.collection.timeline.store",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for collection.timeline.store"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "com.activation.activate",
    "stable_id": "OSCO-CAP-0111",
    "name": "Activate Activation",
    "description": "Perform activate operation on activation in the com domain.",
    "category": "endpoint",
    "domain": "com",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "com.activation.activate"
    ],
    "preconditions": [
      "provider exposes com capability surface"
    ],
    "postconditions": [
      "activation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.com.activation.activate",
        "type": "safe_execute",
        "description": "Safely verify com.activation.activate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.com.activation.activate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for com.activation.activate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "com.activation.modify",
    "stable_id": "OSCO-CAP-0112",
    "name": "Modify Activation",
    "description": "Modify COM server activation entries in the registry to hijack COM object instantiation for persistent execution.",
    "category": "endpoint",
    "domain": "com",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "com.activation.modify"
    ],
    "preconditions": [
      "provider exposes com capability surface"
    ],
    "postconditions": [
      "activation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.com.activation.modify",
        "type": "safe_execute",
        "description": "Safely verify com.activation.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.com.activation.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for com.activation.modify"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1546.015",
        "external_name": "Event Triggered Execution: Component Object Model Hijacking",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "com.activation.query",
    "stable_id": "OSCO-CAP-0113",
    "name": "Query Activation",
    "description": "Perform query operation on activation in the com domain.",
    "category": "endpoint",
    "domain": "com",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "com.activation.query"
    ],
    "preconditions": [
      "provider exposes com capability surface"
    ],
    "postconditions": [
      "activation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.com.activation.query",
        "type": "safe_execute",
        "description": "Safely verify com.activation.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.com.activation.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for com.activation.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "com.activation.register",
    "stable_id": "OSCO-CAP-0114",
    "name": "Register Activation",
    "description": "Register a COM server activation entry, which can be abused to hijack COM object invocation for persistence or privilege escalation.",
    "category": "endpoint",
    "domain": "com",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "com.activation.register"
    ],
    "preconditions": [
      "provider exposes com capability surface"
    ],
    "postconditions": [
      "activation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.com.activation.register",
        "type": "safe_execute",
        "description": "Safely verify com.activation.register with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.com.activation.register",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for com.activation.register"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1546.015",
        "external_name": "Event Triggered Execution: Component Object Model Hijacking",
        "relation": "maps_to",
        "confidence": 0.8
      }
    ]
  },
  {
    "capability_id": "container.container.build",
    "stable_id": "OSCO-CAP-0115",
    "name": "Build Container",
    "description": "Perform build operation on container in the container domain.",
    "category": "container",
    "domain": "container",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.docker",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "container.container.build"
    ],
    "preconditions": [
      "provider exposes container capability surface"
    ],
    "postconditions": [
      "container state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.container.container.build",
        "type": "safe_execute",
        "description": "Safely verify container.container.build with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.container.container.build",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for container.container.build"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "container.container.delete",
    "stable_id": "OSCO-CAP-0116",
    "name": "Delete Container",
    "description": "Perform delete operation on container in the container domain.",
    "category": "container",
    "domain": "container",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.docker",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "container.container.delete"
    ],
    "preconditions": [
      "provider exposes container capability surface"
    ],
    "postconditions": [
      "container state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.container.container.delete",
        "type": "safe_execute",
        "description": "Safely verify container.container.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.container.container.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for container.container.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "container.container.inspect",
    "stable_id": "OSCO-CAP-0117",
    "name": "Inspect Container",
    "description": "Perform inspect operation on container in the container domain.",
    "category": "container",
    "domain": "container",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.docker",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "container.container.inspect"
    ],
    "preconditions": [
      "provider exposes container capability surface"
    ],
    "postconditions": [
      "container state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.container.container.inspect",
        "type": "safe_execute",
        "description": "Safely verify container.container.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.container.container.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for container.container.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "container.container.run",
    "stable_id": "OSCO-CAP-0118",
    "name": "Run Container",
    "description": "Perform run operation on container in the container domain.",
    "category": "container",
    "domain": "container",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.docker",
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "container.container.run"
    ],
    "preconditions": [
      "provider exposes container capability surface"
    ],
    "postconditions": [
      "container state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.container.container.run",
        "type": "safe_execute",
        "description": "Safely verify container.container.run with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.container.container.run",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for container.container.run"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.credential.access",
    "stable_id": "OSCO-CAP-0119",
    "name": "Access Credential",
    "description": "Access stored credentials from the operating system, password managers, browser stores, or application credential stores.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.credential.access"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "credential state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.credential.access",
        "type": "safe_execute",
        "description": "Safely verify credential.credential.access with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.credential.access",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.credential.access"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003",
        "external_name": "OS Credential Dumping",
        "relation": "maps_to",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "credential.credential.delete",
    "stable_id": "OSCO-CAP-0120",
    "name": "Delete Credential",
    "description": "Perform delete operation on credential in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.credential.delete"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "credential state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.credential.delete",
        "type": "safe_execute",
        "description": "Safely verify credential.credential.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.credential.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.credential.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.credential.dump",
    "stable_id": "OSCO-CAP-0121",
    "name": "Dump Credential",
    "description": "Extract credentials from the operating system credential store, LSASS memory, or SAM database.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.credential.dump"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "credential state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.credential.dump",
        "type": "safe_execute",
        "description": "Safely verify credential.credential.dump with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.credential.dump",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.credential.dump"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003",
        "external_name": "OS Credential Dumping",
        "relation": "maps_to",
        "confidence": 0.95
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1003",
        "external_name": "OS Credential Dumping",
        "relation": "validated_by",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "credential.credential.rotate",
    "stable_id": "OSCO-CAP-0122",
    "name": "Rotate Credential",
    "description": "Perform rotate operation on credential in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.credential.rotate"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "credential state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.credential.rotate",
        "type": "safe_execute",
        "description": "Safely verify credential.credential.rotate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.credential.rotate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.credential.rotate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.credential.store",
    "stable_id": "OSCO-CAP-0123",
    "name": "Store Credential",
    "description": "Perform store operation on credential in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.credential.store"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "credential state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.credential.store",
        "type": "safe_execute",
        "description": "Safely verify credential.credential.store with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.credential.store",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.credential.store"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.hash.access",
    "stable_id": "OSCO-CAP-0124",
    "name": "Access Hash",
    "description": "Access NTLM password hashes from SAM, NTDS.dit, or memory, enabling offline cracking or pass-the-hash authentication.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.hash.access"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "hash state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.hash.access",
        "type": "safe_execute",
        "description": "Safely verify credential.hash.access with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.hash.access",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.hash.access"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003.002",
        "external_name": "OS Credential Dumping: Security Account Manager",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "credential.hash.delete",
    "stable_id": "OSCO-CAP-0125",
    "name": "Delete Hash",
    "description": "Perform delete operation on hash in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.hash.delete"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "hash state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.hash.delete",
        "type": "safe_execute",
        "description": "Safely verify credential.hash.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.hash.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.hash.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.hash.dump",
    "stable_id": "OSCO-CAP-0126",
    "name": "Dump Hash",
    "description": "Extract NTLM password hashes from the Security Account Manager (SAM) database or from domain controller NTDS.dit.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.hash.dump"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "hash state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.hash.dump",
        "type": "safe_execute",
        "description": "Safely verify credential.hash.dump with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.hash.dump",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.hash.dump"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003.002",
        "external_name": "OS Credential Dumping: Security Account Manager",
        "relation": "maps_to",
        "confidence": 0.9
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1003.002",
        "external_name": "Security Account Manager Dump",
        "relation": "validated_by",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "credential.hash.rotate",
    "stable_id": "OSCO-CAP-0127",
    "name": "Rotate Hash",
    "description": "Perform rotate operation on hash in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.hash.rotate"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "hash state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.hash.rotate",
        "type": "safe_execute",
        "description": "Safely verify credential.hash.rotate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.hash.rotate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.hash.rotate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.hash.store",
    "stable_id": "OSCO-CAP-0128",
    "name": "Store Hash",
    "description": "Perform store operation on hash in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.hash.store"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "hash state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.hash.store",
        "type": "safe_execute",
        "description": "Safely verify credential.hash.store with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.hash.store",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.hash.store"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.token.access",
    "stable_id": "OSCO-CAP-0129",
    "name": "Access Token",
    "description": "Perform access operation on token in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.token.access"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.token.access",
        "type": "safe_execute",
        "description": "Safely verify credential.token.access with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.token.access",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.token.access"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1528",
        "external_name": "Steal Application Access Token",
        "relation": "maps_to",
        "confidence": 0.78
      }
    ]
  },
  {
    "capability_id": "credential.token.delete",
    "stable_id": "OSCO-CAP-0130",
    "name": "Delete Token",
    "description": "Perform delete operation on token in the credential domain.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.token.delete"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.token.delete",
        "type": "safe_execute",
        "description": "Safely verify credential.token.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.token.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.token.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "credential.token.dump",
    "stable_id": "OSCO-CAP-0131",
    "name": "Dump Token",
    "description": "Extract OAuth tokens, STS tokens, or session tokens from browser storage, memory, or credential managers.",
    "category": "identity",
    "domain": "credential",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.okta",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "credential.token.dump"
    ],
    "preconditions": [
      "provider exposes credential capability surface"
    ],
    "postconditions": [
      "token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.credential.token.dump",
        "type": "safe_execute",
        "description": "Safely verify credential.token.dump with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.credential.token.dump",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for credential.token.dump"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1134.001",
        "external_name": "Access Token Manipulation: Token Impersonation/Theft",
        "relation": "maps_to",
        "confidence": 0.82
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1528",
        "external_name": "Steal Application Access Token",
        "relation": "maps_to",
        "confidence": 0.75
      }
    ]
  },
  {
    "capability_id": "database.audit.create",
    "stable_id": "OSCO-CAP-0132",
    "name": "Create Audit",
    "description": "Perform create operation on audit in the database domain.",
    "category": "database",
    "domain": "database",
    "platforms": [
      "database",
      "cloud"
    ],
    "providers": [
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "database.audit.create"
    ],
    "preconditions": [
      "provider exposes database capability surface"
    ],
    "postconditions": [
      "audit state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.database.audit.create",
        "type": "safe_execute",
        "description": "Safely verify database.audit.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.database.audit.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for database.audit.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "database.audit.delete",
    "stable_id": "OSCO-CAP-0133",
    "name": "Delete Audit",
    "description": "Perform delete operation on audit in the database domain.",
    "category": "database",
    "domain": "database",
    "platforms": [
      "database",
      "cloud"
    ],
    "providers": [
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "database.audit.delete"
    ],
    "preconditions": [
      "provider exposes database capability surface"
    ],
    "postconditions": [
      "audit state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.database.audit.delete",
        "type": "safe_execute",
        "description": "Safely verify database.audit.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.database.audit.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for database.audit.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "database.audit.grant",
    "stable_id": "OSCO-CAP-0134",
    "name": "Grant Audit",
    "description": "Perform grant operation on audit in the database domain.",
    "category": "database",
    "domain": "database",
    "platforms": [
      "database",
      "cloud"
    ],
    "providers": [
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "database.audit.grant"
    ],
    "preconditions": [
      "provider exposes database capability surface"
    ],
    "postconditions": [
      "audit state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.database.audit.grant",
        "type": "safe_execute",
        "description": "Safely verify database.audit.grant with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.database.audit.grant",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for database.audit.grant"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "database.audit.read",
    "stable_id": "OSCO-CAP-0135",
    "name": "Read Audit",
    "description": "Perform read operation on audit in the database domain.",
    "category": "database",
    "domain": "database",
    "platforms": [
      "database",
      "cloud"
    ],
    "providers": [
      "provider.postgresql",
      "provider.sql_server"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "database.audit.read"
    ],
    "preconditions": [
      "provider exposes database capability surface"
    ],
    "postconditions": [
      "audit state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.database.audit.read",
        "type": "safe_execute",
        "description": "Safely verify database.audit.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.database.audit.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for database.audit.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "database.role.grant",
    "stable_id": "OSCO-CAP-0136",
    "name": "Grant Database Role",
    "description": "Grant an authorization role to a principal.",
    "category": "database",
    "domain": "authorization",
    "platforms": [
      "database"
    ],
    "providers": [
      "provider.sql_server",
      "provider.postgresql"
    ],
    "status": "stable",
    "confidence": 0.87,
    "safety": "caution",
    "mappings": [
      {
        "framework": "cwe",
        "external_id": "CWE-732",
        "external_name": "Incorrect Permission Assignment",
        "relation": "related_to",
        "confidence": 0.5
      }
    ]
  },
  {
    "capability_id": "detection.analytic.create",
    "stable_id": "OSCO-CAP-0137",
    "name": "Create Analytic",
    "description": "Perform create operation on analytic in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.analytic.create"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "analytic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.analytic.create",
        "type": "safe_execute",
        "description": "Safely verify detection.analytic.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.analytic.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.analytic.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.analytic.deploy",
    "stable_id": "OSCO-CAP-0138",
    "name": "Deploy Analytic",
    "description": "Perform deploy operation on analytic in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.analytic.deploy"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "analytic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.analytic.deploy",
        "type": "safe_execute",
        "description": "Safely verify detection.analytic.deploy with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.analytic.deploy",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.analytic.deploy"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.analytic.retire",
    "stable_id": "OSCO-CAP-0139",
    "name": "Retire Analytic",
    "description": "Perform retire operation on analytic in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.analytic.retire"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "analytic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.analytic.retire",
        "type": "safe_execute",
        "description": "Safely verify detection.analytic.retire with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.analytic.retire",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.analytic.retire"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.analytic.test",
    "stable_id": "OSCO-CAP-0140",
    "name": "Test Analytic",
    "description": "Perform test operation on analytic in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.analytic.test"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "analytic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.analytic.test",
        "type": "safe_execute",
        "description": "Safely verify detection.analytic.test with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.analytic.test",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.analytic.test"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.analytic.tune",
    "stable_id": "OSCO-CAP-0141",
    "name": "Tune Analytic",
    "description": "Perform tune operation on analytic in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.analytic.tune"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "analytic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.analytic.tune",
        "type": "safe_execute",
        "description": "Safely verify detection.analytic.tune with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.analytic.tune",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.analytic.tune"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.baseline.create",
