@cdxgen/cdxgen 13.5.0 → 13.7.0

package/data/behavior-taxonomy.schema.json

@@ -0,0 +1,1491 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://cyclonedx.org/schema/behavior-taxonomy.schema.json",
+  "title": "CycloneDX Behavior Taxonomy",
+  "description": "An independent taxonomy of behaviours that describe actions performed by entities with security, privacy, safety, or operational implications. This taxonomy is maintained separately from the CycloneDX specification and may evolve at a different rate.\n The taxonomy uses a hierarchical colon-delimited naming convention with three levels: domain (e.g. security), category (e.g. security:authentication), and specific behaviour (e.g. security:authentication:authenticatesUser).\n Values at any level of the hierarchy are valid.",
+  "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
+  "enum": [
+    "ai",
+    "ai:agent",
+    "ai:agent:actsOnBehalfOfUser",
+    "ai:agent:coordinatesAgents",
+    "ai:agent:delegatesTask",
+    "ai:agent:executesAction",
+    "ai:agent:invokesTool",
+    "ai:agent:observesResult",
+    "ai:agent:plansAction",
+    "ai:agent:receivesHumanDelegation",
+    "ai:agent:reflectsOnResult",
+    "ai:agent:reportsDelegatedAction",
+    "ai:agent:requestsUserApproval",
+    "ai:agent:returnsDelegation",
+    "ai:agent:revisesPlan",
+    "ai:explainability",
+    "ai:explainability:attributesFeatures",
+    "ai:explainability:documentsModel",
+    "ai:explainability:explainsDecision",
+    "ai:explainability:tracesPrediction",
+    "ai:explainability:visualizesModel",
+    "ai:fairness",
+    "ai:fairness:auditsModelFairness",
+    "ai:fairness:calculatesFairnessMetric",
+    "ai:fairness:detectsBias",
+    "ai:fairness:handlesProtectedAttribute",
+    "ai:fairness:mitigatesBias",
+    "ai:generative",
+    "ai:generative:citesSource",
+    "ai:generative:filtersOutput",
+    "ai:generative:generatesAudio",
+    "ai:generative:generatesCode",
+    "ai:generative:generatesEmbedding",
+    "ai:generative:generatesImage",
+    "ai:generative:generatesText",
+    "ai:generative:mitigatesHallucination",
+    "ai:generative:processesPrompt",
+    "ai:generative:streamsResponse",
+    "ai:inference",
+    "ai:inference:appliesThreshold",
+    "ai:inference:batchesInference",
+    "ai:inference:cachesPrediction",
+    "ai:inference:ensemblesModels",
+    "ai:inference:generatesPrediction",
+    "ai:inference:infersInRealTime",
+    "ai:inference:ranksResults",
+    "ai:inference:scoresConfidence",
+    "ai:management",
+    "ai:management:comparesModels",
+    "ai:management:deploysModel",
+    "ai:management:loadsModel",
+    "ai:management:monitorsModel",
+    "ai:management:retiresModel",
+    "ai:management:rollsBackModel",
+    "ai:management:unloadsModel",
+    "ai:management:versionsModel",
+    "ai:quality",
+    "ai:quality:detectsConceptDrift",
+    "ai:quality:detectsDataDrift",
+    "ai:quality:detectsOutlier",
+    "ai:quality:engineersFeatures",
+    "ai:quality:selectsFeatures",
+    "ai:quality:validatesInputData",
+    "ai:robustness",
+    "ai:robustness:defendsAgainstAdversarial",
+    "ai:robustness:detectsAdversarialInput",
+    "ai:robustness:detectsOutOfDistribution",
+    "ai:robustness:estimatesUncertainty",
+    "ai:robustness:validatesRobustness",
+    "ai:training",
+    "ai:training:appliesTransferLearning",
+    "ai:training:checkpointsModel",
+    "ai:training:fineTunesModel",
+    "ai:training:ingestsTrainingData",
+    "ai:training:preprocessesTrainingData",
+    "ai:training:trainsFederatedly",
+    "ai:training:trainsModel",
+    "ai:training:tunesHyperparameters",
+    "ai:training:validatesModel",
+    "ai:training:validatesTrainingData",
+    "application",
+    "application:codeExecution",
+    "application:codeExecution:compilesCode",
+    "application:codeExecution:evaluatesExpression",
+    "application:codeExecution:executesNativeCommand",
+    "application:codeExecution:executesScript",
+    "application:codeExecution:interpretsCode",
+    "application:codeExecution:invokesViaReflection",
+    "application:codeExecution:loadsCodeDynamically",
+    "application:configuration",
+    "application:configuration:detectsEnvironment",
+    "application:configuration:evaluatesFeatureFlag",
+    "application:configuration:loadsConfiguration",
+    "application:configuration:reloadsConfiguration",
+    "application:controlFlow",
+    "application:controlFlow:awaitsAsyncResult",
+    "application:controlFlow:catchesException",
+    "application:controlFlow:emitsEvent",
+    "application:controlFlow:handlesEvent",
+    "application:controlFlow:invokesCallback",
+    "application:controlFlow:invokesHandler",
+    "application:controlFlow:invokesMiddleware",
+    "application:controlFlow:schedulesAsyncOperation",
+    "application:controlFlow:throwsException",
+    "application:dependencyManagement",
+    "application:dependencyManagement:closesCircuitBreaker",
+    "application:dependencyManagement:fallsBack",
+    "application:dependencyManagement:injectsDependency",
+    "application:dependencyManagement:opensCircuitBreaker",
+    "application:dependencyManagement:resolvesDependency",
+    "application:externalIntegration",
+    "application:externalIntegration:callsExternalService",
+    "application:externalIntegration:consumesEvent",
+    "application:externalIntegration:publishesEvent",
+    "application:externalIntegration:receivesWebhook",
+    "application:observability",
+    "application:observability:emitsTelemetry",
+    "application:observability:logsOperation",
+    "application:observability:recordsMetric",
+    "application:observability:reportsHealth",
+    "application:observability:tracesRequest",
+    "application:requestHandling",
+    "application:requestHandling:authenticatesRequest",
+    "application:requestHandling:authorizesRequest",
+    "application:requestHandling:bindsParameters",
+    "application:requestHandling:parsesRequest",
+    "application:requestHandling:receivesHttpRequest",
+    "application:requestHandling:rejectsRequest",
+    "application:requestHandling:routesRequest",
+    "application:requestHandling:validatesRequest",
+    "application:responseGeneration",
+    "application:responseGeneration:generatesResponse",
+    "application:responseGeneration:readsCookie",
+    "application:responseGeneration:redirectsRequest",
+    "application:responseGeneration:returnsError",
+    "application:responseGeneration:returnsSuccess",
+    "application:responseGeneration:sendsHttpResponse",
+    "application:responseGeneration:setsCookie",
+    "application:responseGeneration:setsHeader",
+    "application:stateManagement",
+    "application:stateManagement:acquiresLock",
+    "application:stateManagement:beginsTransaction",
+    "application:stateManagement:commitsTransaction",
+    "application:stateManagement:createsSessionState",
+    "application:stateManagement:destroysSessionState",
+    "application:stateManagement:readsSessionState",
+    "application:stateManagement:releasesLock",
+    "application:stateManagement:rollsBackTransaction",
+    "application:stateManagement:synchronizesState",
+    "application:stateManagement:updatesSessionState",
+    "data",
+    "data:encoding",
+    "data:encoding:appliesXor",
+    "data:encoding:decodesBaseSixtyFour",
+    "data:encoding:decodesUrl",
+    "data:encoding:encodesBaseSixtyFour",
+    "data:encoding:encodesUrl",
+    "data:ingestion",
+    "data:ingestion:pollsSource",
+    "data:ingestion:readsFile",
+    "data:ingestion:readsStream",
+    "data:ingestion:receivesInput",
+    "data:ingestion:receivesMessage",
+    "data:ingestion:receivesRequest",
+    "data:ingestion:subscribesToFeed",
+    "data:output",
+    "data:output:formatsResponse",
+    "data:output:producesOutput",
+    "data:output:publishesMessage",
+    "data:output:rendersTemplate",
+    "data:output:sendsResponse",
+    "data:output:serializesObject",
+    "data:output:streamsOutput",
+    "data:output:writesFile",
+    "data:parsing",
+    "data:parsing:decodesData",
+    "data:parsing:deserializesObject",
+    "data:parsing:extractsFields",
+    "data:parsing:parsesData",
+    "data:parsing:parsesHtml",
