{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-760.30","name":"Threat Detection & Response","level":2,"parent_id":"BC-760","l1_id":"BC-760","industry":"cross-industry","macro_id":"MC-70","path":["Cybersecurity","Threat Detection & Response"],"description":"Watch for attacks across the estate, respond to confirmed incidents fast enough to limit the damage, and learn enough from each one to see the next one sooner.","aliases":["Security Operations Center","SOC","Incident Response"],"in_scope":["Security monitoring and alert triage","Security incident response and containment","Threat intelligence and hunting","Forensic investigation and evidence handling"],"out_of_scope":["Technology incident management for non-security outages (see BC-740)","Crisis communications and business continuity (see BC-830)"],"csdm_note":null,"status":"active","successor_id":null,"child_ids":["BC-760.30.10","BC-760.30.20","BC-760.30.30","BC-760.30.40"]},"crosswalk":{"realized_by":[{"product_id":"PR-100","product":"ServiceNow","pc_id":"PC-100.90","pc":"Security Operations","maturity":"partial","via":null},{"product_id":"PR-140","product":"Microsoft 365","pc_id":"PC-140.90","pc":"Microsoft Defender","maturity":"partial","via":null}],"used_in":[],"patterns":[],"stacks":[],"books":[]},"ancestors":[{"id":"BC-760","name":"Cybersecurity","level":1}],"children":[{"id":"BC-760.30.10","name":"Security Monitoring","level":3,"child_count":0},{"id":"BC-760.30.20","name":"Security Incident Response","level":3,"child_count":0},{"id":"BC-760.30.30","name":"Threat Intelligence & Hunting","level":3,"child_count":0},{"id":"BC-760.30.40","name":"Digital Forensics","level":3,"child_count":0}]}