    "stable_id": "OSCO-CAP-0142",
    "name": "Create Baseline",
    "description": "Perform create operation on baseline in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.baseline.create"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "baseline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.baseline.create",
        "type": "safe_execute",
        "description": "Safely verify detection.baseline.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.baseline.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.baseline.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.baseline.deploy",
    "stable_id": "OSCO-CAP-0143",
    "name": "Deploy Baseline",
    "description": "Perform deploy operation on baseline in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.baseline.deploy"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "baseline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.baseline.deploy",
        "type": "safe_execute",
        "description": "Safely verify detection.baseline.deploy with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.baseline.deploy",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.baseline.deploy"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.baseline.retire",
    "stable_id": "OSCO-CAP-0144",
    "name": "Retire Baseline",
    "description": "Perform retire operation on baseline in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.baseline.retire"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "baseline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.baseline.retire",
        "type": "safe_execute",
        "description": "Safely verify detection.baseline.retire with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.baseline.retire",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.baseline.retire"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.baseline.test",
    "stable_id": "OSCO-CAP-0145",
    "name": "Test Baseline",
    "description": "Perform test operation on baseline in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.baseline.test"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "baseline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.baseline.test",
        "type": "safe_execute",
        "description": "Safely verify detection.baseline.test with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.baseline.test",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.baseline.test"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.baseline.tune",
    "stable_id": "OSCO-CAP-0146",
    "name": "Tune Baseline",
    "description": "Perform tune operation on baseline in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.baseline.tune"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "baseline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.baseline.tune",
        "type": "safe_execute",
        "description": "Safely verify detection.baseline.tune with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.baseline.tune",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.baseline.tune"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.query.create",
    "stable_id": "OSCO-CAP-0147",
    "name": "Create Query",
    "description": "Perform create operation on query in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.query.create"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.query.create",
        "type": "safe_execute",
        "description": "Safely verify detection.query.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.query.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.query.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.query.deploy",
    "stable_id": "OSCO-CAP-0148",
    "name": "Deploy Query",
    "description": "Perform deploy operation on query in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.query.deploy"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.query.deploy",
        "type": "safe_execute",
        "description": "Safely verify detection.query.deploy with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.query.deploy",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.query.deploy"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.query.retire",
    "stable_id": "OSCO-CAP-0149",
    "name": "Retire Query",
    "description": "Perform retire operation on query in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.query.retire"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.query.retire",
        "type": "safe_execute",
        "description": "Safely verify detection.query.retire with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.query.retire",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.query.retire"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.query.test",
    "stable_id": "OSCO-CAP-0150",
    "name": "Test Query",
    "description": "Perform test operation on query in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.query.test"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.query.test",
        "type": "safe_execute",
        "description": "Safely verify detection.query.test with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.query.test",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.query.test"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.query.tune",
    "stable_id": "OSCO-CAP-0151",
    "name": "Tune Query",
    "description": "Perform tune operation on query in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.query.tune"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.query.tune",
        "type": "safe_execute",
        "description": "Safely verify detection.query.tune with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.query.tune",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.query.tune"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.registry.persistence.detect",
    "stable_id": "OSCO-CAP-0152",
    "name": "Detect Registry Persistence",
    "description": "Detect suspicious registry persistence modifications.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "windows",
      "cross_platform"
    ],
    "providers": [
      "provider.windows"
    ],
    "status": "stable",
    "confidence": 0.91,
    "safety": "safe",
    "consumed_telemetry": [
      "tm.sysmon.13"
    ],
    "mappings": [
      {
        "framework": "sigma",
        "external_id": "win_registry_persistence",
        "external_name": "Windows Registry Persistence",
        "relation": "maps_to",
        "confidence": 0.92
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1547.001",
        "external_name": "Registry Run Keys / Startup Folder",
        "relation": "detects",
        "confidence": 0.93
      }
    ]
  },
  {
    "capability_id": "detection.rule.create",
    "stable_id": "OSCO-CAP-0153",
    "name": "Create Rule",
    "description": "Perform create operation on rule in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.rule.create"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "rule state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.rule.create",
        "type": "safe_execute",
        "description": "Safely verify detection.rule.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.rule.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.rule.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.rule.deploy",
    "stable_id": "OSCO-CAP-0154",
    "name": "Deploy Rule",
    "description": "Perform deploy operation on rule in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.rule.deploy"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "rule state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.rule.deploy",
        "type": "safe_execute",
        "description": "Safely verify detection.rule.deploy with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.rule.deploy",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.rule.deploy"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.rule.retire",
    "stable_id": "OSCO-CAP-0155",
    "name": "Retire Rule",
    "description": "Perform retire operation on rule in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.rule.retire"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "rule state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.rule.retire",
        "type": "safe_execute",
        "description": "Safely verify detection.rule.retire with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.rule.retire",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.rule.retire"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.rule.test",
    "stable_id": "OSCO-CAP-0156",
    "name": "Test Rule",
    "description": "Perform test operation on rule in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.rule.test"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "rule state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.rule.test",
        "type": "safe_execute",
        "description": "Safely verify detection.rule.test with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.rule.test",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.rule.test"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "detection.rule.tune",
    "stable_id": "OSCO-CAP-0157",
    "name": "Tune Rule",
    "description": "Perform tune operation on rule in the detection domain.",
    "category": "detection",
    "domain": "detection",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "detection.rule.tune"
    ],
    "preconditions": [
      "provider exposes detection capability surface"
    ],
    "postconditions": [
      "rule state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.detection.rule.tune",
        "type": "safe_execute",
        "description": "Safely verify detection.rule.tune with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.detection.rule.tune",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for detection.rule.tune"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "dns.query.create",
    "stable_id": "OSCO-CAP-0158",
    "name": "Create Query",
    "description": "Resolve DNS names through configured resolvers. May be observed during C2 beaconing, DNS tunneling, or domain generation algorithm (DGA) activity.",
    "category": "network",
    "domain": "dns",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "dns.query.create"
    ],
    "preconditions": [
      "provider exposes dns capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.dns.query.create",
        "type": "safe_execute",
        "description": "Safely verify dns.query.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.dns.query.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for dns.query.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1071.004",
        "external_name": "Application Layer Protocol: DNS",
        "relation": "maps_to",
        "confidence": 0.8
      },
      {
        "framework": "ocsf",
        "external_id": "dns_activity",
        "external_name": "DNS Activity Event",
        "relation": "maps_to",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "dns.query.delete",
    "stable_id": "OSCO-CAP-0159",
    "name": "Delete Query",
    "description": "Perform delete operation on query in the dns domain.",
    "category": "network",
    "domain": "dns",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "dns.query.delete"
    ],
    "preconditions": [
      "provider exposes dns capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.dns.query.delete",
        "type": "safe_execute",
        "description": "Safely verify dns.query.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.dns.query.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for dns.query.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "dns.query.monitor",
    "stable_id": "OSCO-CAP-0160",
    "name": "Monitor Query",
    "description": "Perform monitor operation on query in the dns domain.",
    "category": "network",
    "domain": "dns",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "dns.query.monitor"
    ],
    "preconditions": [
      "provider exposes dns capability surface"
    ],
    "postconditions": [
      "query state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.dns.query.monitor",
        "type": "safe_execute",
        "description": "Safely verify dns.query.monitor with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.dns.query.monitor",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for dns.query.monitor"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "driver.driver.install",
    "stable_id": "OSCO-CAP-0161",
    "name": "Install Driver",
    "description": "Install a kernel-mode driver for autostart on boot, achieving persistent kernel-level access or control.",
    "category": "endpoint",
    "domain": "driver",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "driver.driver.install"
    ],
    "preconditions": [
      "provider exposes driver capability surface"
    ],
    "postconditions": [
      "driver state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.driver.driver.install",
        "type": "safe_execute",
        "description": "Safely verify driver.driver.install with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.driver.driver.install",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for driver.driver.install"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1547.006",
        "external_name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_driver_load",
        "external_name": "Suspicious Driver Loaded by User",
        "relation": "detected_by",
        "confidence": 0.82
      }
    ]
  },
  {
    "capability_id": "driver.driver.load",
    "stable_id": "OSCO-CAP-0162",
    "name": "Load Driver",
    "description": "Load a kernel-mode driver into the running OS. May be used for rootkit functionality, detection evasion, or direct kernel object manipulation (DKOM).",
    "category": "endpoint",
    "domain": "driver",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "driver.driver.load"
    ],
    "preconditions": [
      "provider exposes driver capability surface"
    ],
    "postconditions": [
      "driver state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.driver.driver.load",
        "type": "safe_execute",
        "description": "Safely verify driver.driver.load with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.driver.driver.load",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for driver.driver.load"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1014",
        "external_name": "Rootkit",
        "relation": "maps_to",
        "confidence": 0.72
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1547.006",
        "external_name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions",
        "relation": "maps_to",
        "confidence": 0.8
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_driver_load",
        "external_name": "Suspicious Driver Loaded by User",
        "relation": "detected_by",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "driver.driver.query",
    "stable_id": "OSCO-CAP-0163",
    "name": "Query Driver",
    "description": "Perform query operation on driver in the driver domain.",
    "category": "endpoint",
    "domain": "driver",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "driver.driver.query"
    ],
    "preconditions": [
      "provider exposes driver capability surface"
    ],
    "postconditions": [
      "driver state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.driver.driver.query",
        "type": "safe_execute",
        "description": "Safely verify driver.driver.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.driver.driver.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for driver.driver.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "driver.driver.unload",
    "stable_id": "OSCO-CAP-0164",
    "name": "Unload Driver",
    "description": "Perform unload operation on driver in the driver domain.",
    "category": "endpoint",
    "domain": "driver",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "driver.driver.unload"
    ],
    "preconditions": [
      "provider exposes driver capability surface"
    ],
    "postconditions": [
      "driver state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.driver.driver.unload",
        "type": "safe_execute",
        "description": "Safely verify driver.driver.unload with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.driver.driver.unload",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for driver.driver.unload"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "email.forwarding.audit",
    "stable_id": "OSCO-CAP-0165",
    "name": "Audit Forwarding",
    "description": "Perform audit operation on forwarding in the email domain.",
    "category": "saas",
    "domain": "email",
    "platforms": [
      "saas",
      "cloud"
    ],
    "providers": [
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "email.forwarding.audit"
    ],
    "preconditions": [
      "provider exposes email capability surface"
    ],
    "postconditions": [
      "forwarding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.email.forwarding.audit",
        "type": "safe_execute",
        "description": "Safely verify email.forwarding.audit with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.email.forwarding.audit",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for email.forwarding.audit"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "email.forwarding.create",
    "stable_id": "OSCO-CAP-0166",
    "name": "Create Forwarding",
    "description": "Perform create operation on forwarding in the email domain.",
    "category": "saas",
    "domain": "email",
    "platforms": [
      "saas",
      "cloud"
    ],
    "providers": [
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "email.forwarding.create"
    ],
    "preconditions": [
      "provider exposes email capability surface"
    ],
    "postconditions": [
      "forwarding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.email.forwarding.create",
        "type": "safe_execute",
        "description": "Safely verify email.forwarding.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.email.forwarding.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for email.forwarding.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "email.forwarding.delete",
    "stable_id": "OSCO-CAP-0167",
    "name": "Delete Forwarding",
    "description": "Perform delete operation on forwarding in the email domain.",
    "category": "saas",
    "domain": "email",
    "platforms": [
      "saas",
      "cloud"
    ],
    "providers": [
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "email.forwarding.delete"
    ],
    "preconditions": [
      "provider exposes email capability surface"
    ],
    "postconditions": [
      "forwarding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.email.forwarding.delete",
        "type": "safe_execute",
        "description": "Safely verify email.forwarding.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.email.forwarding.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for email.forwarding.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "enrichment.context.annotate",
    "stable_id": "OSCO-CAP-0168",
    "name": "Annotate Context",
    "description": "Perform annotate operation on context in the enrichment domain.",
    "category": "enrichment",
    "domain": "enrichment",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "enrichment.context.annotate"
    ],
    "preconditions": [
      "provider exposes enrichment capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.enrichment.context.annotate",
        "type": "safe_execute",
        "description": "Safely verify enrichment.context.annotate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.enrichment.context.annotate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for enrichment.context.annotate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "enrichment.context.correlate",
    "stable_id": "OSCO-CAP-0169",
    "name": "Correlate Context",
    "description": "Perform correlate operation on context in the enrichment domain.",
    "category": "enrichment",
    "domain": "enrichment",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "enrichment.context.correlate"
    ],
    "preconditions": [
      "provider exposes enrichment capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.enrichment.context.correlate",
        "type": "safe_execute",
        "description": "Safely verify enrichment.context.correlate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.enrichment.context.correlate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for enrichment.context.correlate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "enrichment.context.lookup",
    "stable_id": "OSCO-CAP-0170",
    "name": "Lookup Context",
    "description": "Perform lookup operation on context in the enrichment domain.",
    "category": "enrichment",
    "domain": "enrichment",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "enrichment.context.lookup"
    ],
    "preconditions": [
      "provider exposes enrichment capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.enrichment.context.lookup",
        "type": "safe_execute",
        "description": "Safely verify enrichment.context.lookup with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.enrichment.context.lookup",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for enrichment.context.lookup"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "enrichment.context.publish",
    "stable_id": "OSCO-CAP-0171",
    "name": "Publish Context",
    "description": "Perform publish operation on context in the enrichment domain.",
    "category": "enrichment",
    "domain": "enrichment",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "enrichment.context.publish"
    ],
    "preconditions": [
      "provider exposes enrichment capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.enrichment.context.publish",
        "type": "safe_execute",
        "description": "Safely verify enrichment.context.publish with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.enrichment.context.publish",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for enrichment.context.publish"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "etw.consumer.emit",
    "stable_id": "OSCO-CAP-0172",
    "name": "Emit Consumer",
    "description": "Perform emit operation on consumer in the etw domain.",
    "category": "telemetry",
    "domain": "etw",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "etw.consumer.emit"
    ],
    "preconditions": [
      "provider exposes etw capability surface"
    ],
    "postconditions": [
      "consumer state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.etw.consumer.emit",
        "type": "safe_execute",
        "description": "Safely verify etw.consumer.emit with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.etw.consumer.emit",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for etw.consumer.emit"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "etw.consumer.parse",
    "stable_id": "OSCO-CAP-0173",
    "name": "Parse Consumer",
    "description": "Perform parse operation on consumer in the etw domain.",
    "category": "telemetry",
    "domain": "etw",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "etw.consumer.parse"
    ],
    "preconditions": [
      "provider exposes etw capability surface"
    ],
    "postconditions": [
      "consumer state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.etw.consumer.parse",
        "type": "safe_execute",
        "description": "Safely verify etw.consumer.parse with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.etw.consumer.parse",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for etw.consumer.parse"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "etw.consumer.start",
    "stable_id": "OSCO-CAP-0174",
    "name": "Start Consumer",
    "description": "Perform start operation on consumer in the etw domain.",
    "category": "telemetry",
    "domain": "etw",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "etw.consumer.start"
    ],
    "preconditions": [
      "provider exposes etw capability surface"
    ],
    "postconditions": [
      "consumer state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.etw.consumer.start",
        "type": "safe_execute",
        "description": "Safely verify etw.consumer.start with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.etw.consumer.start",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for etw.consumer.start"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.006",
        "external_name": "Impair Defenses: Indicator Blocking",
        "relation": "enables",
        "confidence": 0.78
      }
    ]
  },
  {
    "capability_id": "etw.consumer.stop",
    "stable_id": "OSCO-CAP-0175",