+    "data:parsing:parsesJson",
+    "data:parsing:parsesXml",
+    "data:query",
+    "data:query:executesLdapQuery",
+    "data:query:executesNoSqlQuery",
+    "data:query:executesSearch",
+    "data:query:executesSql",
+    "data:query:executesXPath",
+    "data:query:queriesData",
+    "data:storage",
+    "data:storage:cachesData",
+    "data:storage:deletesData",
+    "data:storage:flushesCache",
+    "data:storage:invalidatesCache",
+    "data:storage:retrievesData",
+    "data:storage:storesData",
+    "data:storage:updatesData",
+    "data:transformation",
+    "data:transformation:aggregatesData",
+    "data:transformation:compressesData",
+    "data:transformation:decompressesData",
+    "data:transformation:encodesData",
+    "data:transformation:enrichesData",
+    "data:transformation:filtersData",
+    "data:transformation:joinsData",
+    "data:transformation:mapsData",
+    "data:transformation:normalizesData",
+    "data:transformation:sortsData",
+    "data:transformation:transformsData",
+    "evasion",
+    "evasion:analysisResistance",
+    "evasion:analysisResistance:detectsAnalysisTool",
+    "evasion:analysisResistance:detectsDebugger",
+    "evasion:analysisResistance:detectsEmulator",
+    "evasion:analysisResistance:detectsSandbox",
+    "evasion:analysisResistance:detectsVirtualMachine",
+    "evasion:analysisResistance:evadesDebugger",
+    "evasion:analysisResistance:evadesEmulator",
+    "evasion:analysisResistance:evadesSandbox",
+    "evasion:analysisResistance:evadesVirtualMachine",
+    "evasion:analysisResistance:usesTimingEvasion",
+    "evasion:antiSecurity",
+    "evasion:antiSecurity:detectsAntivirus",
+    "evasion:antiSecurity:disablesSecuritySoftware",
+    "evasion:antiSecurity:evadesAntivirus",
+    "evasion:antiSecurity:terminatesSecurityProcess",
+    "evasion:indirection",
+    "evasion:indirection:resolvesApiDynamically",
+    "evasion:indirection:usesIndirectCalls",
+    "evasion:indirection:usesProxyExecution",
+    "evasion:obfuscation",
+    "evasion:obfuscation:obfuscatesCode",
+    "evasion:obfuscation:obfuscatesControlFlow",
+    "evasion:obfuscation:obfuscatesData",
+    "evasion:obfuscation:obfuscatesStrings",
+    "evasion:obfuscation:packsCode",
+    "evasion:obfuscation:unpacksAtRuntime",
+    "file",
+    "file:directory",
+    "file:directory:changesDirectory",
+    "file:directory:createsDirectory",
+    "file:directory:deletesDirectory",
+    "file:directory:listsDirectory",
+    "file:directory:traversesDirectory",
+    "file:disk",
+    "file:disk:decryptsVolume",
+    "file:disk:encryptsVolume",
+    "file:disk:formatsVolume",
+    "file:disk:mountsVolume",
+    "file:disk:unmountsVolume",
+    "file:disk:wipesDisk",
+    "file:operations",
+    "file:operations:appendsToFile",
+    "file:operations:checksFileExistence",
+    "file:operations:closesFile",
+    "file:operations:copiesFile",
+    "file:operations:createsFile",
+    "file:operations:deletesFile",
+    "file:operations:getsFileAttributes",
+    "file:operations:movesFile",
+    "file:operations:opensFile",
+    "file:operations:readsFile",
+    "file:operations:renamesFile",
+    "file:operations:setsFileAttributes",
+    "file:operations:setsFilePermissions",
+    "file:operations:writesFile",
+    "gui",
+    "gui:display",
+    "gui:display:displaysData",
+    "gui:display:monitorsDisplay",
+    "gui:display:updatesDisplay",
+    "gui:session",
+    "gui:session:displaysLogin",
+    "gui:session:interactsWithSession",
+    "gui:session:switchesSession",
+    "gui:window",
+    "gui:window:capturesWindow",
+    "gui:window:createsWindow",
+    "gui:window:destroysWindow",
+    "gui:window:enumeratesWindows",
+    "gui:window:interactsWithTaskbar",
+    "gui:window:modifiesWindow",
+    "hardware",
+    "hardware:actuator",
+    "hardware:actuator:calibratesActuator",
+    "hardware:actuator:controlsBattery",
+    "hardware:actuator:controlsHeating",
+    "hardware:actuator:controlsLed",
+    "hardware:actuator:controlsMotor",
+    "hardware:actuator:controlsPower",
+    "hardware:actuator:controlsPump",
+    "hardware:actuator:controlsTemperature",
+    "hardware:boot",
+    "hardware:boot:entersRecoveryMode",
+    "hardware:boot:executesSecureBoot",
+    "hardware:boot:locksBootConfiguration",
+    "hardware:boot:modifiesBootConfiguration",
+    "hardware:boot:readsBootConfiguration",
+    "hardware:boot:recordsBootMeasurement",
+    "hardware:boot:verifiesBootLoader",
+    "hardware:firmware",
+    "hardware:firmware:monitorsFirmwareIntegrity",
+    "hardware:firmware:preventsFirmwareRollback",
+    "hardware:firmware:readsFirmwareVersion",
+    "hardware:firmware:updatesFirmware",
+    "hardware:firmware:verifiesFirmwareSignature",
+    "hardware:memory",
+    "hardware:memory:encryptsMemory",
+    "hardware:memory:isolatesMemory",
+    "hardware:memory:protectsStack",
+    "hardware:memory:randomizesAddressSpace",
+    "hardware:memory:readsProtectedMemory",
+    "hardware:memory:writesProtectedMemory",
+    "hardware:peripheral",
+    "hardware:peripheral:accessesCamera",
+    "hardware:peripheral:accessesDisplay",
+    "hardware:peripheral:accessesGpio",
+    "hardware:peripheral:accessesJtag",
+    "hardware:peripheral:accessesKeyboard",
+    "hardware:peripheral:accessesStorageDevice",
+    "hardware:peripheral:accessesUsbDevice",
+    "hardware:peripheral:configuresDma",
+    "hardware:peripheral:protectsDma",
+    "hardware:physicalSecurity",
+    "hardware:physicalSecurity:detectsPhysicalTamper",
+    "hardware:physicalSecurity:disablesDebugInterface",
+    "hardware:physicalSecurity:enablesDebugInterface",
+    "hardware:physicalSecurity:monitorsEnclosure",
+    "hardware:physicalSecurity:respondsToTamper",
+    "hardware:physicalSecurity:zeroizesKeys",
+    "hardware:security",
+    "hardware:security:anchorsInHardwareRoot",
+    "hardware:security:executesInTee",
+    "hardware:security:generatesPufResponse",
+    "hardware:security:usesHsm",
+    "hardware:security:usesSecureElement",
+    "hardware:sensor",
+    "hardware:sensor:calibratesSensor",
+    "hardware:sensor:readsBatteryStatus",
+    "hardware:sensor:readsBloodOxygen",
+    "hardware:sensor:readsBloodPressure",
+    "hardware:sensor:readsCoTwoLevel",
+    "hardware:sensor:readsEcg",
+    "hardware:sensor:readsPowerStatus",
+    "hardware:sensor:readsTemperature",
+    "hardware:sideChannelDefense",
+    "hardware:sideChannelDefense:controlsEmEmissions",
+    "hardware:sideChannelDefense:resistsFaultInjection",
+    "hardware:sideChannelDefense:resistsPowerAnalysis",
+    "hardware:sideChannelDefense:resistsTimingAnalysis",
+    "network",
+    "network:connection",
+    "network:connection:acceptsConnection",
+    "network:connection:detectsConnectionLoss",
+    "network:connection:establishesConnection",
+    "network:connection:reconnects",
+    "network:connection:reusesConnection",
+    "network:connection:sendsHeartbeat",
+    "network:connection:terminatesConnection",
+    "network:discovery",
+    "network:discovery:advertisesService",
+    "network:discovery:discoversService",
+    "network:discovery:enumeratesInterfaces",
+    "network:discovery:probesPort",
+    "network:discovery:queriesDns",
+    "network:discovery:resolvesName",
+    "network:discovery:scansNetwork",
+    "network:protocol",
+    "network:protocol:downgradesProtocol",
+    "network:protocol:framesMessage",
+    "network:protocol:negotiatesProtocol",
+    "network:protocol:parsesMessage",
+    "network:protocol:retransmitsMessage",
+    "network:protocol:upgradesProtocol",
+    "network:protocol:validatesMessage",
+    "network:remoteInteraction",
+    "network:remoteInteraction:accessesRemoteDesktop",
+    "network:remoteInteraction:accessesRemoteShell",
+    "network:remoteInteraction:executesRemoteCommand",
+    "network:remoteInteraction:invokesRemoteProcedure",
+    "network:remoteInteraction:sendsEmail",
+    "network:remoteInteraction:sendsSms",
+    "network:remoteInteraction:transfersFile",
+    "network:routing",
+    "network:routing:configuresProxy",
+    "network:routing:forwardsPacket",
+    "network:routing:redirectsTraffic",
