{"version":"0.11.0","built_at":"2026-10-12T01:17:59.374Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","category":{"id":"TR-100.40","name":"Security Monitoring & Response","description":"Collecting security events in one place, correlating them into detections and automating the first steps of response.","aliases":["SIEM","SOAR","Security Operations"],"in_scope":["Security event collection and correlation","Detection rules","Response playbooks"],"capability_ids":["BC-760.30.10","BC-760.30.20"],"examples":["Splunk Enterprise Security","Microsoft Sentinel","Google Security Operations","Elastic Security"],"out_of_scope":[],"domain_id":"TR-100","domain":"Security & Identity","page_url":"https://catalog.mikereams.com/technology/TR-100.40","business_capabilities":[{"id":"BC-760.30.10","name":"Security Monitoring"},{"id":"BC-760.30.20","name":"Security Incident Response"}],"technology_ids":[]},"domain":{"id":"TR-100","name":"Security & Identity","description":"Proving who and what is acting, protecting systems and data, and spotting attacks early enough to stop them.","category_ids":["TR-100.10","TR-100.20","TR-100.30","TR-100.40","TR-100.50","TR-100.60","TR-100.70"],"page_url":"https://catalog.mikereams.com/technology#TR-100"},"technologies":[]}