    "name": "Stop Consumer",
    "description": "Stop or disable an ETW consumer session, disrupting telemetry collection and potentially blinding endpoint detection tooling.",
    "category": "telemetry",
    "domain": "etw",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "etw.consumer.stop"
    ],
    "preconditions": [
      "provider exposes etw capability surface"
    ],
    "postconditions": [
      "consumer state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.etw.consumer.stop",
        "type": "safe_execute",
        "description": "Safely verify etw.consumer.stop with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.etw.consumer.stop",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for etw.consumer.stop"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.006",
        "external_name": "Impair Defenses: Indicator Blocking",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "eventlog.channel.clear",
    "stable_id": "OSCO-CAP-0176",
    "name": "Clear Channel",
    "description": "Clear Windows Event Log channels (Security, System, Application) to destroy forensic evidence of attacker activity prior to or during an incident.",
    "category": "telemetry",
    "domain": "eventlog",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "eventlog.channel.clear"
    ],
    "preconditions": [
      "provider exposes eventlog capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.eventlog.channel.clear",
        "type": "safe_execute",
        "description": "Safely verify eventlog.channel.clear with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.eventlog.channel.clear",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for eventlog.channel.clear"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1070.001",
        "external_name": "Indicator Removal: Clear Windows Event Logs",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_event_log_cleared",
        "external_name": "Windows Event Log Cleared",
        "relation": "detected_by",
        "confidence": 0.92
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.EventLogs.EvtxHunter",
        "external_name": "EvtxHunter Artifact",
        "relation": "collected_by",
        "confidence": 0.85
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1070.001",
        "external_name": "Clear Windows Event Logs",
        "relation": "validated_by",
        "confidence": 0.92
      }
    ]
  },
  {
    "capability_id": "eventlog.channel.configure",
    "stable_id": "OSCO-CAP-0177",
    "name": "Configure Channel",
    "description": "Perform configure operation on channel in the eventlog domain.",
    "category": "telemetry",
    "domain": "eventlog",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "eventlog.channel.configure"
    ],
    "preconditions": [
      "provider exposes eventlog capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.eventlog.channel.configure",
        "type": "safe_execute",
        "description": "Safely verify eventlog.channel.configure with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.eventlog.channel.configure",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for eventlog.channel.configure"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "eventlog.channel.export",
    "stable_id": "OSCO-CAP-0178",
    "name": "Export Channel",
    "description": "Perform export operation on channel in the eventlog domain.",
    "category": "telemetry",
    "domain": "eventlog",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "eventlog.channel.export"
    ],
    "preconditions": [
      "provider exposes eventlog capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.eventlog.channel.export",
        "type": "safe_execute",
        "description": "Safely verify eventlog.channel.export with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.eventlog.channel.export",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for eventlog.channel.export"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "eventlog.channel.read",
    "stable_id": "OSCO-CAP-0179",
    "name": "Read Channel",
    "description": "Perform read operation on channel in the eventlog domain.",
    "category": "telemetry",
    "domain": "eventlog",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "eventlog.channel.read"
    ],
    "preconditions": [
      "provider exposes eventlog capability surface"
    ],
    "postconditions": [
      "channel state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.eventlog.channel.read",
        "type": "safe_execute",
        "description": "Safely verify eventlog.channel.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.eventlog.channel.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for eventlog.channel.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "filesystem.directory.create",
    "stable_id": "OSCO-CAP-0180",
    "name": "Create Directory",
    "description": "Perform create operation on directory in the filesystem domain.",
    "category": "endpoint",
    "domain": "filesystem",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container"
    ],
    "providers": [
      "provider.docker",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "filesystem.directory.create"
    ],
    "preconditions": [
      "provider exposes filesystem capability surface"
    ],
    "postconditions": [
      "directory state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.filesystem.directory.create",
        "type": "safe_execute",
        "description": "Safely verify filesystem.directory.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.filesystem.directory.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for filesystem.directory.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "filesystem.directory.delete",
    "stable_id": "OSCO-CAP-0181",
    "name": "Delete Directory",
    "description": "Perform delete operation on directory in the filesystem domain.",
    "category": "endpoint",
    "domain": "filesystem",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container"
    ],
    "providers": [
      "provider.docker",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "filesystem.directory.delete"
    ],
    "preconditions": [
      "provider exposes filesystem capability surface"
    ],
    "postconditions": [
      "directory state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.filesystem.directory.delete",
        "type": "safe_execute",
        "description": "Safely verify filesystem.directory.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.filesystem.directory.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for filesystem.directory.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "filesystem.directory.hash",
    "stable_id": "OSCO-CAP-0182",
    "name": "Hash Directory",
    "description": "Perform hash operation on directory in the filesystem domain.",
    "category": "endpoint",
    "domain": "filesystem",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container"
    ],
    "providers": [
      "provider.docker",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "filesystem.directory.hash"
    ],
    "preconditions": [
      "provider exposes filesystem capability surface"
    ],
    "postconditions": [
      "directory state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.filesystem.directory.hash",
        "type": "safe_execute",
        "description": "Safely verify filesystem.directory.hash with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.filesystem.directory.hash",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for filesystem.directory.hash"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "filesystem.file.create",
    "stable_id": "OSCO-CAP-0183",
    "name": "Create File",
    "description": "Create a file object at a target path.",
    "category": "endpoint",
    "domain": "filesystem",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container"
    ],
    "providers": [
      "provider.windows",
      "provider.linux",
      "provider.macos",
      "provider.docker"
    ],
    "status": "stable",
    "confidence": 0.95,
    "safety": "caution",
    "related_capabilities": [
      "filesystem.file.modify",
      "filesystem.file.delete"
    ],
    "required_privileges": [
      "write_path"
    ],
    "preconditions": [
      "target path exists and is writable"
    ],
    "postconditions": [
      "new file inode or equivalent exists"
    ],
    "inputs": [
      "path",
      "content"
    ],
    "outputs": [
      "created_file_path"
    ],
    "evidence": [
      {
        "evidence_id": "ev.file.metadata",
        "type": "file",
        "description": "File metadata record with create timestamp"
      }
    ],
    "produced_telemetry": [
      {
        "telemetry_id": "tm.sysmon.11",
        "source": "sysmon",
        "event_type": "FileCreate",
        "description": "Sysmon file creation event"
      }
    ],
    "verification_methods": [
      {
        "method_id": "verify.tempfile",
        "type": "safe_execute",
        "description": "Create and remove temporary file in controlled path"
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.api.filesystem",
        "type": "declared",
        "state": "declared",
        "description": "Check provider API surface for file create primitives"
      }
    ],
    "execution_metadata": [
      {
        "implementation_id": "impl.winapi.createfilew",
        "implementation_type": "native_api",
        "interface": "CreateFileW"
      },
      {
        "implementation_id": "impl.posix.open",
        "implementation_type": "native_api",
        "interface": "open(O_CREAT)"
      }
    ],
    "references": [
      "https://learn.microsoft.com/windows/win32/api/fileapi/nf-fileapi-createfilew"
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1105",
        "external_name": "Ingress Tool Transfer",
        "relation": "related_to",
        "confidence": 0.55
      },
      {
        "framework": "ocsf",
        "external_id": "file_activity",
        "external_name": "File Activity",
        "confidence": 0.8
      }
    ]
  },
  {
    "capability_id": "firewall.exception.audit",
    "stable_id": "OSCO-CAP-0184",
    "name": "Audit Exception",
    "description": "Perform audit operation on exception in the firewall domain.",
    "category": "network",
    "domain": "firewall",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "firewall.exception.audit"
    ],
    "preconditions": [
      "provider exposes firewall capability surface"
    ],
    "postconditions": [
      "exception state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.firewall.exception.audit",
        "type": "safe_execute",
        "description": "Safely verify firewall.exception.audit with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.firewall.exception.audit",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for firewall.exception.audit"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "firewall.exception.create",
    "stable_id": "OSCO-CAP-0185",
    "name": "Create Exception",
    "description": "Create a Windows Firewall exception rule to allow previously blocked traffic, commonly used to enable inbound C2 or lateral movement connections.",
    "category": "network",
    "domain": "firewall",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "firewall.exception.create"
    ],
    "preconditions": [
      "provider exposes firewall capability surface"
    ],
    "postconditions": [
      "exception state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.firewall.exception.create",
        "type": "safe_execute",
        "description": "Safely verify firewall.exception.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.firewall.exception.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for firewall.exception.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.004",
        "external_name": "Impair Defenses: Disable or Modify System Firewall",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_netsh_firewall_disabled",
        "external_name": "Firewall Disabled via Netsh",
        "relation": "detected_by",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "firewall.exception.delete",
    "stable_id": "OSCO-CAP-0186",
    "name": "Delete Exception",
    "description": "Perform delete operation on exception in the firewall domain.",
    "category": "network",
    "domain": "firewall",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "firewall.exception.delete"
    ],
    "preconditions": [
      "provider exposes firewall capability surface"
    ],
    "postconditions": [
      "exception state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.firewall.exception.delete",
        "type": "safe_execute",
        "description": "Safely verify firewall.exception.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.firewall.exception.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for firewall.exception.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "firewall.exception.disable",
    "stable_id": "OSCO-CAP-0187",
    "name": "Disable Exception",
    "description": "Disable or remove Windows Firewall rules to weaken network security controls and permit blocked traffic flows.",
    "category": "network",
    "domain": "firewall",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "firewall.exception.disable"
    ],
    "preconditions": [
      "provider exposes firewall capability surface"
    ],
    "postconditions": [
      "exception state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.firewall.exception.disable",
        "type": "safe_execute",
        "description": "Safely verify firewall.exception.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.firewall.exception.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for firewall.exception.disable"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.004",
        "external_name": "Impair Defenses: Disable or Modify System Firewall",
        "relation": "maps_to",
        "confidence": 0.92
      }
    ]
  },
  {
    "capability_id": "identity.federation.create",
    "stable_id": "OSCO-CAP-0188",
    "name": "Create Federation",
    "description": "Create or modify an identity federation trust relationship (e.g., SAML trust, OIDC federation), enabling cross-domain authentication and potential credential access across trust boundaries.",
    "category": "identity",
    "domain": "identity",
    "platforms": [
      "cloud",
      "saas",
      "identity"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "identity.federation.create"
    ],
    "preconditions": [
      "provider exposes identity capability surface"
    ],
    "postconditions": [
      "federation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.identity.federation.create",
        "type": "safe_execute",
        "description": "Safely verify identity.federation.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.identity.federation.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for identity.federation.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1484.002",
        "external_name": "Domain Policy Modification: Domain Trust Modification",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "identity.federation.delete",
    "stable_id": "OSCO-CAP-0189",
    "name": "Delete Federation",
    "description": "Perform delete operation on federation in the identity domain.",
    "category": "identity",
    "domain": "identity",
    "platforms": [
      "cloud",
      "saas",
      "identity"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "identity.federation.delete"
    ],
    "preconditions": [
      "provider exposes identity capability surface"
    ],
    "postconditions": [
      "federation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.identity.federation.delete",
        "type": "safe_execute",
        "description": "Safely verify identity.federation.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.identity.federation.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for identity.federation.delete"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1484.002",
        "external_name": "Domain Policy Modification: Domain Trust Modification",
        "relation": "maps_to",
        "confidence": 0.72
      }
    ]
  },
  {
    "capability_id": "identity.federation.enumerate",
    "stable_id": "OSCO-CAP-0190",
    "name": "Enumerate Federation",
    "description": "Perform enumerate operation on federation in the identity domain.",
    "category": "identity",
    "domain": "identity",
    "platforms": [
      "cloud",
      "saas",
      "identity"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "identity.federation.enumerate"
    ],
    "preconditions": [
      "provider exposes identity capability surface"
    ],
    "postconditions": [
      "federation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.identity.federation.enumerate",
        "type": "safe_execute",
        "description": "Safely verify identity.federation.enumerate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.identity.federation.enumerate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for identity.federation.enumerate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "kerberos.delegation.delegate",
    "stable_id": "OSCO-CAP-0191",
    "name": "Delegate Delegation",
    "description": "Perform Kerberos delegation using an account with delegation rights, enabling impersonation of user credentials for lateral movement or privilege escalation.",
    "category": "identity",
    "domain": "kerberos",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kerberos.delegation.delegate"
    ],
    "preconditions": [
      "provider exposes kerberos capability surface"
    ],
    "postconditions": [
      "delegation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kerberos.delegation.delegate",
        "type": "safe_execute",
        "description": "Safely verify kerberos.delegation.delegate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kerberos.delegation.delegate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kerberos.delegation.delegate"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1558",
        "external_name": "Steal or Forge Kerberos Tickets",
        "relation": "maps_to",
        "confidence": 0.82
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1550.003",
        "external_name": "Use Alternate Authentication Material: Pass the Ticket",
        "relation": "enables",
        "confidence": 0.78
      }
    ]
  },
  {
    "capability_id": "kerberos.delegation.purge",
    "stable_id": "OSCO-CAP-0192",
    "name": "Purge Delegation",
    "description": "Perform purge operation on delegation in the kerberos domain.",
    "category": "identity",
    "domain": "kerberos",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kerberos.delegation.purge"
    ],
    "preconditions": [
      "provider exposes kerberos capability surface"
    ],
    "postconditions": [
      "delegation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kerberos.delegation.purge",
        "type": "safe_execute",
        "description": "Safely verify kerberos.delegation.purge with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kerberos.delegation.purge",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kerberos.delegation.purge"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1070.006",
        "external_name": "Indicator Removal: Timestomp",
        "relation": "maps_to",
        "confidence": 0.5
      }
    ]
  },
  {
    "capability_id": "kerberos.delegation.renew",
    "stable_id": "OSCO-CAP-0193",
    "name": "Renew Delegation",
    "description": "Perform renew operation on delegation in the kerberos domain.",
    "category": "identity",
    "domain": "kerberos",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kerberos.delegation.renew"
    ],
    "preconditions": [
      "provider exposes kerberos capability surface"
    ],
    "postconditions": [
      "delegation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kerberos.delegation.renew",
        "type": "safe_execute",
        "description": "Safely verify kerberos.delegation.renew with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kerberos.delegation.renew",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kerberos.delegation.renew"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "kerberos.delegation.request",
    "stable_id": "OSCO-CAP-0194",
    "name": "Request Delegation",
    "description": "Request a Kerberos Service Ticket (TGS) for a target SPN. Encrypted tickets can be extracted and cracked offline in Kerberoasting attacks.",
    "category": "identity",
    "domain": "kerberos",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kerberos.delegation.request"
    ],
    "preconditions": [
      "provider exposes kerberos capability surface"
    ],
    "postconditions": [
      "delegation state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kerberos.delegation.request",
        "type": "safe_execute",
        "description": "Safely verify kerberos.delegation.request with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kerberos.delegation.request",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kerberos.delegation.request"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1558.003",
        "external_name": "Steal or Forge Kerberos Tickets: Kerberoasting",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_kerberoasting",
        "external_name": "Kerberoasting Activity",
        "relation": "detected_by",
        "confidence": 0.88
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1558.003",
        "external_name": "Kerberoasting",
        "relation": "validated_by",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "kernel.extension.inspect",
    "stable_id": "OSCO-CAP-0195",
    "name": "Inspect Extension",
    "description": "Perform inspect operation on extension in the kernel domain.",
    "category": "endpoint",
    "domain": "kernel",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "kernel.extension.inspect"
    ],
    "preconditions": [
      "provider exposes kernel capability surface"
    ],
    "postconditions": [
      "extension state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.kernel.extension.inspect",
        "type": "safe_execute",
        "description": "Safely verify kernel.extension.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kernel.extension.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kernel.extension.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "kernel.extension.load",
    "stable_id": "OSCO-CAP-0196",
    "name": "Load Extension",
    "description": "Load a kernel extension or module, which may implement rootkit functionality, hook system calls, or provide persistent kernel-level access.",
    "category": "endpoint",
    "domain": "kernel",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "kernel.extension.load"
    ],
    "preconditions": [
      "provider exposes kernel capability surface"
    ],
    "postconditions": [
      "extension state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.kernel.extension.load",
        "type": "safe_execute",
        "description": "Safely verify kernel.extension.load with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kernel.extension.load",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kernel.extension.load"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1014",
        "external_name": "Rootkit",
        "relation": "maps_to",
        "confidence": 0.75
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1547.006",
        "external_name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions",
        "relation": "maps_to",
        "confidence": 0.8
      }
    ]
  },
  {
    "capability_id": "kernel.extension.modify",
    "stable_id": "OSCO-CAP-0197",
    "name": "Modify Extension",
    "description": "Perform modify operation on extension in the kernel domain.",
    "category": "endpoint",
    "domain": "kernel",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "kernel.extension.modify"
    ],
    "preconditions": [
      "provider exposes kernel capability surface"
    ],
    "postconditions": [
      "extension state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.kernel.extension.modify",
        "type": "safe_execute",
        "description": "Safely verify kernel.extension.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kernel.extension.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kernel.extension.modify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "kernel.extension.register",
    "stable_id": "OSCO-CAP-0198",
    "name": "Register Extension",
    "description": "Perform register operation on extension in the kernel domain.",
    "category": "endpoint",
    "domain": "kernel",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "kernel.extension.register"