+    "network:routing:routesTraffic",
+    "network:routing:tunnelsTraffic",
+    "network:trafficControl",
+    "network:trafficControl:balancesLoad",
+    "network:trafficControl:filtersTraffic",
+    "network:trafficControl:inspectsTraffic",
+    "network:trafficControl:interceptsTraffic",
+    "network:trafficControl:limitsRate",
+    "network:trafficControl:modifiesTraffic",
+    "network:trafficControl:shapesTraffic",
+    "network:transmission",
+    "network:transmission:broadcastsData",
+    "network:transmission:multicastsData",
+    "network:transmission:receivesData",
+    "network:transmission:sendsData",
+    "network:transmission:streamsData",
+    "privacy",
+    "privacy:collection",
+    "privacy:collection:capturesAudio",
+    "privacy:collection:capturesKeystrokes",
+    "privacy:collection:capturesScreen",
+    "privacy:collection:capturesVideo",
+    "privacy:collection:collectsBehavioralData",
+    "privacy:collection:collectsBiometricData",
+    "privacy:collection:collectsCommunicationContent",
+    "privacy:collection:collectsDeviceInformation",
+    "privacy:collection:collectsFinancialData",
+    "privacy:collection:collectsHealthData",
+    "privacy:collection:collectsInBackground",
+    "privacy:collection:collectsLocationData",
+    "privacy:collection:collectsPersonalData",
+    "privacy:collection:collectsSilently",
+    "privacy:collection:readsBrowserHistory",
+    "privacy:collection:readsClipboard",
+    "privacy:deletion",
+    "privacy:deletion:clearsCache",
+    "privacy:deletion:deletesPersonalData",
+    "privacy:deletion:erasesSecurely",
+    "privacy:deletion:purgesFromBackup",
+    "privacy:deletion:redactsData",
+    "privacy:inference",
+    "privacy:inference:correlatesData",
+    "privacy:inference:createsProfile",
+    "privacy:inference:fingerprintsDevice",
+    "privacy:inference:infersPersonalInformation",
+    "privacy:inference:linksIdentities",
+    "privacy:inference:tracksUser",
+    "privacy:minimization",
+    "privacy:minimization:aggregatesData",
+    "privacy:minimization:anonymizesData",
+    "privacy:minimization:filtersData",
+    "privacy:minimization:generalizesData",
+    "privacy:minimization:limitsCollection",
+    "privacy:minimization:limitsProcessing",
+    "privacy:minimization:pseudonymizesData",
+    "privacy:privacyEnhancement",
+    "privacy:privacyEnhancement:addsDifferentialPrivacy",
+    "privacy:privacyEnhancement:computesMultiparty",
+    "privacy:privacyEnhancement:processesHomomorphically",
+    "privacy:privacyEnhancement:processesLocally",
+    "privacy:retention",
+    "privacy:retention:archivesData",
+    "privacy:retention:backsUpData",
+    "privacy:retention:enforcesRetentionPeriod",
+    "privacy:retention:retainsBeyondPurpose",
+    "privacy:retention:retainsInCache",
+    "privacy:retention:retainsInLog",
+    "privacy:retention:storesPersonalData",
+    "privacy:sharing",
+    "privacy:sharing:disclosesToThirdParty",
+    "privacy:sharing:exportsData",
+    "privacy:sharing:publishesData",
+    "privacy:sharing:sellsData",
+    "privacy:sharing:sharesWithAffiliate",
+    "privacy:sharing:transfersCrossBorder",
+    "privacy:subjectRights",
+    "privacy:subjectRights:correctsData",
+    "privacy:subjectRights:exportsDataPortably",
+    "privacy:subjectRights:honorsErasureRequest",
+    "privacy:subjectRights:honorsObjection",
+    "privacy:subjectRights:providesDataAccess",
+    "privacy:subjectRights:restrictsProcessing",
+    "privacy:transparency",
+    "privacy:transparency:disclosesProcessing",
+    "privacy:transparency:displaysPrivacyNotice",
+    "privacy:transparency:explainsAutomatedDecision",
+    "privacy:transparency:recordsConsent",
+    "privacy:transparency:requestsConsent",
+    "privacy:transparency:withdrawsConsent",
+    "safety",
+    "safety:autonomousBehavior",
+    "safety:autonomousBehavior:acceptsOverride",
+    "safety:autonomousBehavior:enforcesHumanInLoop",
+    "safety:autonomousBehavior:explainsDecision",
+    "safety:autonomousBehavior:requestsGuidance",
+    "safety:autonomousBehavior:respectsDecisionBoundary",
+    "safety:contentSafety",
+    "safety:contentSafety:detectsHarmfulContent",
+    "safety:contentSafety:detectsMisinformation",
+    "safety:contentSafety:enforcesAgeRestriction",
+    "safety:contentSafety:filtersContent",
+    "safety:contentSafety:labelsContent",
+    "safety:harmPrevention",
+    "safety:harmPrevention:preventsEnvironmentalHarm",
+    "safety:harmPrevention:preventsPropertyDamage",
+    "safety:harmPrevention:preventsUserHarm",
+    "safety:harmPrevention:protectsBystanders",
+    "safety:hazardManagement",
+    "safety:hazardManagement:assessesRisk",
+    "safety:hazardManagement:identifiesHazard",
+    "safety:hazardManagement:mitigatesHazard",
+    "safety:hazardManagement:reportsHazard",
+    "safety:humanInteraction",
+    "safety:humanInteraction:adaptsForAccessibility",
+    "safety:humanInteraction:managesCognitiveLoad",
+    "safety:humanInteraction:requestsConfirmation",
+    "safety:humanInteraction:warnsOperator",
+    "safety:operationalSafety",
+    "safety:operationalSafety:acceptsManualOverride",
+    "safety:operationalSafety:enforcesInterlock",
+    "safety:operationalSafety:enforcesOperatingLimits",
+    "safety:operationalSafety:executesEmergencyStop",
+    "safety:operationalSafety:monitorsWatchdog",
+    "safety:operationalSafety:validatesSafetyCondition",
+    "security",
+    "security:auditing",
+    "security:auditing:logsEvent",
+    "security:auditing:logsSecurityEvent",
+    "security:auditing:protectsAuditLog",
+    "security:auditing:purgesLog",
+    "security:auditing:rotatesLog",
+    "security:auditing:signsLogEntry",
+    "security:auditing:timestampsEvent",
+    "security:auditing:transmitsLog",
+    "security:authentication",
+    "security:authentication:authenticatesDevice",
+    "security:authentication:authenticatesService",
+    "security:authentication:authenticatesUser",
+    "security:authentication:bypassesAuthentication",
+    "security:authentication:capturesBiometric",
+    "security:authentication:delegatesAuthentication",
+    "security:authentication:failsAuthentication",
+    "security:authentication:locksAccount",
+    "security:authentication:performsMultiFactorAuthentication",
+    "security:authentication:promptsForCredentials",
+    "security:authentication:unlocksAccount",
+    "security:authentication:validatesBiometric",
+    "security:authentication:validatesCredentials",
+    "security:authorization",
+    "security:authorization:checksPermission",
+    "security:authorization:delegatesAuthority",
+    "security:authorization:deniesAccess",
+    "security:authorization:enforcesRole",
+    "security:authorization:escalatesPrivilege",
+    "security:authorization:evaluatesAttributes",
+    "security:authorization:evaluatesPolicy",
+    "security:authorization:grantsAccess",
+    "security:authorization:grantsImpersonation",
+    "security:authorization:impersonatesUser",
+    "security:authorization:requestsImpersonation",
+    "security:authorization:revokesAccess",
+    "security:authorization:revokesImpersonation",
+    "security:cryptography",
+    "security:cryptography:authenticates",
+    "security:cryptography:checksRevocation",
+    "security:cryptography:decryptsData",
+    "security:cryptography:decryptsDataAtRest",
+    "security:cryptography:decryptsDataInTransit",
+    "security:cryptography:decryptsDisk",
+    "security:cryptography:decryptsSecret",
+    "security:cryptography:destroysKey",
+    "security:cryptography:encryptsData",
+    "security:cryptography:encryptsDataAtRest",
+    "security:cryptography:encryptsDataInTransit",
+    "security:cryptography:encryptsDisk",
+    "security:cryptography:encryptsSecret",
+    "security:cryptography:ensuresAccountability",
+    "security:cryptography:ensuresConfidentiality",
+    "security:cryptography:ensuresIntegrity",
+    "security:cryptography:ensuresNonRepudiation",
+    "security:cryptography:exchangesKey",
+    "security:cryptography:generatesKey",
+    "security:cryptography:generatesRandomValue",
+    "security:cryptography:hashesData",
+    "security:cryptography:hashesPassword",
