The TSF takes a defined action when it detects an event that points to a possible security violation. One component: FAU_ARP.1 Security alarms, for which the ST lists the actions taken on detection of a potential violation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.