    ],
    "preconditions": [
      "provider exposes kernel capability surface"
    ],
    "postconditions": [
      "extension state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.kernel.extension.register",
        "type": "safe_execute",
        "description": "Safely verify kernel.extension.register with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kernel.extension.register",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kernel.extension.register"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "kubernetes.configmap.create",
    "stable_id": "OSCO-CAP-0199",
    "name": "Create Configmap",
    "description": "Perform create operation on configmap in the kubernetes domain.",
    "category": "container",
    "domain": "kubernetes",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kubernetes.configmap.create"
    ],
    "preconditions": [
      "provider exposes kubernetes capability surface"
    ],
    "postconditions": [
      "configmap state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kubernetes.configmap.create",
        "type": "safe_execute",
        "description": "Safely verify kubernetes.configmap.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kubernetes.configmap.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kubernetes.configmap.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1610",
        "external_name": "Deploy Container",
        "relation": "enables",
        "confidence": 0.72
      }
    ]
  },
  {
    "capability_id": "kubernetes.configmap.delete",
    "stable_id": "OSCO-CAP-0200",
    "name": "Delete Configmap",
    "description": "Perform delete operation on configmap in the kubernetes domain.",
    "category": "container",
    "domain": "kubernetes",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kubernetes.configmap.delete"
    ],
    "preconditions": [
      "provider exposes kubernetes capability surface"
    ],
    "postconditions": [
      "configmap state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kubernetes.configmap.delete",
        "type": "safe_execute",
        "description": "Safely verify kubernetes.configmap.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kubernetes.configmap.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kubernetes.configmap.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "kubernetes.configmap.exec",
    "stable_id": "OSCO-CAP-0201",
    "name": "Exec Configmap",
    "description": "Execute commands within a running Kubernetes container via kubectl exec or the Kubernetes API server, enabling container escape or lateral movement.",
    "category": "container",
    "domain": "kubernetes",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.kubernetes"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "kubernetes.configmap.exec"
    ],
    "preconditions": [
      "provider exposes kubernetes capability surface"
    ],
    "postconditions": [
      "configmap state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.kubernetes.configmap.exec",
        "type": "safe_execute",
        "description": "Safely verify kubernetes.configmap.exec with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.kubernetes.configmap.exec",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for kubernetes.configmap.exec"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1609",
        "external_name": "Container Administration Command",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1610",
        "external_name": "Deploy Container",
        "relation": "enables",
        "confidence": 0.7
      }
    ]
  },
  {
    "capability_id": "kubernetes.secret.read",
    "stable_id": "OSCO-CAP-0202",
    "name": "Read Kubernetes Secret",
    "description": "Read Kubernetes secret object data.",
    "category": "container",
    "domain": "kubernetes",
    "platforms": [
      "container",
      "cloud"
    ],
    "providers": [
      "provider.kubernetes"
    ],
    "status": "stable",
    "confidence": 0.9,
    "safety": "caution",
    "required_privileges": [
      "k8s.secret.get"
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1552",
        "external_name": "Unsecured Credentials",
        "confidence": 0.75
      }
    ]
  },
  {
    "capability_id": "logging.collector.configure",
    "stable_id": "OSCO-CAP-0203",
    "name": "Configure Collector",
    "description": "Perform configure operation on collector in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.collector.configure"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.collector.configure",
        "type": "safe_execute",
        "description": "Safely verify logging.collector.configure with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.collector.configure",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.collector.configure"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.collector.route",
    "stable_id": "OSCO-CAP-0204",
    "name": "Route Collector",
    "description": "Perform route operation on collector in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.collector.route"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.collector.route",
        "type": "safe_execute",
        "description": "Safely verify logging.collector.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.collector.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.collector.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.collector.start",
    "stable_id": "OSCO-CAP-0205",
    "name": "Start Collector",
    "description": "Perform start operation on collector in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.collector.start"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.collector.start",
        "type": "safe_execute",
        "description": "Safely verify logging.collector.start with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.collector.start",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.collector.start"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.collector.stop",
    "stable_id": "OSCO-CAP-0206",
    "name": "Stop Collector",
    "description": "Perform stop operation on collector in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.collector.stop"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.collector.stop",
        "type": "safe_execute",
        "description": "Safely verify logging.collector.stop with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.collector.stop",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.collector.stop"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.collector.validate",
    "stable_id": "OSCO-CAP-0207",
    "name": "Validate Collector",
    "description": "Perform validate operation on collector in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.collector.validate"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.collector.validate",
        "type": "safe_execute",
        "description": "Safely verify logging.collector.validate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.collector.validate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.collector.validate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.parser.configure",
    "stable_id": "OSCO-CAP-0208",
    "name": "Configure Parser",
    "description": "Perform configure operation on parser in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.parser.configure"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "parser state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.parser.configure",
        "type": "safe_execute",
        "description": "Safely verify logging.parser.configure with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.parser.configure",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.parser.configure"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.parser.route",
    "stable_id": "OSCO-CAP-0209",
    "name": "Route Parser",
    "description": "Perform route operation on parser in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.parser.route"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "parser state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.parser.route",
        "type": "safe_execute",
        "description": "Safely verify logging.parser.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.parser.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.parser.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.parser.start",
    "stable_id": "OSCO-CAP-0210",
    "name": "Start Parser",
    "description": "Perform start operation on parser in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.parser.start"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "parser state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.parser.start",
        "type": "safe_execute",
        "description": "Safely verify logging.parser.start with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.parser.start",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.parser.start"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.parser.stop",
    "stable_id": "OSCO-CAP-0211",
    "name": "Stop Parser",
    "description": "Perform stop operation on parser in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.parser.stop"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "parser state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.parser.stop",
        "type": "safe_execute",
        "description": "Safely verify logging.parser.stop with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.parser.stop",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.parser.stop"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.parser.validate",
    "stable_id": "OSCO-CAP-0212",
    "name": "Validate Parser",
    "description": "Perform validate operation on parser in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.parser.validate"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "parser state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.parser.validate",
        "type": "safe_execute",
        "description": "Safely verify logging.parser.validate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.parser.validate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.parser.validate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.pipeline.configure",
    "stable_id": "OSCO-CAP-0213",
    "name": "Configure Pipeline",
    "description": "Perform configure operation on pipeline in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.pipeline.configure"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.pipeline.configure",
        "type": "safe_execute",
        "description": "Safely verify logging.pipeline.configure with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.pipeline.configure",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.pipeline.configure"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.pipeline.route",
    "stable_id": "OSCO-CAP-0214",
    "name": "Route Pipeline",
    "description": "Perform route operation on pipeline in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.pipeline.route"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.pipeline.route",
        "type": "safe_execute",
        "description": "Safely verify logging.pipeline.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.pipeline.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.pipeline.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.pipeline.start",
    "stable_id": "OSCO-CAP-0215",
    "name": "Start Pipeline",
    "description": "Perform start operation on pipeline in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.pipeline.start"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.pipeline.start",
        "type": "safe_execute",
        "description": "Safely verify logging.pipeline.start with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.pipeline.start",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.pipeline.start"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.pipeline.stop",
    "stable_id": "OSCO-CAP-0216",
    "name": "Stop Pipeline",
    "description": "Perform stop operation on pipeline in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.pipeline.stop"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.pipeline.stop",
        "type": "safe_execute",
        "description": "Safely verify logging.pipeline.stop with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.pipeline.stop",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.pipeline.stop"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.pipeline.validate",
    "stable_id": "OSCO-CAP-0217",
    "name": "Validate Pipeline",
    "description": "Perform validate operation on pipeline in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.pipeline.validate"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.pipeline.validate",
        "type": "safe_execute",
        "description": "Safely verify logging.pipeline.validate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.pipeline.validate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.pipeline.validate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.sink.configure",
    "stable_id": "OSCO-CAP-0218",
    "name": "Configure Sink",
    "description": "Perform configure operation on sink in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.sink.configure"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.sink.configure",
        "type": "safe_execute",
        "description": "Safely verify logging.sink.configure with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.sink.configure",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.sink.configure"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.sink.route",
    "stable_id": "OSCO-CAP-0219",
    "name": "Route Sink",
    "description": "Perform route operation on sink in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.sink.route"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.sink.route",
        "type": "safe_execute",
        "description": "Safely verify logging.sink.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.sink.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.sink.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.sink.start",
    "stable_id": "OSCO-CAP-0220",
    "name": "Start Sink",
    "description": "Perform start operation on sink in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.sink.start"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.sink.start",
        "type": "safe_execute",
        "description": "Safely verify logging.sink.start with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.sink.start",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.sink.start"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.sink.stop",
    "stable_id": "OSCO-CAP-0221",
    "name": "Stop Sink",
    "description": "Perform stop operation on sink in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.sink.stop"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.sink.stop",
        "type": "safe_execute",
        "description": "Safely verify logging.sink.stop with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.sink.stop",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.sink.stop"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "logging.sink.validate",
    "stable_id": "OSCO-CAP-0222",
    "name": "Validate Sink",
    "description": "Perform validate operation on sink in the logging domain.",
    "category": "telemetry",
    "domain": "logging",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "logging.sink.validate"
    ],
    "preconditions": [
      "provider exposes logging capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.logging.sink.validate",
        "type": "safe_execute",
        "description": "Safely verify logging.sink.validate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.logging.sink.validate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for logging.sink.validate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "mail.forwarding.create",
    "stable_id": "OSCO-CAP-0223",
    "name": "Create Mail Forwarding Rule",
    "description": "Create forwarding rule for mailbox routing.",
    "category": "saas",
    "domain": "email",
    "platforms": [
      "saas"
    ],
    "providers": [
      "provider.google_workspace",
      "provider.microsoft365"
    ],
    "status": "stable",
    "confidence": 0.92,
    "safety": "caution",
    "required_privileges": [
      "mailbox.rule.create"
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1114.003",
        "external_name": "Email Collection: Email Forwarding Rule",
        "confidence": 0.97
      },
      {
        "framework": "event_maturity_matrix",
        "external_id": "identity-mail-03",
        "external_name": "Email Forwarding Visibility",
        "confidence": 0.8
      }
    ]
  },
  {
    "capability_id": "memory.dump.allocate",
    "stable_id": "OSCO-CAP-0224",
    "name": "Allocate Dump",
    "description": "Perform allocate operation on dump in the memory domain.",
    "category": "endpoint",
    "domain": "memory",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "memory.dump.allocate"
    ],
    "preconditions": [
      "provider exposes memory capability surface"
    ],
    "postconditions": [
      "dump state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.memory.dump.allocate",
        "type": "safe_execute",
        "description": "Safely verify memory.dump.allocate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.memory.dump.allocate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for memory.dump.allocate"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1055",
        "external_name": "Process Injection",
        "relation": "enables",
        "confidence": 0.75
      }
    ]
  },
  {
    "capability_id": "memory.dump.dump",
    "stable_id": "OSCO-CAP-0225",
    "name": "Dump Dump",
    "description": "Dump process memory to disk or over the network. Most commonly observed targeting LSASS.exe to extract plaintext credentials and NTLM hashes.",
    "category": "endpoint",
    "domain": "memory",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "memory.dump.dump"
    ],
    "preconditions": [
      "provider exposes memory capability surface"
    ],
    "postconditions": [
      "dump state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.memory.dump.dump",
        "type": "safe_execute",
        "description": "Safely verify memory.dump.dump with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.memory.dump.dump",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for memory.dump.dump"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003.001",
        "external_name": "OS Credential Dumping: LSASS Memory",
        "relation": "maps_to",
        "confidence": 0.92
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1003.001",
        "external_name": "LSASS Memory Credential Dump",
        "relation": "validated_by",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "memory.dump.protect",
    "stable_id": "OSCO-CAP-0226",
    "name": "Protect Dump",
    "description": "Perform protect operation on dump in the memory domain.",
    "category": "endpoint",
    "domain": "memory",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "memory.dump.protect"
    ],
    "preconditions": [
      "provider exposes memory capability surface"
    ],
    "postconditions": [
      "dump state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.memory.dump.protect",
        "type": "safe_execute",
        "description": "Safely verify memory.dump.protect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.memory.dump.protect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for memory.dump.protect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "memory.dump.read",
    "stable_id": "OSCO-CAP-0227",
    "name": "Read Dump",
    "description": "Read process memory directly, bypassing file system controls. Primarily used to extract credentials from LSASS process memory.",
    "category": "endpoint",
    "domain": "memory",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "memory.dump.read"
    ],
    "preconditions": [
      "provider exposes memory capability surface"
    ],
    "postconditions": [
      "dump state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.memory.dump.read",
        "type": "safe_execute",
        "description": "Safely verify memory.dump.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.memory.dump.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for memory.dump.read"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003.001",
        "external_name": "OS Credential Dumping: LSASS Memory",
        "relation": "maps_to",
        "confidence": 0.92
      },
      {
        "framework": "sigma",
        "external_id": "win_lsass_dump_comsvcs_minidump",
        "external_name": "LSASS Dump via Comsvcs DLL",
        "relation": "detected_by",
        "confidence": 0.88
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.Memory.Acquisition",
        "external_name": "Memory Acquisition Artifact",
        "relation": "collected_by",
        "confidence": 0.82
      }
    ]
  },
  {
    "capability_id": "named_pipe.client.close",
    "stable_id": "OSCO-CAP-0228",
    "name": "Close Client",
    "description": "Perform close operation on client in the named_pipe domain.",
    "category": "endpoint",
    "domain": "named_pipe",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "named_pipe.client.close"
    ],
    "preconditions": [
      "provider exposes named_pipe capability surface"
    ],
    "postconditions": [
      "client state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.named_pipe.client.close",
        "type": "safe_execute",
        "description": "Safely verify named_pipe.client.close with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.named_pipe.client.close",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for named_pipe.client.close"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "named_pipe.client.connect",
    "stable_id": "OSCO-CAP-0229",
    "name": "Connect Client",
    "description": "Perform connect operation on client in the named_pipe domain.",
    "category": "endpoint",
    "domain": "named_pipe",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "named_pipe.client.connect"
    ],
    "preconditions": [
      "provider exposes named_pipe capability surface"
    ],
    "postconditions": [
      "client state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.named_pipe.client.connect",
        "type": "safe_execute",
        "description": "Safely verify named_pipe.client.connect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.named_pipe.client.connect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for named_pipe.client.connect"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1559.001",
        "external_name": "Inter-Process Communication: Component Object Model",
        "relation": "maps_to",
        "confidence": 0.6
      }
    ]
  },
  {
    "capability_id": "named_pipe.client.create",
    "stable_id": "OSCO-CAP-0230",
    "name": "Create Client",
    "description": "Perform create operation on client in the named_pipe domain.",
    "category": "endpoint",
    "domain": "named_pipe",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "named_pipe.client.create"
    ],
    "preconditions": [
      "provider exposes named_pipe capability surface"
    ],
    "postconditions": [
      "client state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.named_pipe.client.create",
        "type": "safe_execute",
        "description": "Safely verify named_pipe.client.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.named_pipe.client.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for named_pipe.client.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "named_pipe.client.read",
    "stable_id": "OSCO-CAP-0231",
    "name": "Read Client",
    "description": "Perform read operation on client in the named_pipe domain.",
    "category": "endpoint",
    "domain": "named_pipe",
    "platforms": [
      "windows",
      "linux"
    ],
    "providers": [
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "named_pipe.client.read"
    ],
    "preconditions": [
      "provider exposes named_pipe capability surface"
    ],
    "postconditions": [
      "client state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.named_pipe.client.read",
        "type": "safe_execute",
        "description": "Safely verify named_pipe.client.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.named_pipe.client.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for named_pipe.client.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "network.connection.close",
    "stable_id": "OSCO-CAP-0232",
    "name": "Close Connection",