+    "security:cryptography:identifies",
+    "security:cryptography:issuesCertificate",
+    "security:cryptography:preservesPrivacy",
+    "security:cryptography:presentsClientCertificate",
+    "security:cryptography:presentsServerCertificate",
+    "security:cryptography:retrievesKey",
+    "security:cryptography:revokesCertificate",
+    "security:cryptography:rotatesKey",
+    "security:cryptography:signsCode",
+    "security:cryptography:signsData",
+    "security:cryptography:signsDocument",
+    "security:cryptography:storesKey",
+    "security:cryptography:usesIdentity",
+    "security:cryptography:validatesCertificate",
+    "security:cryptography:validatesToken",
+    "security:cryptography:verifiesCodeSignature",
+    "security:cryptography:verifiesDataSignature",
+    "security:cryptography:verifiesDocumentSignature",
+    "security:cryptography:verifiesHash",
+    "security:cryptography:verifiesSignature",
+    "security:cryptography:wrapsKey",
+    "security:errorHandling",
+    "security:errorHandling:catchesException",
+    "security:errorHandling:disclosesErrorDetails",
+    "security:errorHandling:failsClosed",
+    "security:errorHandling:failsOpen",
+    "security:errorHandling:generatesError",
+    "security:errorHandling:logsError",
+    "security:errorHandling:propagatesError",
+    "security:errorHandling:returnsGenericError",
+    "security:errorHandling:suppressesError",
+    "security:inputHandling",
+    "security:inputHandling:escapesInput",
+    "security:inputHandling:normalizesInput",
+    "security:inputHandling:rejectsInvalidInput",
+    "security:inputHandling:sanitizesInput",
+    "security:inputHandling:truncatesInput",
+    "security:inputHandling:validatesFormat",
+    "security:inputHandling:validatesRange",
+    "security:inputHandling:validatesSchema",
+    "security:integrity",
+    "security:integrity:attestsIntegrity",
+    "security:integrity:detectsTampering",
+    "security:integrity:respondsToTampering",
+    "security:integrity:validatesComponent",
+    "security:integrity:verifiesIntegrity",
+    "security:integrity:verifiesProvenance",
+    "security:outputHandling",
+    "security:outputHandling:encodesOutput",
+    "security:outputHandling:enforcesContentPolicy",
+    "security:outputHandling:escapesOutput",
+    "security:outputHandling:filtersOutput",
+    "security:outputHandling:masksOutput",
+    "security:outputHandling:setsSecurityHeader",
+    "security:session",
+    "security:session:createsSession",
+    "security:session:detectsSessionHijacking",
+    "security:session:invalidatesSession",
+    "security:session:refreshesSession",
+    "security:session:regeneratesSessionId",
+    "security:session:terminatesSession",
+    "security:session:validatesSession",
+    "security:threatResponse",
+    "security:threatResponse:blocksRequest",
+    "security:threatResponse:blocksSource",
+    "security:threatResponse:collectsForensicData",
+    "security:threatResponse:detectsAnomaly",
+    "security:threatResponse:detectsIntrusion",
+    "security:threatResponse:initiatesIncidentResponse",
+    "security:threatResponse:quarantinesElement",
+    "security:threatResponse:raisesAlert",
+    "system",
+    "system:configuration",
+    "system:configuration:deletesRegistryKey",
+    "system:configuration:modifiesGroupPolicy",
+    "system:configuration:readsConfigurationFile",
+    "system:configuration:readsEnvironmentVariable",
+    "system:configuration:readsGroupPolicy",
+    "system:configuration:readsRegistry",
+    "system:configuration:setsEnvironmentVariable",
+    "system:configuration:writesConfigurationFile",
+    "system:configuration:writesRegistry",
+    "system:informationGathering",
+    "system:informationGathering:detectsOsVersion",
+    "system:informationGathering:gathersSystemInformation",
+    "system:informationGathering:queriesHardwareInformation",
+    "system:informationGathering:retrievesHostname",
+    "system:kernelInteraction",
+    "system:kernelInteraction:hooksKernelFunction",
+    "system:kernelInteraction:installsDriver",
+    "system:kernelInteraction:readsKernelMemory",
+    "system:kernelInteraction:writesKernelMemory",
+    "system:lifecycle",
+    "system:lifecycle:appliesUpdate",
+    "system:lifecycle:decommissions",
+    "system:lifecycle:initializes",
+    "system:lifecycle:performsSelfTest",
+    "system:lifecycle:provisions",
+    "system:lifecycle:rollsBack",
+    "system:lifecycle:shutsDown",
+    "system:operationalState",
+    "system:operationalState:entersFailSafeState",
+    "system:operationalState:entersFailSecureState",
+    "system:operationalState:operatesInDegradedMode",
+    "system:operationalState:operatesNormally",
+    "system:operationalState:performsEmergencyShutdown",
+    "system:persistence",
+    "system:persistence:createsScheduledTask",
+    "system:persistence:installsAsService",
+    "system:persistence:loadsAsKernelModule",
+    "system:persistence:registersForStartup",
+    "system:persistence:removesPersistence",
+    "system:processControl",
+    "system:processControl:createsProcess",
+    "system:processControl:dumpsProcessMemory",
+    "system:processControl:enumeratesProcesses",
+    "system:processControl:hooksFunction",
+    "system:processControl:injectsCodeIntoProcess",
+    "system:processControl:modifiesProcess",
+    "system:processControl:resumesProcess",
+    "system:processControl:suspendsProcess",
+    "system:processControl:terminatesProcess",
+    "system:resilience",
+    "system:resilience:activatesRedundancy",
+    "system:resilience:degradesGracefully",
+    "system:resilience:detectsFault",
+    "system:resilience:recoversFromFailure",
+    "system:resilience:toleratesFault",
+    "system:resourceManagement",
+    "system:resourceManagement:allocatesMemory",
+    "system:resourceManagement:deallocatesMemory",
+    "system:resourceManagement:handlesResourceExhaustion",
+    "system:resourceManagement:managesPowerState",
+    "system:resourceManagement:readsFromStorage",
+    "system:resourceManagement:resumesThread",
+    "system:resourceManagement:spawnsThread",
+    "system:resourceManagement:suspendsThread",
+    "system:resourceManagement:terminatesThread",
+    "system:resourceManagement:writesToStorage",
+    "system:serviceControl",
+    "system:serviceControl:createsService",
+    "system:serviceControl:deletesService",
+    "system:serviceControl:enumeratesServices",
+    "system:serviceControl:modifiesService",
+    "system:serviceControl:startsService",
+    "system:serviceControl:stopsService",
+    "system:synchronization",
+    "system:synchronization:acquiresMutex",
+    "system:synchronization:releasesMutex",
+    "system:synchronization:signalsEvent",
+    "system:synchronization:signalsSemaphore",
+    "system:synchronization:waitsOnEvent",
+    "system:synchronization:waitsOnSemaphore",
+    "system:timing",
+    "system:timing:delaysExecution",
+    "system:timing:enforcesDeadline",
+    "system:timing:executesScheduledTask",
+    "system:timing:resetsWatchdog",
+    "system:timing:synchronizesClock",
+    "system:timing:triggersTimeout",
+    "system:timing:waits",
+    "system:userManagement",
+    "system:userManagement:createsUserAccount",
+    "system:userManagement:deletesUserAccount",
+    "system:userManagement:elevatesPrivileges",
+    "system:userManagement:enumeratesUsers",
+    "system:userManagement:impersonatesUser",
+    "system:userManagement:modifiesUserAccount"
+  ],
+  "meta:enum": {
+    "ai": "Behaviours relating to artificial intelligence and machine learning operations.",
+    "ai:agent": "Behaviours that enable autonomous agents to plan and execute tasks.",
+    "ai:agent:actsOnBehalfOfUser": "The entity performs actions within a delegated user context.",
+    "ai:agent:coordinatesAgents": "The entity orchestrates multiple agents.",
+    "ai:agent:delegatesTask": "The entity assigns work to another agent.",
+    "ai:agent:executesAction": "The entity performs planned step.",
+    "ai:agent:invokesTool": "The entity calls external capability.",
+    "ai:agent:observesResult": "The entity captures action outcome.",
+    "ai:agent:plansAction": "The entity determines steps to achieve goal.",
