Security Event
A logged security occurrence — type, source, target, and risk level that enables threat detection.
Why This Object Matters for AI
AI threat detection analyzes security events; incident response depends on event visibility.
Security & Compliance Capacity Profile
Typical CMC levels for security & compliance in SaaS/Technology organizations.
CMC Dimension Scenarios
What each CMC level looks like specifically for Security Event. Baseline level is highlighted.
Security event handling is entirely reactive — someone notices a suspicious login or a customer reports an anomaly, and the response depends on which engineer is available and what they think to check first.
None — AI has no security event process definitions to follow or automate.
Document a basic security event handling process defining event classification criteria, triage responsibilities, and escalation paths for different risk levels.
A general security event handling document describes event types and escalation contacts, but actual triage varies by analyst — 'We have a runbook, but when the WAF starts firing alerts at 2 AM, people just do whatever gets it quiet.'
Can reference the process document but cannot determine whether security events are being classified and escalated according to the defined criteria.
Define structured event handling stages (detection, classification, triage, investigation, containment, resolution) with mandatory transitions and required evidence at each gate.
Structured stages exist for security event handling — detection through resolution — but correlation rules, investigation playbook requirements, and containment action criteria are not formalized per event category.
Can track security events through defined stages but cannot enforce investigation depth or containment actions because per-category requirements are not specified.
Formalize per-category investigation playbooks, correlation rule documentation, containment decision trees, and mandatory evidence collection requirements for each security event type.
Security event handling defines per-category playbooks, correlation rules, containment decision trees, and evidence requirements — brute-force attempts trigger account lockout review, data exfiltration patterns trigger network isolation assessment.
Can enforce event-specific investigation workflows, trigger appropriate containment actions, and verify evidence collection completeness for each event category.
Encode security event handling rules in machine-readable SOAR playbooks with automated classification, investigation orchestration, and containment action execution.
Machine-readable SOAR playbooks automate security event classification, investigation orchestration, and containment execution — events auto-classify by source and pattern, investigations auto-gather context, and containment actions execute with approval gates.
Can autonomously orchestrate security event response — automated classification, parallel investigation, context enrichment, and containment with human-in-the-loop for critical actions.
Deploy adaptive event handling logic that learns from analyst decisions, refines classification thresholds, and optimizes playbook selection based on resolution outcomes.
Adaptive security event handling learns continuously — classification thresholds adjust from false positive feedback, playbook selection optimizes from resolution outcomes, and new event patterns auto-generate draft playbooks from observed analyst behavior.
Can autonomously manage the full security event lifecycle — classification, investigation, containment, and resolution — adapting processes based on real-time outcome analysis.
Ceiling of the CMC framework for this dimension.
Capabilities That Depend on Security Event
Other Objects in Security & Compliance
Related business objects in the same function area.
Security Vulnerability
EntityA discovered security weakness — CVE, severity, affected systems, and remediation status.
Access Policy
RuleA permission configuration — roles, resources, conditions, and enforcement that controls access.
Compliance Control
EntityA required security measure — framework, control ID, implementation status, and evidence.
User Identity
EntityAn authenticated user record — credentials, roles, last access, and risk indicators.
What Can Your Organization Deploy?
Enter your context profile or request an assessment to see which capabilities your infrastructure supports.