    "description": "Perform close operation on connection in the network domain.",
    "category": "network",
    "domain": "network",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.docker",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "network.connection.close"
    ],
    "preconditions": [
      "provider exposes network capability surface"
    ],
    "postconditions": [
      "connection state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.network.connection.close",
        "type": "safe_execute",
        "description": "Safely verify network.connection.close with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.network.connection.close",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for network.connection.close"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "network.connection.inspect",
    "stable_id": "OSCO-CAP-0233",
    "name": "Inspect Connection",
    "description": "Perform inspect operation on connection in the network domain.",
    "category": "network",
    "domain": "network",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.docker",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "network.connection.inspect"
    ],
    "preconditions": [
      "provider exposes network capability surface"
    ],
    "postconditions": [
      "connection state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.network.connection.inspect",
        "type": "safe_execute",
        "description": "Safely verify network.connection.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.network.connection.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for network.connection.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "network.connection.modify",
    "stable_id": "OSCO-CAP-0234",
    "name": "Modify Connection",
    "description": "Perform modify operation on connection in the network domain.",
    "category": "network",
    "domain": "network",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.docker",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "network.connection.modify"
    ],
    "preconditions": [
      "provider exposes network capability surface"
    ],
    "postconditions": [
      "connection state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.network.connection.modify",
        "type": "safe_execute",
        "description": "Safely verify network.connection.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.network.connection.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for network.connection.modify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "network.connection.monitor",
    "stable_id": "OSCO-CAP-0235",
    "name": "Monitor Connection",
    "description": "Perform monitor operation on connection in the network domain.",
    "category": "network",
    "domain": "network",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.docker",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "network.connection.monitor"
    ],
    "preconditions": [
      "provider exposes network capability surface"
    ],
    "postconditions": [
      "connection state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.network.connection.monitor",
        "type": "safe_execute",
        "description": "Safely verify network.connection.monitor with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.network.connection.monitor",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for network.connection.monitor"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1040",
        "external_name": "Network Sniffing",
        "relation": "maps_to",
        "confidence": 0.75
      }
    ]
  },
  {
    "capability_id": "network.dns.query",
    "stable_id": "OSCO-CAP-0236",
    "name": "Perform DNS Query",
    "description": "Resolve a DNS name through configured resolver.",
    "category": "network",
    "domain": "dns",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "container",
      "cloud"
    ],
    "providers": [
      "provider.windows",
      "provider.linux",
      "provider.macos",
      "provider.kubernetes"
    ],
    "status": "stable",
    "confidence": 0.9,
    "safety": "safe",
    "mappings": [
      {
        "framework": "ocsf",
        "external_id": "dns_activity",
        "external_name": "DNS Activity",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "office.addin.create",
    "stable_id": "OSCO-CAP-0237",
    "name": "Create Addin",
    "description": "Perform create operation on addin in the office domain.",
    "category": "saas",
    "domain": "office",
    "platforms": [
      "saas",
      "windows",
      "macos"
    ],
    "providers": [
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "office.addin.create"
    ],
    "preconditions": [
      "provider exposes office capability surface"
    ],
    "postconditions": [
      "addin state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.office.addin.create",
        "type": "safe_execute",
        "description": "Safely verify office.addin.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.office.addin.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for office.addin.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "office.addin.delete",
    "stable_id": "OSCO-CAP-0238",
    "name": "Delete Addin",
    "description": "Perform delete operation on addin in the office domain.",
    "category": "saas",
    "domain": "office",
    "platforms": [
      "saas",
      "windows",
      "macos"
    ],
    "providers": [
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "office.addin.delete"
    ],
    "preconditions": [
      "provider exposes office capability surface"
    ],
    "postconditions": [
      "addin state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.office.addin.delete",
        "type": "safe_execute",
        "description": "Safely verify office.addin.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.office.addin.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for office.addin.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "office.addin.disable",
    "stable_id": "OSCO-CAP-0239",
    "name": "Disable Addin",
    "description": "Perform disable operation on addin in the office domain.",
    "category": "saas",
    "domain": "office",
    "platforms": [
      "saas",
      "windows",
      "macos"
    ],
    "providers": [
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "office.addin.disable"
    ],
    "preconditions": [
      "provider exposes office capability surface"
    ],
    "postconditions": [
      "addin state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.office.addin.disable",
        "type": "safe_execute",
        "description": "Safely verify office.addin.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.office.addin.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for office.addin.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "office.addin.execute",
    "stable_id": "OSCO-CAP-0240",
    "name": "Execute Addin",
    "description": "Perform execute operation on addin in the office domain.",
    "category": "saas",
    "domain": "office",
    "platforms": [
      "saas",
      "windows",
      "macos"
    ],
    "providers": [
      "provider.microsoft365"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "office.addin.execute"
    ],
    "preconditions": [
      "provider exposes office capability surface"
    ],
    "postconditions": [
      "addin state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.office.addin.execute",
        "type": "safe_execute",
        "description": "Safely verify office.addin.execute with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.office.addin.execute",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for office.addin.execute"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "powershell.command.constrain",
    "stable_id": "OSCO-CAP-0241",
    "name": "Constrain Command",
    "description": "Enforce PowerShell Constrained Language Mode (CLM) to limit available commands and reduce the attack surface of script-based execution.",
    "category": "endpoint",
    "domain": "powershell",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "powershell.command.constrain"
    ],
    "preconditions": [
      "provider exposes powershell capability surface"
    ],
    "postconditions": [
      "command state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.powershell.command.constrain",
        "type": "safe_execute",
        "description": "Safely verify powershell.command.constrain with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.powershell.command.constrain",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for powershell.command.constrain"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1059.001",
        "external_name": "Command and Scripting Interpreter: PowerShell",
        "relation": "mitigates",
        "confidence": 0.82
      }
    ]
  },
  {
    "capability_id": "powershell.command.execute",
    "stable_id": "OSCO-CAP-0242",
    "name": "Execute Command",
    "description": "Execute a PowerShell command, script block, or encoded payload. PowerShell is the most widely abused scripting engine for living-off-the-land attacks.",
    "category": "endpoint",
    "domain": "powershell",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "powershell.command.execute"
    ],
    "preconditions": [
      "provider exposes powershell capability surface"
    ],
    "postconditions": [
      "command state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.powershell.command.execute",
        "type": "safe_execute",
        "description": "Safely verify powershell.command.execute with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.powershell.command.execute",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for powershell.command.execute"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1059.001",
        "external_name": "Command and Scripting Interpreter: PowerShell",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_powershell_encode",
        "external_name": "Suspicious PowerShell Encoded Command",
        "relation": "detected_by",
        "confidence": 0.88
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1059.001",
        "external_name": "PowerShell Execution",
        "relation": "validated_by",
        "confidence": 0.95
      }
    ]
  },
  {
    "capability_id": "powershell.command.import",
    "stable_id": "OSCO-CAP-0243",
    "name": "Import Command",
    "description": "Perform import operation on command in the powershell domain.",
    "category": "endpoint",
    "domain": "powershell",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "powershell.command.import"
    ],
    "preconditions": [
      "provider exposes powershell capability surface"
    ],
    "postconditions": [
      "command state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.powershell.command.import",
        "type": "safe_execute",
        "description": "Safely verify powershell.command.import with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.powershell.command.import",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for powershell.command.import"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "powershell.command.inspect",
    "stable_id": "OSCO-CAP-0244",
    "name": "Inspect Command",
    "description": "Perform inspect operation on command in the powershell domain.",
    "category": "endpoint",
    "domain": "powershell",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "powershell.command.inspect"
    ],
    "preconditions": [
      "provider exposes powershell capability surface"
    ],
    "postconditions": [
      "command state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.powershell.command.inspect",
        "type": "safe_execute",
        "description": "Safely verify powershell.command.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.powershell.command.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for powershell.command.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "privilege.context.delegate",
    "stable_id": "OSCO-CAP-0245",
    "name": "Delegate Context",
    "description": "Delegate process privilege context by duplicating or impersonating higher-privileged access tokens.",
    "category": "identity",
    "domain": "privilege",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "privilege.context.delegate"
    ],
    "preconditions": [
      "provider exposes privilege capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.privilege.context.delegate",
        "type": "safe_execute",
        "description": "Safely verify privilege.context.delegate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.privilege.context.delegate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for privilege.context.delegate"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1134.001",
        "external_name": "Access Token Manipulation: Token Impersonation/Theft",
        "relation": "maps_to",
        "confidence": 0.82
      }
    ]
  },
  {
    "capability_id": "privilege.context.drop",
    "stable_id": "OSCO-CAP-0246",
    "name": "Drop Context",
    "description": "Perform drop operation on context in the privilege domain.",
    "category": "identity",
    "domain": "privilege",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "privilege.context.drop"
    ],
    "preconditions": [
      "provider exposes privilege capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.privilege.context.drop",
        "type": "safe_execute",
        "description": "Safely verify privilege.context.drop with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.privilege.context.drop",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for privilege.context.drop"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "privilege.context.escalate",
    "stable_id": "OSCO-CAP-0247",
    "name": "Escalate Context",
    "description": "Escalate process privilege context via token manipulation, exploitation, or abuse of privileged system calls.",
    "category": "identity",
    "domain": "privilege",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "privilege.context.escalate"
    ],
    "preconditions": [
      "provider exposes privilege capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.privilege.context.escalate",
        "type": "safe_execute",
        "description": "Safely verify privilege.context.escalate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.privilege.context.escalate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for privilege.context.escalate"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1134",
        "external_name": "Access Token Manipulation",
        "relation": "maps_to",
        "confidence": 0.82
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1068",
        "external_name": "Exploitation for Privilege Escalation",
        "relation": "maps_to",
        "confidence": 0.72
      }
    ]
  },
  {
    "capability_id": "privilege.context.inspect",
    "stable_id": "OSCO-CAP-0248",
    "name": "Inspect Context",
    "description": "Perform inspect operation on context in the privilege domain.",
    "category": "identity",
    "domain": "privilege",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.8,
    "safety": "destructive",
    "required_privileges": [
      "privilege.context.inspect"
    ],
    "preconditions": [
      "provider exposes privilege capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.privilege.context.inspect",
        "type": "safe_execute",
        "description": "Safely verify privilege.context.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.privilege.context.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for privilege.context.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "process.argument.create",
    "stable_id": "OSCO-CAP-0249",
    "name": "Create Argument",
    "description": "Perform create operation on argument in the process domain.",
    "category": "endpoint",
    "domain": "process",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "process.argument.create"
    ],
    "preconditions": [
      "provider exposes process capability surface"
    ],
    "postconditions": [
      "argument state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.process.argument.create",
        "type": "safe_execute",
        "description": "Safely verify process.argument.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.argument.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for process.argument.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "process.argument.enumerate",
    "stable_id": "OSCO-CAP-0250",
    "name": "Enumerate Argument",
    "description": "Perform enumerate operation on argument in the process domain.",
    "category": "endpoint",
    "domain": "process",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "process.argument.enumerate"
    ],
    "preconditions": [
      "provider exposes process capability surface"
    ],
    "postconditions": [
      "argument state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.process.argument.enumerate",
        "type": "safe_execute",
        "description": "Safely verify process.argument.enumerate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.argument.enumerate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for process.argument.enumerate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "process.argument.inject",
    "stable_id": "OSCO-CAP-0251",
    "name": "Inject Argument",
    "description": "Inject content into process arguments or command line, enabling argument spoofing or command injection via process creation.",
    "category": "endpoint",
    "domain": "process",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "process.argument.inject"
    ],
    "preconditions": [
      "provider exposes process capability surface"
    ],
    "postconditions": [
      "argument state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.process.argument.inject",
        "type": "safe_execute",
        "description": "Safely verify process.argument.inject with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.argument.inject",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for process.argument.inject"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1055",
        "external_name": "Process Injection",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "process.argument.modify",
    "stable_id": "OSCO-CAP-0252",
    "name": "Modify Argument",
    "description": "Perform modify operation on argument in the process domain.",
    "category": "endpoint",
    "domain": "process",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "process.argument.modify"
    ],
    "preconditions": [
      "provider exposes process capability surface"
    ],
    "postconditions": [
      "argument state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.process.argument.modify",
        "type": "safe_execute",
        "description": "Safely verify process.argument.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.argument.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for process.argument.modify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "proxy.configuration.bypass",
    "stable_id": "OSCO-CAP-0253",
    "name": "Bypass Configuration",
    "description": "Perform bypass operation on configuration in the proxy domain.",
    "category": "network",
    "domain": "proxy",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "proxy.configuration.bypass"
    ],
    "preconditions": [
      "provider exposes proxy capability surface"
    ],
    "postconditions": [
      "configuration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.proxy.configuration.bypass",
        "type": "safe_execute",
        "description": "Safely verify proxy.configuration.bypass with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.proxy.configuration.bypass",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for proxy.configuration.bypass"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "proxy.configuration.delete",
    "stable_id": "OSCO-CAP-0254",
    "name": "Delete Configuration",
    "description": "Perform delete operation on configuration in the proxy domain.",
    "category": "network",
    "domain": "proxy",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "proxy.configuration.delete"
    ],
    "preconditions": [
      "provider exposes proxy capability surface"
    ],
    "postconditions": [
      "configuration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.proxy.configuration.delete",
        "type": "safe_execute",
        "description": "Safely verify proxy.configuration.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.proxy.configuration.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for proxy.configuration.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "proxy.configuration.enforce",
    "stable_id": "OSCO-CAP-0255",
    "name": "Enforce Configuration",
    "description": "Perform enforce operation on configuration in the proxy domain.",
    "category": "network",
    "domain": "proxy",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "proxy.configuration.enforce"
    ],
    "preconditions": [
      "provider exposes proxy capability surface"
    ],
    "postconditions": [
      "configuration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.proxy.configuration.enforce",
        "type": "safe_execute",
        "description": "Safely verify proxy.configuration.enforce with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.proxy.configuration.enforce",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for proxy.configuration.enforce"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "proxy.configuration.read",
    "stable_id": "OSCO-CAP-0256",
    "name": "Read Configuration",
    "description": "Perform read operation on configuration in the proxy domain.",
    "category": "network",
    "domain": "proxy",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "proxy.configuration.read"
    ],
    "preconditions": [
      "provider exposes proxy capability surface"
    ],
    "postconditions": [
      "configuration state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.proxy.configuration.read",
        "type": "safe_execute",
        "description": "Safely verify proxy.configuration.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.proxy.configuration.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for proxy.configuration.read"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "registry.hive.backup",
    "stable_id": "OSCO-CAP-0257",
    "name": "Backup Hive",
    "description": "Perform backup operation on hive in the registry domain.",
    "category": "endpoint",
    "domain": "registry",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "registry.hive.backup"
    ],
    "preconditions": [
      "provider exposes registry capability surface"
    ],
    "postconditions": [
      "hive state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.registry.hive.backup",
        "type": "safe_execute",
        "description": "Safely verify registry.hive.backup with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.registry.hive.backup",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for registry.hive.backup"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "registry.hive.delete",
    "stable_id": "OSCO-CAP-0258",
    "name": "Delete Hive",
    "description": "Perform delete operation on hive in the registry domain.",
    "category": "endpoint",
    "domain": "registry",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "registry.hive.delete"
    ],
    "preconditions": [
      "provider exposes registry capability surface"
    ],
    "postconditions": [
      "hive state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.registry.hive.delete",
        "type": "safe_execute",
        "description": "Safely verify registry.hive.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.registry.hive.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for registry.hive.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "registry.hive.enumerate",
    "stable_id": "OSCO-CAP-0259",
    "name": "Enumerate Hive",
    "description": "Perform enumerate operation on hive in the registry domain.",
    "category": "endpoint",
    "domain": "registry",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "registry.hive.enumerate"
    ],
    "preconditions": [
      "provider exposes registry capability surface"
    ],
    "postconditions": [
      "hive state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.registry.hive.enumerate",
        "type": "safe_execute",
        "description": "Safely verify registry.hive.enumerate with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.registry.hive.enumerate",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for registry.hive.enumerate"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "registry.key.set",