+    "ai:agent:receivesHumanDelegation": "The entity accepts authority delegated by a human user.",
+    "ai:agent:reflectsOnResult": "The entity evaluates action effectiveness.",
+    "ai:agent:reportsDelegatedAction": "The entity notifies the delegating user of actions taken.",
+    "ai:agent:requestsUserApproval": "The entity seeks explicit user authorisation before acting.",
+    "ai:agent:returnsDelegation": "The entity relinquishes delegated authority.",
+    "ai:agent:revisesPlan": "The entity modifies approach based on results.",
+    "ai:explainability": "Behaviours that provide interpretable explanations for model decisions.",
+    "ai:explainability:attributesFeatures": "The entity identifies influential inputs.",
+    "ai:explainability:documentsModel": "The entity records model design and behaviour.",
+    "ai:explainability:explainsDecision": "The entity provides human-readable rationale.",
+    "ai:explainability:tracesPrediction": "The entity records basis for output.",
+    "ai:explainability:visualizesModel": "The entity renders model behaviour graphically.",
+    "ai:fairness": "Behaviours that detect and mitigate bias in machine learning models.",
+    "ai:fairness:auditsModelFairness": "The entity evaluates model for bias.",
+    "ai:fairness:calculatesFairnessMetric": "The entity measures outcome equality.",
+    "ai:fairness:detectsBias": "The entity identifies unfair model behaviour.",
+    "ai:fairness:handlesProtectedAttribute": "The entity manages sensitive attributes.",
+    "ai:fairness:mitigatesBias": "The entity reduces unfair treatment.",
+    "ai:generative": "Behaviours that produce content using generative models.",
+    "ai:generative:citesSource": "The entity attributes generated content.",
+    "ai:generative:filtersOutput": "The entity screens generated content.",
+    "ai:generative:generatesAudio": "The entity produces sound content.",
+    "ai:generative:generatesCode": "The entity produces executable code.",
+    "ai:generative:generatesEmbedding": "The entity produces vector representation.",
+    "ai:generative:generatesImage": "The entity produces visual content.",
+    "ai:generative:generatesText": "The entity produces natural language.",
+    "ai:generative:mitigatesHallucination": "The entity reduces false content generation.",
+    "ai:generative:processesPrompt": "The entity interprets user instruction.",
+    "ai:generative:streamsResponse": "The entity delivers output incrementally.",
+    "ai:inference": "Behaviours that generate predictions using trained models.",
+    "ai:inference:appliesThreshold": "The entity uses decision boundary.",
+    "ai:inference:batchesInference": "The entity processes multiple inputs together.",
+    "ai:inference:cachesPrediction": "The entity stores prediction for reuse.",
+    "ai:inference:ensemblesModels": "The entity combines multiple model outputs.",
+    "ai:inference:generatesPrediction": "The entity produces model output.",
+    "ai:inference:infersInRealTime": "The entity generates prediction with low latency.",
+    "ai:inference:ranksResults": "The entity orders predictions by relevance.",
+    "ai:inference:scoresConfidence": "The entity assigns certainty to prediction.",
+    "ai:management": "Behaviours that deploy and manage machine learning models throughout their lifecycle.",
+    "ai:management:comparesModels": "The entity evaluates relative model performance.",
+    "ai:management:deploysModel": "The entity places model into service.",
+    "ai:management:loadsModel": "The entity retrieves model for use.",
+    "ai:management:monitorsModel": "The entity observes model performance.",
+    "ai:management:retiresModel": "The entity removes model from service.",
+    "ai:management:rollsBackModel": "The entity reverts to previous version.",
+    "ai:management:unloadsModel": "The entity removes model from memory.",
+    "ai:management:versionsModel": "The entity tracks model versions.",
+    "ai:quality": "Behaviours that monitor and maintain model and data quality.",
+    "ai:quality:detectsConceptDrift": "The entity identifies input-output relationship change.",
+    "ai:quality:detectsDataDrift": "The entity identifies input distribution change.",
+    "ai:quality:detectsOutlier": "The entity identifies anomalous input.",
+    "ai:quality:engineersFeatures": "The entity transforms raw data for model.",
+    "ai:quality:selectsFeatures": "The entity chooses relevant input features.",
+    "ai:quality:validatesInputData": "The entity checks inference input quality.",
+    "ai:robustness": "Behaviours that defend against adversarial attacks and handle uncertain inputs.",
+    "ai:robustness:defendsAgainstAdversarial": "The entity resists adversarial manipulation.",
+    "ai:robustness:detectsAdversarialInput": "The entity identifies crafted malicious input.",
+    "ai:robustness:detectsOutOfDistribution": "The entity identifies unfamiliar input.",
+    "ai:robustness:estimatesUncertainty": "The entity quantifies prediction confidence.",
+    "ai:robustness:validatesRobustness": "The entity tests model resilience.",
+    "ai:training": "Behaviours that prepare data and train machine learning models.",
+    "ai:training:appliesTransferLearning": "The entity adapts pre-trained model.",
+    "ai:training:checkpointsModel": "The entity saves model state during training.",
+    "ai:training:fineTunesModel": "The entity refines model for specific task.",
+    "ai:training:ingestsTrainingData": "The entity acquires data for training.",
+    "ai:training:preprocessesTrainingData": "The entity prepares data for training.",
+    "ai:training:trainsFederatedly": "The entity trains on distributed data.",
+    "ai:training:trainsModel": "The entity adjusts model parameters.",
+    "ai:training:tunesHyperparameters": "The entity optimises configuration parameters.",
+    "ai:training:validatesModel": "The entity evaluates model during training.",
+    "ai:training:validatesTrainingData": "The entity checks training data quality.",
+    "application": "Behaviours relating to application-level request processing and business logic.",
+    "application:codeExecution": "Behaviours that dynamically load and execute code at runtime.",
+    "application:codeExecution:compilesCode": "The entity transforms source to executable form.",
+    "application:codeExecution:evaluatesExpression": "The entity interprets and executes an expression.",
+    "application:codeExecution:executesNativeCommand": "The entity runs an operating system command.",
+    "application:codeExecution:executesScript": "The entity runs script code.",
+    "application:codeExecution:interpretsCode": "The entity executes code without compilation.",
+    "application:codeExecution:invokesViaReflection": "The entity calls method through reflection.",
+    "application:codeExecution:loadsCodeDynamically": "The entity loads executable code at runtime.",
+    "application:configuration": "Behaviours that load and manage application configuration settings.",
+    "application:configuration:detectsEnvironment": "The entity determines deployment context.",
+    "application:configuration:evaluatesFeatureFlag": "The entity checks feature toggle state.",
+    "application:configuration:loadsConfiguration": "The entity reads configuration settings.",
+    "application:configuration:reloadsConfiguration": "The entity refreshes configuration dynamically.",
+    "application:controlFlow": "Behaviours that manage the execution sequence and event handling within an application.",
+    "application:controlFlow:awaitsAsyncResult": "The entity waits for asynchronous completion.",
+    "application:controlFlow:catchesException": "The entity handles an error condition.",
+    "application:controlFlow:emitsEvent": "The entity triggers an event.",
+    "application:controlFlow:handlesEvent": "The entity responds to an event.",
+    "application:controlFlow:invokesCallback": "The entity executes a callback function.",
+    "application:controlFlow:invokesHandler": "The entity calls a request handler.",
+    "application:controlFlow:invokesMiddleware": "The entity executes middleware component.",
