Events are detected and reported, including cyber events arising from people's activity, from the network, from the physical environment and from information handling, logged in an incident knowledge base, categorised, correlated with other events, prioritised, tracked and managed to resolution; the rules, laws and policies that govern forensic evidence are identified and a process keeps evidence handling within those obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.