    "stable_id": "OSCO-CAP-0260",
    "name": "Set Registry Key",
    "description": "Create or modify a registry key and value.",
    "category": "endpoint",
    "domain": "registry",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "status": "stable",
    "confidence": 0.96,
    "safety": "caution",
    "required_privileges": [
      "registry_write"
    ],
    "evidence": [
      {
        "evidence_id": "ev.registry.path",
        "type": "registry_key",
        "description": "Registry value exists at expected path"
      }
    ],
    "produced_telemetry": [
      {
        "telemetry_id": "tm.sysmon.13",
        "source": "sysmon",
        "event_type": "RegistryValueSet",
        "description": "Registry value set telemetry"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1112",
        "external_name": "Modify Registry",
        "confidence": 0.94
      },
      {
        "framework": "sigma",
        "external_id": "proc_creation_win_reg",
        "external_name": "Registry Persistence Detection",
        "relation": "detects",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "response.containment.document",
    "stable_id": "OSCO-CAP-0261",
    "name": "Document Containment",
    "description": "Perform document operation on containment in the response domain.",
    "category": "response",
    "domain": "response",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "response.containment.document"
    ],
    "preconditions": [
      "provider exposes response capability surface"
    ],
    "postconditions": [
      "containment state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.response.containment.document",
        "type": "safe_execute",
        "description": "Safely verify response.containment.document with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.response.containment.document",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for response.containment.document"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "response.containment.execute",
    "stable_id": "OSCO-CAP-0262",
    "name": "Execute Containment",
    "description": "Perform execute operation on containment in the response domain.",
    "category": "response",
    "domain": "response",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "response.containment.execute"
    ],
    "preconditions": [
      "provider exposes response capability surface"
    ],
    "postconditions": [
      "containment state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.response.containment.execute",
        "type": "safe_execute",
        "description": "Safely verify response.containment.execute with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.response.containment.execute",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for response.containment.execute"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "response.containment.plan",
    "stable_id": "OSCO-CAP-0263",
    "name": "Plan Containment",
    "description": "Perform plan operation on containment in the response domain.",
    "category": "response",
    "domain": "response",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "response.containment.plan"
    ],
    "preconditions": [
      "provider exposes response capability surface"
    ],
    "postconditions": [
      "containment state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.response.containment.plan",
        "type": "safe_execute",
        "description": "Safely verify response.containment.plan with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.response.containment.plan",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for response.containment.plan"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "response.containment.rollback",
    "stable_id": "OSCO-CAP-0264",
    "name": "Rollback Containment",
    "description": "Perform rollback operation on containment in the response domain.",
    "category": "response",
    "domain": "response",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "response.containment.rollback"
    ],
    "preconditions": [
      "provider exposes response capability surface"
    ],
    "postconditions": [
      "containment state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.response.containment.rollback",
        "type": "safe_execute",
        "description": "Safely verify response.containment.rollback with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.response.containment.rollback",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for response.containment.rollback"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "rpc.binding.discover",
    "stable_id": "OSCO-CAP-0265",
    "name": "Discover Binding",
    "description": "Perform discover operation on binding in the rpc domain.",
    "category": "network",
    "domain": "rpc",
    "platforms": [
      "windows",
      "linux",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "rpc.binding.discover"
    ],
    "preconditions": [
      "provider exposes rpc capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.rpc.binding.discover",
        "type": "safe_execute",
        "description": "Safely verify rpc.binding.discover with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.rpc.binding.discover",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for rpc.binding.discover"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "rpc.binding.inspect",
    "stable_id": "OSCO-CAP-0266",
    "name": "Inspect Binding",
    "description": "Perform inspect operation on binding in the rpc domain.",
    "category": "network",
    "domain": "rpc",
    "platforms": [
      "windows",
      "linux",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "rpc.binding.inspect"
    ],
    "preconditions": [
      "provider exposes rpc capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.rpc.binding.inspect",
        "type": "safe_execute",
        "description": "Safely verify rpc.binding.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.rpc.binding.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for rpc.binding.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "rpc.binding.invoke",
    "stable_id": "OSCO-CAP-0267",
    "name": "Invoke Binding",
    "description": "Invoke a remote RPC/DCOM method, which can be used for lateral movement by executing code on a remote host via the Distributed Component Object Model.",
    "category": "network",
    "domain": "rpc",
    "platforms": [
      "windows",
      "linux",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "rpc.binding.invoke"
    ],
    "preconditions": [
      "provider exposes rpc capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.rpc.binding.invoke",
        "type": "safe_execute",
        "description": "Safely verify rpc.binding.invoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.rpc.binding.invoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for rpc.binding.invoke"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1021.003",
        "external_name": "Remote Services: Distributed Component Object Model",
        "relation": "maps_to",
        "confidence": 0.82
      }
    ]
  },
  {
    "capability_id": "rpc.binding.register",
    "stable_id": "OSCO-CAP-0268",
    "name": "Register Binding",
    "description": "Perform register operation on binding in the rpc domain.",
    "category": "network",
    "domain": "rpc",
    "platforms": [
      "windows",
      "linux",
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.linux",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "rpc.binding.register"
    ],
    "preconditions": [
      "provider exposes rpc capability surface"
    ],
    "postconditions": [
      "binding state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.rpc.binding.register",
        "type": "safe_execute",
        "description": "Safely verify rpc.binding.register with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.rpc.binding.register",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for rpc.binding.register"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "scheduled_task.action.create",
    "stable_id": "OSCO-CAP-0269",
    "name": "Create Action",
    "description": "Perform create operation on action in the scheduled_task domain.",
    "category": "endpoint",
    "domain": "scheduled_task",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "scheduled_task.action.create"
    ],
    "preconditions": [
      "provider exposes scheduled_task capability surface"
    ],
    "postconditions": [
      "action state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.scheduled_task.action.create",
        "type": "safe_execute",
        "description": "Safely verify scheduled_task.action.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.scheduled_task.action.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for scheduled_task.action.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "scheduled_task.action.delete",
    "stable_id": "OSCO-CAP-0270",
    "name": "Delete Action",
    "description": "Perform delete operation on action in the scheduled_task domain.",
    "category": "endpoint",
    "domain": "scheduled_task",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "scheduled_task.action.delete"
    ],
    "preconditions": [
      "provider exposes scheduled_task capability surface"
    ],
    "postconditions": [
      "action state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.scheduled_task.action.delete",
        "type": "safe_execute",
        "description": "Safely verify scheduled_task.action.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.scheduled_task.action.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for scheduled_task.action.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "scheduled_task.action.modify",
    "stable_id": "OSCO-CAP-0271",
    "name": "Modify Action",
    "description": "Perform modify operation on action in the scheduled_task domain.",
    "category": "endpoint",
    "domain": "scheduled_task",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "scheduled_task.action.modify"
    ],
    "preconditions": [
      "provider exposes scheduled_task capability surface"
    ],
    "postconditions": [
      "action state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.scheduled_task.action.modify",
        "type": "safe_execute",
        "description": "Safely verify scheduled_task.action.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.scheduled_task.action.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for scheduled_task.action.modify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "service.binary.create",
    "stable_id": "OSCO-CAP-0272",
    "name": "Create Binary",
    "description": "Create a new Windows service binary or service registration, commonly used for persistence and privilege escalation to SYSTEM.",
    "category": "endpoint",
    "domain": "service",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "service.binary.create"
    ],
    "preconditions": [
      "provider exposes service capability surface"
    ],
    "postconditions": [
      "binary state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.service.binary.create",
        "type": "safe_execute",
        "description": "Safely verify service.binary.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.service.binary.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for service.binary.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1543.003",
        "external_name": "Create or Modify System Process: Windows Service",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_service_install",
        "external_name": "Suspicious Service Installation",
        "relation": "detected_by",
        "confidence": 0.85
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.System.Services",
        "external_name": "Windows Services Artifact",
        "relation": "discovered_by",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "service.binary.delete",
    "stable_id": "OSCO-CAP-0273",
    "name": "Delete Binary",
    "description": "Perform delete operation on binary in the service domain.",
    "category": "endpoint",
    "domain": "service",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "service.binary.delete"
    ],
    "preconditions": [
      "provider exposes service capability surface"
    ],
    "postconditions": [
      "binary state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.service.binary.delete",
        "type": "safe_execute",
        "description": "Safely verify service.binary.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.service.binary.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for service.binary.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "service.binary.modify",
    "stable_id": "OSCO-CAP-0274",
    "name": "Modify Binary",
    "description": "Modify an existing Windows service binary path or configuration, enabling persistence via service hijacking.",
    "category": "endpoint",
    "domain": "service",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "service.binary.modify"
    ],
    "preconditions": [
      "provider exposes service capability surface"
    ],
    "postconditions": [
      "binary state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.service.binary.modify",
        "type": "safe_execute",
        "description": "Safely verify service.binary.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.service.binary.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for service.binary.modify"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1543.003",
        "external_name": "Create or Modify System Process: Windows Service",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "service.binary.query",
    "stable_id": "OSCO-CAP-0275",
    "name": "Query Binary",
    "description": "Perform query operation on binary in the service domain.",
    "category": "endpoint",
    "domain": "service",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "service.binary.query"
    ],
    "preconditions": [
      "provider exposes service capability surface"
    ],
    "postconditions": [
      "binary state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.service.binary.query",
        "type": "safe_execute",
        "description": "Safely verify service.binary.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.service.binary.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for service.binary.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "smb.file.connect",
    "stable_id": "OSCO-CAP-0276",
    "name": "Connect File",
    "description": "Connect to a remote SMB share, used for lateral movement via admin shares (C$, ADMIN$) or for accessing network-shared files.",
    "category": "network",
    "domain": "smb",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "smb.file.connect"
    ],
    "preconditions": [
      "provider exposes smb capability surface"
    ],
    "postconditions": [
      "file state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.smb.file.connect",
        "type": "safe_execute",
        "description": "Safely verify smb.file.connect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.smb.file.connect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for smb.file.connect"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1021.002",
        "external_name": "Remote Services: SMB/Windows Admin Shares",
        "relation": "maps_to",
        "confidence": 0.82
      }
    ]
  },
  {
    "capability_id": "smb.file.disconnect",
    "stable_id": "OSCO-CAP-0277",
    "name": "Disconnect File",
    "description": "Perform disconnect operation on file in the smb domain.",
    "category": "network",
    "domain": "smb",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "smb.file.disconnect"
    ],
    "preconditions": [
      "provider exposes smb capability surface"
    ],
    "postconditions": [
      "file state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.smb.file.disconnect",
        "type": "safe_execute",
        "description": "Safely verify smb.file.disconnect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.smb.file.disconnect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for smb.file.disconnect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "smb.file.mount",
    "stable_id": "OSCO-CAP-0278",
    "name": "Mount File",
    "description": "Mount a remote SMB share locally, enabling file access across Windows network shares including administrative shares.",
    "category": "network",
    "domain": "smb",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "smb.file.mount"
    ],
    "preconditions": [
      "provider exposes smb capability surface"
    ],
    "postconditions": [
      "file state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.smb.file.mount",
        "type": "safe_execute",
        "description": "Safely verify smb.file.mount with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.smb.file.mount",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for smb.file.mount"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1021.002",
        "external_name": "Remote Services: SMB/Windows Admin Shares",
        "relation": "maps_to",
        "confidence": 0.85
      }
    ]
  },
  {
    "capability_id": "smb.file.read",
    "stable_id": "OSCO-CAP-0279",
    "name": "Read File",
    "description": "Perform read operation on file in the smb domain.",
    "category": "network",
    "domain": "smb",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "smb.file.read"
    ],
    "preconditions": [
      "provider exposes smb capability surface"
    ],
    "postconditions": [
      "file state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.smb.file.read",
        "type": "safe_execute",
        "description": "Safely verify smb.file.read with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.smb.file.read",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for smb.file.read"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1039",
        "external_name": "Data from Network Shared Drive",
        "relation": "maps_to",
        "confidence": 0.8
      }
    ]
  },
  {
    "capability_id": "telemetry.collector.disable",
    "stable_id": "OSCO-CAP-0280",
    "name": "Disable Collector",
    "description": "Perform disable operation on collector in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.collector.disable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.collector.disable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.collector.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.collector.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.collector.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.collector.enable",
    "stable_id": "OSCO-CAP-0281",
    "name": "Enable Collector",
    "description": "Perform enable operation on collector in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.collector.enable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.collector.enable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.collector.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.collector.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.collector.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.collector.query",
    "stable_id": "OSCO-CAP-0282",
    "name": "Query Collector",
    "description": "Perform query operation on collector in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.collector.query"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.collector.query",
        "type": "safe_execute",
        "description": "Safely verify telemetry.collector.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.collector.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.collector.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.collector.route",
    "stable_id": "OSCO-CAP-0283",
    "name": "Route Collector",
    "description": "Perform route operation on collector in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.collector.route"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.collector.route",
        "type": "safe_execute",
        "description": "Safely verify telemetry.collector.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.collector.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.collector.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.collector.transform",
    "stable_id": "OSCO-CAP-0284",
    "name": "Transform Collector",
    "description": "Perform transform operation on collector in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.collector.transform"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "collector state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.collector.transform",
        "type": "safe_execute",
        "description": "Safely verify telemetry.collector.transform with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.collector.transform",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.collector.transform"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.pipeline.disable",
    "stable_id": "OSCO-CAP-0285",
    "name": "Disable Pipeline",
    "description": "Perform disable operation on pipeline in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.pipeline.disable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.pipeline.disable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.pipeline.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.pipeline.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.pipeline.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.pipeline.enable",
    "stable_id": "OSCO-CAP-0286",
    "name": "Enable Pipeline",
    "description": "Perform enable operation on pipeline in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.pipeline.enable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.pipeline.enable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.pipeline.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.pipeline.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.pipeline.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.pipeline.query",
    "stable_id": "OSCO-CAP-0287",
    "name": "Query Pipeline",
    "description": "Perform query operation on pipeline in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.pipeline.query"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.pipeline.query",
        "type": "safe_execute",
        "description": "Safely verify telemetry.pipeline.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.pipeline.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.pipeline.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.pipeline.route",
    "stable_id": "OSCO-CAP-0288",
    "name": "Route Pipeline",
    "description": "Perform route operation on pipeline in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.pipeline.route"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.pipeline.route",
        "type": "safe_execute",
        "description": "Safely verify telemetry.pipeline.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.pipeline.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.pipeline.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.pipeline.transform",
    "stable_id": "OSCO-CAP-0289",
    "name": "Transform Pipeline",
    "description": "Perform transform operation on pipeline in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.pipeline.transform"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "pipeline state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.pipeline.transform",
        "type": "safe_execute",
        "description": "Safely verify telemetry.pipeline.transform with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.pipeline.transform",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.pipeline.transform"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.sink.disable",
    "stable_id": "OSCO-CAP-0290",
    "name": "Disable Sink",
    "description": "Perform disable operation on sink in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.sink.disable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.sink.disable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.sink.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.sink.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.sink.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.sink.enable",
    "stable_id": "OSCO-CAP-0291",
    "name": "Enable Sink",
    "description": "Perform enable operation on sink in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.sink.enable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.sink.enable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.sink.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.sink.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.sink.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.sink.query",