+    "application:controlFlow:schedulesAsyncOperation": "The entity queues work for later execution.",
+    "application:controlFlow:throwsException": "The entity raises an error condition.",
+    "application:dependencyManagement": "Behaviours that resolve and manage dependencies on other components.",
+    "application:dependencyManagement:closesCircuitBreaker": "The entity resumes calls to recovered dependency.",
+    "application:dependencyManagement:fallsBack": "The entity uses alternative when primary fails.",
+    "application:dependencyManagement:injectsDependency": "The entity provides component to dependent.",
+    "application:dependencyManagement:opensCircuitBreaker": "The entity stops calls to failing dependency.",
+    "application:dependencyManagement:resolvesDependency": "The entity locates required component.",
+    "application:externalIntegration": "Behaviours that communicate with external services and systems.",
+    "application:externalIntegration:callsExternalService": "The entity invokes an external API.",
+    "application:externalIntegration:consumesEvent": "The entity receives event from external system.",
+    "application:externalIntegration:publishesEvent": "The entity sends event to external system.",
+    "application:externalIntegration:receivesWebhook": "The entity accepts callback from external service.",
+    "application:observability": "Behaviours that emit telemetry for monitoring and debugging purposes.",
+    "application:observability:emitsTelemetry": "The entity transmits operational data.",
+    "application:observability:logsOperation": "The entity records an operational event.",
+    "application:observability:recordsMetric": "The entity captures a quantitative measurement.",
+    "application:observability:reportsHealth": "The entity communicates operational status.",
+    "application:observability:tracesRequest": "The entity tracks request across services.",
+    "application:requestHandling": "Behaviours that receive and process incoming requests.",
+    "application:requestHandling:authenticatesRequest": "The entity verifies requestor identity.",
+    "application:requestHandling:authorizesRequest": "The entity verifies requestor permissions.",
+    "application:requestHandling:bindsParameters": "The entity maps request data to parameters.",
+    "application:requestHandling:parsesRequest": "The entity interprets incoming request.",
+    "application:requestHandling:receivesHttpRequest": "The entity accepts an HTTP request.",
+    "application:requestHandling:rejectsRequest": "The entity refuses to process request.",
+    "application:requestHandling:routesRequest": "The entity directs request to appropriate handler.",
+    "application:requestHandling:validatesRequest": "The entity verifies request validity.",
+    "application:responseGeneration": "Behaviours that construct and transmit responses to requests.",
+    "application:responseGeneration:generatesResponse": "The entity creates a response.",
+    "application:responseGeneration:readsCookie": "The entity retrieves cookie value.",
+    "application:responseGeneration:redirectsRequest": "The entity sends client to different location.",
+    "application:responseGeneration:returnsError": "The entity indicates failure.",
+    "application:responseGeneration:returnsSuccess": "The entity indicates successful completion.",
+    "application:responseGeneration:sendsHttpResponse": "The entity transmits an HTTP response.",
+    "application:responseGeneration:setsCookie": "The entity creates or modifies a cookie.",
+    "application:responseGeneration:setsHeader": "The entity adds HTTP header to response.",
+    "application:stateManagement": "Behaviours that maintain and synchronise application state across requests.",
+    "application:stateManagement:acquiresLock": "The entity obtains exclusive access to resource.",
+    "application:stateManagement:beginsTransaction": "The entity starts an atomic operation group.",
+    "application:stateManagement:commitsTransaction": "The entity finalises transaction changes.",
+    "application:stateManagement:createsSessionState": "The entity initialises session data.",
+    "application:stateManagement:destroysSessionState": "The entity removes session data.",
+    "application:stateManagement:readsSessionState": "The entity retrieves session data.",
+    "application:stateManagement:releasesLock": "The entity relinquishes exclusive access.",
+    "application:stateManagement:rollsBackTransaction": "The entity undoes transaction changes.",
+    "application:stateManagement:synchronizesState": "The entity maintains consistency across replicas.",
+    "application:stateManagement:updatesSessionState": "The entity modifies session data.",
+    "data": "Behaviours relating to the ingestion and transformation of structured and unstructured data.",
+    "data:encoding": "Behaviours that apply specific encoding schemes to data.",
+    "data:encoding:appliesXor": "The entity transforms data using XOR operation.",
+    "data:encoding:decodesBaseSixtyFour": "The entity converts Base64 to original form.",
+    "data:encoding:decodesUrl": "The entity converts URL-encoded data.",
+    "data:encoding:encodesBaseSixtyFour": "The entity converts data to Base64.",
+    "data:encoding:encodesUrl": "The entity converts data for URL inclusion.",
+    "data:ingestion": "Behaviours that acquire data from external sources.",
+    "data:ingestion:pollsSource": "The entity periodically checks for new data.",
+    "data:ingestion:readsFile": "The entity retrieves data from a file.",
+    "data:ingestion:readsStream": "The entity consumes data from a continuous source.",
+    "data:ingestion:receivesInput": "The entity accepts data from an external source.",
+    "data:ingestion:receivesMessage": "The entity accepts a message from a queue.",
+    "data:ingestion:receivesRequest": "The entity accepts an incoming request.",
+    "data:ingestion:subscribesToFeed": "The entity registers to receive updates.",
+    "data:output": "Behaviours that produce and transmit data to external consumers.",
+    "data:output:formatsResponse": "The entity structures data for delivery.",
+    "data:output:producesOutput": "The entity generates data for consumption.",
+    "data:output:publishesMessage": "The entity sends a message to a queue.",
+    "data:output:rendersTemplate": "The entity generates output from a template.",
+    "data:output:sendsResponse": "The entity transmits a reply.",
+    "data:output:serializesObject": "The entity converts object to transmittable form.",
+    "data:output:streamsOutput": "The entity continuously produces data.",
+    "data:output:writesFile": "The entity saves data to a file.",
+    "data:parsing": "Behaviours that interpret and extract information from structured data formats.",
+    "data:parsing:decodesData": "The entity converts encoded data to original form.",
+    "data:parsing:deserializesObject": "The entity reconstructs object from serialised form.",
+    "data:parsing:extractsFields": "The entity isolates specific data elements.",
+    "data:parsing:parsesData": "The entity interprets structured data.",
+    "data:parsing:parsesHtml": "The entity interprets HTML content.",
+    "data:parsing:parsesJson": "The entity interprets JSON-formatted data.",
+    "data:parsing:parsesXml": "The entity interprets XML-formatted data.",
+    "data:query": "Behaviours that retrieve data based on specified criteria.",
+    "data:query:executesLdapQuery": "The entity queries an LDAP directory.",
+    "data:query:executesNoSqlQuery": "The entity queries a NoSQL database.",
+    "data:query:executesSearch": "The entity performs full-text or indexed search.",
+    "data:query:executesSql": "The entity runs a SQL statement.",
+    "data:query:executesXPath": "The entity evaluates an XPath expression.",
+    "data:query:queriesData": "The entity retrieves data matching criteria.",
+    "data:storage": "Behaviours that persist and retrieve data from storage systems.",
+    "data:storage:cachesData": "The entity stores data for quick retrieval.",
+    "data:storage:deletesData": "The entity removes stored data.",
+    "data:storage:flushesCache": "The entity writes cached data to persistent storage.",
+    "data:storage:invalidatesCache": "The entity marks cached data as stale.",
+    "data:storage:retrievesData": "The entity fetches stored data.",
+    "data:storage:storesData": "The entity saves data persistently.",
+    "data:storage:updatesData": "The entity modifies stored data.",
+    "data:transformation": "Behaviours that convert data from one form or structure to another.",
+    "data:transformation:aggregatesData": "The entity combines multiple values.",
+    "data:transformation:compressesData": "The entity reduces data size.",
+    "data:transformation:decompressesData": "The entity restores compressed data.",
+    "data:transformation:encodesData": "The entity converts data to encoded form.",
+    "data:transformation:enrichesData": "The entity adds information from external sources.",
+    "data:transformation:filtersData": "The entity removes unwanted elements.",
+    "data:transformation:joinsData": "The entity combines data from multiple sources.",
+    "data:transformation:mapsData": "The entity converts between data structures.",
+    "data:transformation:normalizesData": "The entity converts to standard form.",
+    "data:transformation:sortsData": "The entity orders data elements.",
+    "data:transformation:transformsData": "The entity converts data from one form to another.",
+    "evasion": "Behaviours relating to techniques that avoid detection and analysis.",
+    "evasion:analysisResistance": "Behaviours that detect and evade analysis environments.",
+    "evasion:analysisResistance:detectsAnalysisTool": "The entity identifies analysis software.",
+    "evasion:analysisResistance:detectsDebugger": "The entity identifies debugger presence.",
+    "evasion:analysisResistance:detectsEmulator": "The entity identifies emulation environment.",
+    "evasion:analysisResistance:detectsSandbox": "The entity identifies sandbox environment.",
+    "evasion:analysisResistance:detectsVirtualMachine": "The entity identifies VM environment.",
+    "evasion:analysisResistance:evadesDebugger": "The entity modifies behaviour under debugging.",
+    "evasion:analysisResistance:evadesEmulator": "The entity modifies behaviour under emulation.",
+    "evasion:analysisResistance:evadesSandbox": "The entity modifies behaviour in sandbox.",
+    "evasion:analysisResistance:evadesVirtualMachine": "The entity modifies behaviour in VM.",
+    "evasion:analysisResistance:usesTimingEvasion": "The entity uses delays to evade analysis.",
+    "evasion:antiSecurity": "Behaviours that detect and disable security software.",
+    "evasion:antiSecurity:detectsAntivirus": "The entity identifies AV software.",
+    "evasion:antiSecurity:disablesSecuritySoftware": "The entity deactivates security tools.",
+    "evasion:antiSecurity:evadesAntivirus": "The entity avoids AV detection.",
+    "evasion:antiSecurity:terminatesSecurityProcess": "The entity kills security software processes.",
+    "evasion:indirection": "Behaviours that use indirect methods to execute code.",
+    "evasion:indirection:resolvesApiDynamically": "The entity finds API addresses at runtime.",
+    "evasion:indirection:usesIndirectCalls": "The entity invokes functions indirectly.",
+    "evasion:indirection:usesProxyExecution": "The entity executes through intermediary.",
+    "evasion:obfuscation": "Behaviours that obscure code and data to hinder analysis.",
+    "evasion:obfuscation:obfuscatesCode": "The entity makes code difficult to analyse.",
+    "evasion:obfuscation:obfuscatesControlFlow": "The entity obscures execution paths.",
+    "evasion:obfuscation:obfuscatesData": "The entity hides data structures.",
+    "evasion:obfuscation:obfuscatesStrings": "The entity hides string contents.",
+    "evasion:obfuscation:packsCode": "The entity compresses or encrypts executable.",
+    "evasion:obfuscation:unpacksAtRuntime": "The entity decompresses code during execution.",
+    "file": "Behaviours relating to file system operations and disk management.",
+    "file:directory": "Behaviours that create and navigate directory structures.",
+    "file:directory:changesDirectory": "The entity sets current working directory.",
+    "file:directory:createsDirectory": "The entity creates a new directory.",
+    "file:directory:deletesDirectory": "The entity removes a directory.",
+    "file:directory:listsDirectory": "The entity enumerates directory contents.",
+    "file:directory:traversesDirectory": "The entity recursively explores directories.",
+    "file:disk": "Behaviours that manage storage volumes and disk-level operations.",
+    "file:disk:decryptsVolume": "The entity decrypts a storage volume.",
+    "file:disk:encryptsVolume": "The entity encrypts a storage volume.",
+    "file:disk:formatsVolume": "The entity prepares storage for use.",
+    "file:disk:mountsVolume": "The entity attaches a storage volume.",
+    "file:disk:unmountsVolume": "The entity detaches a storage volume.",
+    "file:disk:wipesDisk": "The entity securely erases disk contents.",
+    "file:operations": "Behaviours that create and manipulate files.",
+    "file:operations:appendsToFile": "The entity adds data to end of file.",
+    "file:operations:checksFileExistence": "The entity verifies whether a file exists.",
+    "file:operations:closesFile": "The entity releases file access.",
+    "file:operations:copiesFile": "The entity duplicates a file.",
+    "file:operations:createsFile": "The entity creates a new file.",
+    "file:operations:deletesFile": "The entity removes a file.",
+    "file:operations:getsFileAttributes": "The entity retrieves file metadata.",
+    "file:operations:movesFile": "The entity relocates a file.",
+    "file:operations:opensFile": "The entity prepares a file for access.",
+    "file:operations:readsFile": "The entity retrieves file contents.",
+    "file:operations:renamesFile": "The entity changes a file name.",
+    "file:operations:setsFileAttributes": "The entity modifies file metadata.",
+    "file:operations:setsFilePermissions": "The entity modifies file access permissions.",
+    "file:operations:writesFile": "The entity modifies file contents.",
+    "gui": "Behaviours relating to graphical user interface interactions.",
+    "gui:display": "Behaviours that render and monitor visual output.",
+    "gui:display:displaysData": "The entity renders information visually.",
+    "gui:display:monitorsDisplay": "The entity observes displayed content.",
+    "gui:display:updatesDisplay": "The entity refreshes visual presentation.",
+    "gui:session": "Behaviours that interact with user login sessions.",
+    "gui:session:displaysLogin": "The entity presents login interface.",
+    "gui:session:interactsWithSession": "The entity operates within user session.",
+    "gui:session:switchesSession": "The entity changes active user session.",
+    "gui:window": "Behaviours that create and manipulate graphical windows.",
+    "gui:window:capturesWindow": "The entity captures window contents.",
+    "gui:window:createsWindow": "The entity creates a graphical window.",
+    "gui:window:destroysWindow": "The entity closes a window.",
+    "gui:window:enumeratesWindows": "The entity lists open windows.",
+    "gui:window:interactsWithTaskbar": "The entity modifies taskbar elements.",
+    "gui:window:modifiesWindow": "The entity changes window properties.",
+    "hardware": "Behaviours relating to hardware components and physical device interactions.",
+    "hardware:actuator": "Behaviours that control physical actuators and output devices.",
+    "hardware:actuator:calibratesActuator": "The entity adjusts actuator accuracy.",
+    "hardware:actuator:controlsBattery": "The entity manages battery charging.",
+    "hardware:actuator:controlsHeating": "The entity manages heating element.",
+    "hardware:actuator:controlsLed": "The entity manages LED indicator.",
+    "hardware:actuator:controlsMotor": "The entity manages motor operation.",
+    "hardware:actuator:controlsPower": "The entity manages power distribution.",
+    "hardware:actuator:controlsPump": "The entity manages fluid pump.",