    "stable_id": "OSCO-CAP-0292",
    "name": "Query Sink",
    "description": "Perform query operation on sink in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.sink.query"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.sink.query",
        "type": "safe_execute",
        "description": "Safely verify telemetry.sink.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.sink.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.sink.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.sink.route",
    "stable_id": "OSCO-CAP-0293",
    "name": "Route Sink",
    "description": "Perform route operation on sink in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.sink.route"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.sink.route",
        "type": "safe_execute",
        "description": "Safely verify telemetry.sink.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.sink.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.sink.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.sink.transform",
    "stable_id": "OSCO-CAP-0294",
    "name": "Transform Sink",
    "description": "Perform transform operation on sink in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.sink.transform"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "sink state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.sink.transform",
        "type": "safe_execute",
        "description": "Safely verify telemetry.sink.transform with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.sink.transform",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.sink.transform"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.stream.disable",
    "stable_id": "OSCO-CAP-0295",
    "name": "Disable Stream",
    "description": "Perform disable operation on stream in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.stream.disable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "stream state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.stream.disable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.stream.disable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.stream.disable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.stream.disable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.stream.enable",
    "stable_id": "OSCO-CAP-0296",
    "name": "Enable Stream",
    "description": "Perform enable operation on stream in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.stream.enable"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "stream state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.stream.enable",
        "type": "safe_execute",
        "description": "Safely verify telemetry.stream.enable with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.stream.enable",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.stream.enable"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.stream.query",
    "stable_id": "OSCO-CAP-0297",
    "name": "Query Stream",
    "description": "Perform query operation on stream in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.stream.query"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "stream state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.stream.query",
        "type": "safe_execute",
        "description": "Safely verify telemetry.stream.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.stream.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.stream.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.stream.route",
    "stable_id": "OSCO-CAP-0298",
    "name": "Route Stream",
    "description": "Perform route operation on stream in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.stream.route"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "stream state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.stream.route",
        "type": "safe_execute",
        "description": "Safely verify telemetry.stream.route with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.stream.route",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.stream.route"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "telemetry.stream.transform",
    "stable_id": "OSCO-CAP-0299",
    "name": "Transform Stream",
    "description": "Perform transform operation on stream in the telemetry domain.",
    "category": "telemetry",
    "domain": "telemetry",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "safe",
    "required_privileges": [
      "telemetry.stream.transform"
    ],
    "preconditions": [
      "provider exposes telemetry capability surface"
    ],
    "postconditions": [
      "stream state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.telemetry.stream.transform",
        "type": "safe_execute",
        "description": "Safely verify telemetry.stream.transform with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.telemetry.stream.transform",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for telemetry.stream.transform"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "thread.context.create",
    "stable_id": "OSCO-CAP-0300",
    "name": "Create Context",
    "description": "Perform create operation on context in the thread domain.",
    "category": "endpoint",
    "domain": "thread",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "thread.context.create"
    ],
    "preconditions": [
      "provider exposes thread capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.thread.context.create",
        "type": "safe_execute",
        "description": "Safely verify thread.context.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.thread.context.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for thread.context.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "thread.context.inject",
    "stable_id": "OSCO-CAP-0301",
    "name": "Inject Context",
    "description": "Perform inject operation on context in the thread domain.",
    "category": "endpoint",
    "domain": "thread",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "thread.context.inject"
    ],
    "preconditions": [
      "provider exposes thread capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.thread.context.inject",
        "type": "safe_execute",
        "description": "Safely verify thread.context.inject with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.thread.context.inject",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for thread.context.inject"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "thread.context.inspect",
    "stable_id": "OSCO-CAP-0302",
    "name": "Inspect Context",
    "description": "Perform inspect operation on context in the thread domain.",
    "category": "endpoint",
    "domain": "thread",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "thread.context.inspect"
    ],
    "preconditions": [
      "provider exposes thread capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.thread.context.inspect",
        "type": "safe_execute",
        "description": "Safely verify thread.context.inspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.thread.context.inspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for thread.context.inspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "thread.context.resume",
    "stable_id": "OSCO-CAP-0303",
    "name": "Resume Context",
    "description": "Perform resume operation on context in the thread domain.",
    "category": "endpoint",
    "domain": "thread",
    "platforms": [
      "windows",
      "linux",
      "macos"
    ],
    "providers": [
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "thread.context.resume"
    ],
    "preconditions": [
      "provider exposes thread capability surface"
    ],
    "postconditions": [
      "context state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.thread.context.resume",
        "type": "safe_execute",
        "description": "Safely verify thread.context.resume with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.thread.context.resume",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for thread.context.resume"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "token.access_token.exchange",
    "stable_id": "OSCO-CAP-0304",
    "name": "Exchange Access Token",
    "description": "Perform exchange operation on access token in the token domain.",
    "category": "identity",
    "domain": "token",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "token.access_token.exchange"
    ],
    "preconditions": [
      "provider exposes token capability surface"
    ],
    "postconditions": [
      "access token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.token.access_token.exchange",
        "type": "safe_execute",
        "description": "Safely verify token.access_token.exchange with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.token.access_token.exchange",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for token.access_token.exchange"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "token.access_token.introspect",
    "stable_id": "OSCO-CAP-0305",
    "name": "Introspect Access Token",
    "description": "Perform introspect operation on access token in the token domain.",
    "category": "identity",
    "domain": "token",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "token.access_token.introspect"
    ],
    "preconditions": [
      "provider exposes token capability surface"
    ],
    "postconditions": [
      "access token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.token.access_token.introspect",
        "type": "safe_execute",
        "description": "Safely verify token.access_token.introspect with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.token.access_token.introspect",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for token.access_token.introspect"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "token.access_token.issue",
    "stable_id": "OSCO-CAP-0306",
    "name": "Issue Access Token",
    "description": "Perform issue operation on access token in the token domain.",
    "category": "identity",
    "domain": "token",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "token.access_token.issue"
    ],
    "preconditions": [
      "provider exposes token capability surface"
    ],
    "postconditions": [
      "access token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.token.access_token.issue",
        "type": "safe_execute",
        "description": "Safely verify token.access_token.issue with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.token.access_token.issue",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for token.access_token.issue"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1134.001",
        "external_name": "Access Token Manipulation: Token Impersonation/Theft",
        "relation": "enables",
        "confidence": 0.72
      }
    ]
  },
  {
    "capability_id": "token.access_token.revoke",
    "stable_id": "OSCO-CAP-0307",
    "name": "Revoke Access Token",
    "description": "Perform revoke operation on access token in the token domain.",
    "category": "identity",
    "domain": "token",
    "platforms": [
      "identity",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp",
      "provider.github",
      "provider.google_workspace",
      "provider.microsoft365",
      "provider.okta"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "token.access_token.revoke"
    ],
    "preconditions": [
      "provider exposes token capability surface"
    ],
    "postconditions": [
      "access token state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.token.access_token.revoke",
        "type": "safe_execute",
        "description": "Safely verify token.access_token.revoke with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.token.access_token.revoke",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for token.access_token.revoke"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "validation.atomic.cleanup",
    "stable_id": "OSCO-CAP-0308",
    "name": "Cleanup Atomic",
    "description": "Perform cleanup operation on atomic in the validation domain.",
    "category": "validation",
    "domain": "validation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "validation.atomic.cleanup"
    ],
    "preconditions": [
      "provider exposes validation capability surface"
    ],
    "postconditions": [
      "atomic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.validation.atomic.cleanup",
        "type": "safe_execute",
        "description": "Safely verify validation.atomic.cleanup with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.validation.atomic.cleanup",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for validation.atomic.cleanup"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "validation.atomic.execute",
    "stable_id": "OSCO-CAP-0309",
    "name": "Execute Atomic",
    "description": "Perform execute operation on atomic in the validation domain.",
    "category": "validation",
    "domain": "validation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "validation.atomic.execute"
    ],
    "preconditions": [
      "provider exposes validation capability surface"
    ],
    "postconditions": [
      "atomic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.validation.atomic.execute",
        "type": "safe_execute",
        "description": "Safely verify validation.atomic.execute with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.validation.atomic.execute",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for validation.atomic.execute"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "validation.atomic.measure",
    "stable_id": "OSCO-CAP-0310",
    "name": "Measure Atomic",
    "description": "Perform measure operation on atomic in the validation domain.",
    "category": "validation",
    "domain": "validation",
    "platforms": [
      "cross_platform",
      "cloud",
      "saas"
    ],
    "providers": [
      "provider.github",
      "provider.kubernetes",
      "provider.linux",
      "provider.macos",
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "validation.atomic.measure"
    ],
    "preconditions": [
      "provider exposes validation capability surface"
    ],
    "postconditions": [
      "atomic state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.validation.atomic.measure",
        "type": "safe_execute",
        "description": "Safely verify validation.atomic.measure with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.validation.atomic.measure",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for validation.atomic.measure"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "validation.persistence.endpoint.validate",
    "stable_id": "OSCO-CAP-0311",
    "name": "Validate Endpoint Persistence",
    "description": "Run safe endpoint persistence validation workflows.",
    "category": "validation",
    "domain": "validation",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cross_platform"
    ],
    "providers": [
      "provider.windows",
      "provider.linux",
      "provider.macos"
    ],
    "status": "stable",
    "confidence": 0.9,
    "safety": "caution",
    "verification_methods": [
      {
        "method_id": "verify.atomic.persistence",
        "type": "atomic_test",
        "description": "Execute safe atomic persistence checks",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "mappings": [
      {
        "framework": "atomic_red_team",
        "external_id": "T1053.005",
        "external_name": "Scheduled Task",
        "relation": "validates",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "virtualization.hypervisor.clone",
    "stable_id": "OSCO-CAP-0312",
    "name": "Clone Hypervisor",
    "description": "Perform clone operation on hypervisor in the virtualization domain.",
    "category": "cloud",
    "domain": "virtualization",
    "platforms": [
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "virtualization.hypervisor.clone"
    ],
    "preconditions": [
      "provider exposes virtualization capability surface"
    ],
    "postconditions": [
      "hypervisor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.virtualization.hypervisor.clone",
        "type": "safe_execute",
        "description": "Safely verify virtualization.hypervisor.clone with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.virtualization.hypervisor.clone",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for virtualization.hypervisor.clone"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "virtualization.hypervisor.create",
    "stable_id": "OSCO-CAP-0313",
    "name": "Create Hypervisor",
    "description": "Perform create operation on hypervisor in the virtualization domain.",
    "category": "cloud",
    "domain": "virtualization",
    "platforms": [
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "virtualization.hypervisor.create"
    ],
    "preconditions": [
      "provider exposes virtualization capability surface"
    ],
    "postconditions": [
      "hypervisor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.virtualization.hypervisor.create",
        "type": "safe_execute",
        "description": "Safely verify virtualization.hypervisor.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.virtualization.hypervisor.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for virtualization.hypervisor.create"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "virtualization.hypervisor.delete",
    "stable_id": "OSCO-CAP-0314",
    "name": "Delete Hypervisor",
    "description": "Perform delete operation on hypervisor in the virtualization domain.",
    "category": "cloud",
    "domain": "virtualization",
    "platforms": [
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "virtualization.hypervisor.delete"
    ],
    "preconditions": [
      "provider exposes virtualization capability surface"
    ],
    "postconditions": [
      "hypervisor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.virtualization.hypervisor.delete",
        "type": "safe_execute",
        "description": "Safely verify virtualization.hypervisor.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.virtualization.hypervisor.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for virtualization.hypervisor.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "virtualization.hypervisor.start",
    "stable_id": "OSCO-CAP-0315",
    "name": "Start Hypervisor",
    "description": "Perform start operation on hypervisor in the virtualization domain.",
    "category": "cloud",
    "domain": "virtualization",
    "platforms": [
      "cloud",
      "container"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "virtualization.hypervisor.start"
    ],
    "preconditions": [
      "provider exposes virtualization capability surface"
    ],
    "postconditions": [
      "hypervisor state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.virtualization.hypervisor.start",
        "type": "safe_execute",
        "description": "Safely verify virtualization.hypervisor.start with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.virtualization.hypervisor.start",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for virtualization.hypervisor.start"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "windows.task.create",
    "stable_id": "OSCO-CAP-0316",
    "name": "Create Scheduled Task",
    "description": "Create a Windows scheduled task.",
    "category": "endpoint",
    "domain": "scheduled_task",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "status": "stable",
    "confidence": 0.97,
    "safety": "caution",
    "parent_capability": "persistence.maintain",
    "required_privileges": [
      "task_scheduler_write"
    ],
    "inputs": [
      "name",
      "trigger",
      "action"
    ],
    "outputs": [
      "task_id"
    ],
    "discovery_methods": [
      {
        "method_id": "discover.tasks.api",
        "type": "api",
        "state": "verified",
        "description": "Enumerate task scheduler API and cmdlets"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1053.005",
        "external_name": "Scheduled Task/Job: Scheduled Task",
        "confidence": 0.98
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1053.005",
        "external_name": "Scheduled Task",
        "relation": "validates",
        "confidence": 0.94
      }
    ]
  },
  {
    "capability_id": "wmi.class.create",
    "stable_id": "OSCO-CAP-0317",
    "name": "Create Class",
    "description": "Create a WMI class, which can be used to store attacker data or establish WMI event subscription persistence.",
    "category": "endpoint",
    "domain": "wmi",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "wmi.class.create"
    ],
    "preconditions": [
      "provider exposes wmi capability surface"
    ],
    "postconditions": [
      "class state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.wmi.class.create",
        "type": "safe_execute",
        "description": "Safely verify wmi.class.create with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.wmi.class.create",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for wmi.class.create"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1546.003",
        "external_name": "Event Triggered Execution: WMI Event Subscription",
        "relation": "enables",
        "confidence": 0.7
      }
    ]
  },
  {
    "capability_id": "wmi.class.delete",
    "stable_id": "OSCO-CAP-0318",
    "name": "Delete Class",
    "description": "Perform delete operation on class in the wmi domain.",
    "category": "endpoint",
    "domain": "wmi",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "wmi.class.delete"
    ],
    "preconditions": [
      "provider exposes wmi capability surface"
    ],
    "postconditions": [
      "class state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.wmi.class.delete",
        "type": "safe_execute",
        "description": "Safely verify wmi.class.delete with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.wmi.class.delete",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for wmi.class.delete"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "wmi.class.modify",
    "stable_id": "OSCO-CAP-0319",
    "name": "Modify Class",
    "description": "Perform modify operation on class in the wmi domain.",
    "category": "endpoint",
    "domain": "wmi",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "wmi.class.modify"
    ],
    "preconditions": [
      "provider exposes wmi capability surface"
    ],
    "postconditions": [
      "class state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.wmi.class.modify",
        "type": "safe_execute",
        "description": "Safely verify wmi.class.modify with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.wmi.class.modify",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for wmi.class.modify"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "wmi.class.query",
    "stable_id": "OSCO-CAP-0320",
    "name": "Query Class",
    "description": "Perform query operation on class in the wmi domain.",
    "category": "endpoint",
    "domain": "wmi",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.86,
    "safety": "caution",
    "required_privileges": [
      "wmi.class.query"
    ],
    "preconditions": [
      "provider exposes wmi capability surface"
    ],
    "postconditions": [
      "class state may change based on action"
    ],
    "inputs": [
      "target",
      "context"
    ],
    "outputs": [
      "result"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.wmi.class.query",
        "type": "safe_execute",
        "description": "Safely verify wmi.class.query with dry run and cleanup support",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.wmi.class.query",
        "type": "declared",
        "state": "declared",
        "description": "Discover declared support for wmi.class.query"
      }
    ],
    "mappings": []
  },
  {
    "capability_id": "process.lsass.access",
    "stable_id": "OSCO-CAP-0321",
    "name": "Access LSASS Process Memory",
    "description": "Open a handle to the LSASS process (Local Security Authority Subsystem Service) and read its memory to extract Kerberos tickets, NTLM hashes, and plaintext credentials cached by WDigest. This is the most common credential dumping technique and a high-fidelity indicator of credential access activity.",
    "category": "credential_access",
    "domain": "process",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.98,
    "safety": "caution",
    "required_privileges": [
      "SeDebugPrivilege"
    ],
    "preconditions": [
      "LSASS process is running",
      "caller has SeDebugPrivilege or SYSTEM context"
    ],
    "postconditions": [
      "process handle to lsass.exe",
      "memory dump of credential material"
    ],
    "inputs": [
      "target_pid"
    ],
    "outputs": [
      "credential_material",
      "memory_dump"
    ],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.process.lsass.access",
        "type": "safe_execute",
        "description": "Verify LSASS access detection via handle open without memory read",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": false,
        "supports_rollback": false
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.lsass.access",
        "type": "api",
        "state": "verified",
        "description": "Enumerate LSASS process handles via Process Explorer or Get-Process",
        "query": "Get-Process lsass | Select-Object Id, HandleCount"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1003.001",
        "external_name": "OS Credential Dumping: LSASS Memory",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_lsass_access_non_system_account",
        "external_name": "LSASS Access from Non-SYSTEM Account",
        "relation": "detected_by",
        "confidence": 0.92
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1003.001",
        "external_name": "LSASS Memory Credential Dump",
        "relation": "validated_by",
        "confidence": 0.95
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.Memory.Acquisition",
        "external_name": "Memory Acquisition Artifact",
        "relation": "collected_by",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "windows.vss.delete",
    "stable_id": "OSCO-CAP-0322",
    "name": "Delete Volume Shadow Copies",
    "description": "Delete Windows Volume Shadow Copies (VSS) via vssadmin, wmic, or PowerShell, preventing system restore and backup recovery after ransomware deployment. Shadow copy deletion is a near-universal pre-ransomware step and a high-confidence indicator of destructive intent.",
    "category": "impact",
    "domain": "windows",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.98,
    "safety": "destructive",
    "required_privileges": [
      "Administrator",
      "SYSTEM"
    ],
    "preconditions": [
      "volume shadow copies exist",
      "administrator context"
    ],
    "postconditions": [
      "shadow copies deleted",
      "backup recovery paths removed"
    ],
    "inputs": [
      "volume"
    ],
    "outputs": [],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.windows.vss.delete",
        "type": "safe_execute",
        "description": "Verify VSS enumeration without deletion (list-only mode)",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": false,
        "supports_rollback": false
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.windows.vss",
        "type": "api",
        "state": "verified",
        "description": "Enumerate existing volume shadow copies",
        "query": "vssadmin list shadows"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1490",
        "external_name": "Inhibit System Recovery",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_vssadmin_delete_shadows",
        "external_name": "Shadow Copies Deletion Using OS Utilities",
        "relation": "detected_by",
        "confidence": 0.95
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1490",
        "external_name": "Inhibit System Recovery - Delete Shadow Copies",
        "relation": "validated_by",
        "confidence": 0.95
      }
    ]
  },
  {
    "capability_id": "windows.defender.disable",
    "stable_id": "OSCO-CAP-0323",
    "name": "Disable Windows Defender",
    "description": "Disable Windows Defender real-time protection, tamper protection, or cloud-delivered protection via PowerShell (Set-MpPreference), registry keys, or Group Policy. Disabling AV is a near-universal pre-ransomware and post-exploitation step. Often combined with exclusion path additions.",
    "category": "defense_evasion",
    "domain": "windows",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.98,
    "safety": "caution",
    "required_privileges": [
      "Administrator",
      "SYSTEM"
    ],
    "preconditions": [
      "Windows Defender enabled",
      "administrator privileges"
    ],
    "postconditions": [
      "real-time protection disabled",
      "detection gap created"
    ],
    "inputs": [],
    "outputs": [],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.windows.defender.disable",
        "type": "safe_execute",
        "description": "Verify Defender status query without modification",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.windows.defender.status",
        "type": "api",
        "state": "verified",
        "description": "Query Windows Defender real-time protection status",
        "query": "Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, TamperProtectionSource"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.001",
        "external_name": "Impair Defenses: Disable or Modify Tools",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_disable_defender",
        "external_name": "Suspicious Windows Defender Disabled via Registry",
        "relation": "detected_by",
        "confidence": 0.92
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1562.001",
        "external_name": "Disable or Modify Tools",
        "relation": "validated_by",
        "confidence": 0.92
      }
    ]
  },
  {
    "capability_id": "registry.run.persist",
    "stable_id": "OSCO-CAP-0324",
    "name": "Persist via Registry Run Keys",
    "description": "Write to HKLM or HKCU Run/RunOnce registry keys to achieve user-logon or system-boot persistence. Registry run keys are one of the most common and oldest persistence mechanisms on Windows. Keys: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    "category": "persistence",
    "domain": "registry",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.98,
    "safety": "caution",
    "required_privileges": [
      "User (HKCU)",
      "Administrator (HKLM)"
    ],
    "preconditions": [
      "registry writable"
    ],
    "postconditions": [
      "payload executes on next logon or boot"
    ],
    "inputs": [
      "registry_path",
      "value_name",
      "payload_path"
    ],
    "outputs": [],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.registry.run.persist",
        "type": "safe_execute",
        "description": "Verify run key write and validate detection; rollback on cleanup",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.registry.run.keys",
        "type": "api",
        "state": "verified",
        "description": "Enumerate registry run keys for persistence entries",
        "query": "reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1547.001",
        "external_name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_registry_persistence_run_key",
        "external_name": "Registry Persistence via Run Keys",
        "relation": "detected_by",
        "confidence": 0.92
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1547.001",
        "external_name": "Registry Run Keys Persistence",
        "relation": "validated_by",
        "confidence": 0.95
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.Registry.RunKeys",
        "external_name": "Registry Run Keys Artifact",
        "relation": "discovered_by",
        "confidence": 0.95
      }
    ]
  },
  {
    "capability_id": "wmi.subscription.create",
    "stable_id": "OSCO-CAP-0325",
    "name": "Create WMI Event Subscription",
    "description": "Create a permanent WMI event subscription (EventFilter + EventConsumer + FilterToConsumerBinding) for fileless persistence. WMI subscriptions survive reboots and are stored in the WMI repository, not the file system. Commonly used by sophisticated actors for long-term stealthy persistence.",
    "category": "persistence",
    "domain": "wmi",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.97,
    "safety": "caution",
    "required_privileges": [
      "Administrator",
      "SYSTEM"
    ],
    "preconditions": [
      "WMI service running",
      "administrator privileges"
    ],
    "postconditions": [
      "subscription active in WMI repository",
      "payload executes on trigger event"
    ],
    "inputs": [
      "event_filter_query",
      "consumer_script",
      "binding_name"
    ],
    "outputs": [],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.wmi.subscription.create",
        "type": "safe_execute",
        "description": "Create test WMI subscription and verify detection; cleanup removes subscription",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.wmi.subscription",
        "type": "api",
        "state": "verified",
        "description": "Enumerate WMI permanent event subscriptions",
        "query": "Get-WMIObject -Namespace root\\subscription -Class __EventFilter"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1546.003",
        "external_name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
        "relation": "maps_to",
        "confidence": 0.97
      },
      {
        "framework": "sigma",
        "external_id": "win_wmi_persistence",
        "external_name": "WMI Persistence",
        "relation": "detected_by",
        "confidence": 0.9
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1546.003",
        "external_name": "WMI Event Subscription Persistence",
        "relation": "validated_by",
        "confidence": 0.92
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.Persistence.PermanentWMIEvents",
        "external_name": "Permanent WMI Events",
        "relation": "discovered_by",
        "confidence": 0.92
      }
    ]
  },
  {
    "capability_id": "process.injection.dll",
    "stable_id": "OSCO-CAP-0326",
    "name": "DLL Injection",
    "description": "Inject a DLL into a remote process by writing the DLL path into the target process memory and calling CreateRemoteThread with LoadLibrary as the start address. DLL injection is a classic code injection technique used for defense evasion, persistence, and privilege escalation.",
    "category": "defense_evasion",
    "domain": "process",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.95,
    "safety": "caution",
    "required_privileges": [
      "SeDebugPrivilege or matching process owner"
    ],
    "preconditions": [
      "target process running",
      "DLL available on disk"
    ],
    "postconditions": [
      "DLL loaded in target process address space",
      "attacker code executing in target context"
    ],
    "inputs": [
      "target_pid",
      "dll_path"
    ],
    "outputs": [],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.process.injection.dll",
        "type": "safe_execute",
        "description": "Verify DLL injection detection via benign test DLL in isolated process",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": false,
        "supports_rollback": false
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.injection.dll",
        "type": "api",
        "state": "verified",
        "description": "Enumerate loaded modules in running processes to detect injected DLLs",
        "query": "Get-Process | ForEach-Object { $_.Modules } | Where-Object { $_.FileName -notlike 'C:\\Windows\\*' }"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1055.001",
        "external_name": "Process Injection: Dynamic-link Library Injection",
        "relation": "maps_to",
        "confidence": 0.97
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_createremotethread",
        "external_name": "CreateRemoteThread API Call in Suspicious Context",
        "relation": "detected_by",
        "confidence": 0.82
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1055.001",
        "external_name": "DLL Injection",
        "relation": "validated_by",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "process.injection.hollow",
    "stable_id": "OSCO-CAP-0327",
    "name": "Process Hollowing",
    "description": "Create a legitimate process in a suspended state, unmap its original executable memory, write attacker-controlled payload into the process address space, and resume execution. Process hollowing allows attacker code to execute under a legitimate process identity, evading process-based detections.",
    "category": "defense_evasion",
    "domain": "process",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.95,
    "safety": "caution",
    "required_privileges": [
      "User"
    ],
    "preconditions": [
      "host process binary accessible"
    ],
    "postconditions": [
      "payload running under hollowed process identity"
    ],
    "inputs": [
      "host_process_path",
      "payload"
    ],
    "outputs": [],
    "cleanup_supported": false,
    "verification_methods": [
      {
        "method_id": "verify.process.injection.hollow",
        "type": "safe_execute",
        "description": "Verify process hollowing detection via known benign payload",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": false,
        "supports_rollback": false
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.process.hollow",
        "type": "api",
        "state": "verified",
        "description": "Detect hollowed processes by comparing on-disk PE with in-memory image",
        "query": "Compare-MemoryAndDiskPE -ProcessName svchost.exe"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1055.012",
        "external_name": "Process Injection: Process Hollowing",
        "relation": "maps_to",
        "confidence": 0.97
      },
      {
        "framework": "sigma",
        "external_id": "win_process_hollow",
        "external_name": "Hollow Process Creation Indicators",
        "relation": "detected_by",
        "confidence": 0.78
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1055.012",
        "external_name": "Process Hollowing",
        "relation": "validated_by",
        "confidence": 0.9
      }
    ]
  },
  {
    "capability_id": "windows.amsi.bypass",
    "stable_id": "OSCO-CAP-0328",
    "name": "Bypass AMSI",
    "description": "Bypass the Antimalware Scan Interface (AMSI) by patching the AmsiScanBuffer function in amsi.dll, loading a null AMSI provider, or corrupting the AMSI context in memory. AMSI bypass is a prerequisite for many in-memory script-based attacks and PowerShell post-exploitation frameworks.",
    "category": "defense_evasion",
    "domain": "windows",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.95,
    "safety": "caution",
    "required_privileges": [
      "User"
    ],
    "preconditions": [
      "PowerShell or .NET runtime running",
      "AMSI enabled"
    ],
    "postconditions": [
      "AMSI scanning disabled in current process",
      "malicious scripts execute unscanned"
    ],
    "inputs": [],
    "outputs": [],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.windows.amsi.bypass",
        "type": "safe_execute",
        "description": "Verify AMSI bypass detection by patching with known benign string",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.windows.amsi.bypass",
        "type": "api",
        "state": "verified",
        "description": "Check AMSI provider registration and amsi.dll integrity",
        "query": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\AMSI\\Providers'"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1562.001",
        "external_name": "Impair Defenses: Disable or Modify Tools",
        "relation": "maps_to",
        "confidence": 0.92
      },
      {
        "framework": "sigma",
        "external_id": "win_amsi_bypass",
        "external_name": "AMSI Bypass Pattern in PowerShell",
        "relation": "detected_by",
        "confidence": 0.88
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1562.001",
        "external_name": "AMSI Bypass Techniques",
        "relation": "validated_by",
        "confidence": 0.88
      }
    ]
  },
  {
    "capability_id": "network.proxy.tunnel",
    "stable_id": "OSCO-CAP-0329",
    "name": "Establish Network Proxy Tunnel",
    "description": "Establish a proxy or tunnel for command-and-control traffic to route through intermediate hosts, bypass network controls, or obfuscate the true C2 destination. Includes SOCKS proxies, SSH tunnels, DNS-over-HTTPS tunneling, and multi-hop proxy chains.",
    "category": "command_and_control",
    "domain": "network",
    "platforms": [
      "windows",
      "linux",
      "macos",
      "cloud"
    ],
    "providers": [
      "provider.windows",
      "provider.linux",
      "provider.macos"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.88,
    "safety": "caution",
    "required_privileges": [
      "User"
    ],
    "preconditions": [
      "network access available",
      "proxy/tunnel binary or capability available"
    ],
    "postconditions": [
      "C2 traffic obfuscated or relayed through proxy"
    ],
    "inputs": [
      "proxy_host",
      "proxy_port",
      "tunnel_type"
    ],
    "outputs": [
      "proxy_endpoint"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.network.proxy.tunnel",
        "type": "safe_execute",
        "description": "Verify proxy tunnel establishment detection in isolated network",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.network.proxy",
        "type": "api",
        "state": "verified",
        "description": "Query configured proxy settings and active network connections",
        "query": "netsh winhttp show proxy"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1090",
        "external_name": "Proxy",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1090.003",
        "external_name": "Proxy: Multi-hop Proxy",
        "relation": "maps_to",
        "confidence": 0.82
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_proxy_settings",
        "external_name": "Suspicious Proxy Settings Change",
        "relation": "detected_by",
        "confidence": 0.78
      }
    ]
  },
  {
    "capability_id": "windows.service.create",
    "stable_id": "OSCO-CAP-0330",
    "name": "Create Windows Service for Persistence",
    "description": "Create a Windows service via sc.exe, New-Service, or the Service Control Manager API to execute arbitrary binaries or commands with SYSTEM privileges on startup. Service creation is a heavily-used persistence and privilege escalation technique, and a key lateral movement vector when combined with remote service creation (PsExec-style execution).",
    "category": "persistence",
    "domain": "windows",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.97,
    "safety": "caution",
    "required_privileges": [
      "Administrator"
    ],
    "preconditions": [
      "administrator context",
      "service binary accessible"
    ],
    "postconditions": [
      "service registered",
      "payload executes as SYSTEM on next start"
    ],
    "inputs": [
      "service_name",
      "binary_path",
      "start_type"
    ],
    "outputs": [],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.windows.service.create",
        "type": "safe_execute",
        "description": "Create benign test service and verify detection; sc delete on cleanup",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.windows.services",
        "type": "api",
        "state": "verified",
        "description": "Enumerate Windows services and identify suspicious entries",
        "query": "Get-Service | Where-Object {$_.StartType -eq 'Automatic'} | Select-Object Name, DisplayName, Status"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1543.003",
        "external_name": "Create or Modify System Process: Windows Service",
        "relation": "maps_to",
        "confidence": 0.98
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_service_install",
        "external_name": "Suspicious Service Installation",
        "relation": "detected_by",
        "confidence": 0.88
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1543.003",
        "external_name": "Windows Service Creation",
        "relation": "validated_by",
        "confidence": 0.95
      },
      {
        "framework": "velociraptor",
        "external_id": "Windows.System.Services",
        "external_name": "Windows Services Artifact",
        "relation": "discovered_by",
        "confidence": 0.92
      }
    ]
  },
  {
    "capability_id": "windows.lolbin.certutil",
    "stable_id": "OSCO-CAP-0331",
    "name": "Abuse Certutil for Download or Decode",
    "description": "Abuse certutil.exe (a legitimate Windows certificate utility) to download files from remote URLs or decode Base64-encoded payloads. Certutil is a classic living-off-the-land binary (LOLBin) that bypasses application whitelisting by operating as a trusted Microsoft binary.",
    "category": "defense_evasion",
    "domain": "windows",
    "platforms": [
      "windows"
    ],
    "providers": [
      "provider.windows"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.95,
    "safety": "caution",
    "required_privileges": [
      "User"
    ],
    "preconditions": [
      "certutil.exe available (default Windows install)"
    ],
    "postconditions": [
      "payload downloaded or decoded to disk"
    ],
    "inputs": [
      "url_or_encoded_file",
      "output_path"
    ],
    "outputs": [
      "decoded_or_downloaded_file"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.windows.lolbin.certutil",
        "type": "safe_execute",
        "description": "Verify certutil decode detection using known benign Base64 test file",
        "supports_dry_run": false,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.windows.certutil",
        "type": "api",
        "state": "verified",
        "description": "Query recent certutil process executions in event logs",
        "query": "Get-WinEvent -LogName Security | Where-Object { $_.Message -like '*certutil*' }"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1140",
        "external_name": "Deobfuscate/Decode Files or Information",
        "relation": "maps_to",
        "confidence": 0.88
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1105",
        "external_name": "Ingress Tool Transfer",
        "relation": "maps_to",
        "confidence": 0.85
      },
      {
        "framework": "sigma",
        "external_id": "win_susp_certutil_encode",
        "external_name": "Certutil Encode Usage",
        "relation": "detected_by",
        "confidence": 0.92
      },
      {
        "framework": "atomic_red_team",
        "external_id": "T1140",
        "external_name": "Certutil Decode",
        "relation": "validated_by",
        "confidence": 0.92
      }
    ]
  },
  {
    "capability_id": "cloud.iam.enumerate",
    "stable_id": "OSCO-CAP-0332",
    "name": "Enumerate Cloud IAM Permissions",
    "description": "Enumerate IAM roles, policies, and effective permissions for users, service accounts, or assumed roles in a cloud environment. IAM enumeration is a critical cloud reconnaissance step to identify over-privileged identities and privilege escalation paths.",
    "category": "discovery",
    "domain": "cloud",
    "platforms": [
      "cloud"
    ],
    "providers": [
      "provider.aws",
      "provider.azure",
      "provider.gcp"
    ],
    "version": "0.1.0",
    "status": "stable",
    "confidence": 0.92,
    "safety": "safe",
    "required_privileges": [
      "iam:ListRoles",
      "iam:GetPolicy",
      "iam:SimulatePrincipalPolicy"
    ],
    "preconditions": [
      "valid cloud credentials",
      "IAM read permissions"
    ],
    "postconditions": [
      "IAM inventory collected",
      "privilege escalation paths identified"
    ],
    "inputs": [
      "account_id",
      "principal_arn"
    ],
    "outputs": [
      "iam_roles",
      "iam_policies",
      "effective_permissions"
    ],
    "cleanup_supported": true,
    "verification_methods": [
      {
        "method_id": "verify.cloud.iam.enumerate",
        "type": "safe_execute",
        "description": "Verify IAM enumeration detection via CloudTrail/audit log monitoring",
        "supports_dry_run": true,
        "supports_safe_mode": true,
        "supports_cleanup": true,
        "supports_rollback": true
      }
    ],
    "discovery_methods": [
      {
        "method_id": "discover.cloud.iam",
        "type": "api",
        "state": "verified",
        "description": "Enumerate IAM roles and policies via cloud provider API",
        "query": "aws iam list-roles --query 'Roles[*].[RoleName,Arn]' --output table"
      }
    ],
    "mappings": [
      {
        "framework": "mitre_attack",
        "external_id": "T1069.003",
        "external_name": "Permission Groups Discovery: Cloud Groups",
        "relation": "maps_to",
        "confidence": 0.85
      },
      {
        "framework": "mitre_attack",
        "external_id": "T1078.004",
        "external_name": "Valid Accounts: Cloud Accounts",
        "relation": "enables",
        "confidence": 0.78
      },
      {
        "framework": "aws_security_hub",
        "external_id": "IAM.1",
        "external_name": "IAM policies should not allow full '*' administrative privileges",
        "relation": "maps_to",
        "confidence": 0.82
      }
    ]
  }
]