+    "hardware:actuator:controlsTemperature": "The entity regulates temperature.",
+    "hardware:boot": "Behaviours that verify and configure system startup processes.",
+    "hardware:boot:entersRecoveryMode": "The entity boots via alternative path.",
+    "hardware:boot:executesSecureBoot": "The entity verifies code integrity at startup.",
+    "hardware:boot:locksBootConfiguration": "The entity prevents boot setting changes.",
+    "hardware:boot:modifiesBootConfiguration": "The entity changes boot settings.",
+    "hardware:boot:readsBootConfiguration": "The entity retrieves boot settings.",
+    "hardware:boot:recordsBootMeasurement": "The entity logs boot component hashes.",
+    "hardware:boot:verifiesBootLoader": "The entity validates boot loader authenticity.",
+    "hardware:firmware": "Behaviours that manage and verify firmware integrity.",
+    "hardware:firmware:monitorsFirmwareIntegrity": "The entity checks for firmware tampering.",
+    "hardware:firmware:preventsFirmwareRollback": "The entity blocks reversion to old firmware.",
+    "hardware:firmware:readsFirmwareVersion": "The entity retrieves firmware version.",
+    "hardware:firmware:updatesFirmware": "The entity applies firmware changes.",
+    "hardware:firmware:verifiesFirmwareSignature": "The entity validates firmware authenticity.",
+    "hardware:memory": "Behaviours that protect and isolate memory regions.",
+    "hardware:memory:encryptsMemory": "The entity protects memory contents.",
+    "hardware:memory:isolatesMemory": "The entity separates memory regions.",
+    "hardware:memory:protectsStack": "The entity defends against stack attacks.",
+    "hardware:memory:randomizesAddressSpace": "The entity applies ASLR.",
+    "hardware:memory:readsProtectedMemory": "The entity accesses protected memory region.",
+    "hardware:memory:writesProtectedMemory": "The entity modifies protected memory region.",
+    "hardware:peripheral": "Behaviours that interact with peripheral devices and interfaces.",
+    "hardware:peripheral:accessesCamera": "The entity interacts with camera hardware.",
+    "hardware:peripheral:accessesDisplay": "The entity interacts with display hardware.",
+    "hardware:peripheral:accessesGpio": "The entity reads or writes GPIO pins.",
+    "hardware:peripheral:accessesJtag": "The entity uses JTAG debug interface.",
+    "hardware:peripheral:accessesKeyboard": "The entity interacts with keyboard hardware.",
+    "hardware:peripheral:accessesStorageDevice": "The entity interacts with storage hardware.",
+    "hardware:peripheral:accessesUsbDevice": "The entity interacts with USB peripheral.",
+    "hardware:peripheral:configuresDma": "The entity sets up direct memory access.",
+    "hardware:peripheral:protectsDma": "The entity prevents unauthorised DMA.",
+    "hardware:physicalSecurity": "Behaviours that detect and respond to physical tampering.",
+    "hardware:physicalSecurity:detectsPhysicalTamper": "The entity identifies physical interference.",
+    "hardware:physicalSecurity:disablesDebugInterface": "The entity prevents debug access.",
+    "hardware:physicalSecurity:enablesDebugInterface": "The entity permits debug access.",
+    "hardware:physicalSecurity:monitorsEnclosure": "The entity detects housing penetration.",
+    "hardware:physicalSecurity:respondsToTamper": "The entity reacts to physical attack.",
+    "hardware:physicalSecurity:zeroizesKeys": "The entity destroys keys on tamper detection.",
+    "hardware:security": "Behaviours that utilise hardware security features and trusted execution environments.",
+    "hardware:security:anchorsInHardwareRoot": "The entity uses tamper-resistant hardware for trust.",
+    "hardware:security:executesInTee": "The entity runs in trusted execution environment.",
+    "hardware:security:generatesPufResponse": "The entity uses physical unclonable function.",
+    "hardware:security:usesHsm": "The entity employs hardware security module.",
+    "hardware:security:usesSecureElement": "The entity employs dedicated security hardware.",
+    "hardware:sensor": "Behaviours that read measurements from hardware sensors.",
+    "hardware:sensor:calibratesSensor": "The entity adjusts sensor accuracy.",
+    "hardware:sensor:readsBatteryStatus": "The entity obtains battery state.",
+    "hardware:sensor:readsBloodOxygen": "The entity obtains SpO2 measurement.",
+    "hardware:sensor:readsBloodPressure": "The entity obtains blood pressure measurement.",
+    "hardware:sensor:readsCoTwoLevel": "The entity obtains CO2 measurement.",
+    "hardware:sensor:readsEcg": "The entity obtains electrocardiogram data.",
+    "hardware:sensor:readsPowerStatus": "The entity obtains power state.",
+    "hardware:sensor:readsTemperature": "The entity obtains temperature measurement.",
+    "hardware:sideChannelDefense": "Behaviours that protect against side-channel attacks.",
+    "hardware:sideChannelDefense:controlsEmEmissions": "The entity limits electromagnetic leakage.",
+    "hardware:sideChannelDefense:resistsFaultInjection": "The entity protects against induced faults.",
+    "hardware:sideChannelDefense:resistsPowerAnalysis": "The entity protects against power-based attacks.",
+    "hardware:sideChannelDefense:resistsTimingAnalysis": "The entity protects against timing-based attacks.",
+    "network": "Behaviours relating to network communication and data transmission between systems.",
+    "network:connection": "Behaviours that establish and manage network connections.",
+    "network:connection:acceptsConnection": "The entity receives an incoming connection.",
+    "network:connection:detectsConnectionLoss": "The entity identifies a dropped connection.",
+    "network:connection:establishesConnection": "The entity initiates a network connection.",
+    "network:connection:reconnects": "The entity re-establishes a dropped connection.",
+    "network:connection:reusesConnection": "The entity uses a pooled connection.",
+    "network:connection:sendsHeartbeat": "The entity transmits a keep-alive signal.",
+    "network:connection:terminatesConnection": "The entity closes a network connection.",
+    "network:discovery": "Behaviours that locate and advertise network services and resources.",
+    "network:discovery:advertisesService": "The entity announces its availability.",
+    "network:discovery:discoversService": "The entity locates an available service.",
+    "network:discovery:enumeratesInterfaces": "The entity lists network interfaces.",
+    "network:discovery:probesPort": "The entity checks if a port is open.",
+    "network:discovery:queriesDns": "The entity requests DNS resolution.",
+    "network:discovery:resolvesName": "The entity translates a name to an address.",
+    "network:discovery:scansNetwork": "The entity probes for active hosts or services.",
+    "network:protocol": "Behaviours that negotiate and implement communication protocols.",
+    "network:protocol:downgradesProtocol": "The entity falls back to a less secure protocol version.",
+    "network:protocol:framesMessage": "The entity structures data for transmission.",
+    "network:protocol:negotiatesProtocol": "The entity agrees on communication protocol with peer.",
+    "network:protocol:parsesMessage": "The entity interprets received network data.",
+    "network:protocol:retransmitsMessage": "The entity resends data after transmission failure.",
+    "network:protocol:upgradesProtocol": "The entity transitions to a more secure protocol version.",
+    "network:protocol:validatesMessage": "The entity verifies message format and integrity.",
+    "network:remoteInteraction": "Behaviours that execute operations on remote systems.",
+    "network:remoteInteraction:accessesRemoteDesktop": "The entity controls a remote graphical interface.",
+    "network:remoteInteraction:accessesRemoteShell": "The entity interacts with a remote command line.",
+    "network:remoteInteraction:executesRemoteCommand": "The entity runs a command on a remote system.",
+    "network:remoteInteraction:invokesRemoteProcedure": "The entity calls a function on a remote system.",
+    "network:remoteInteraction:sendsEmail": "The entity transmits an email message.",
+    "network:remoteInteraction:sendsSms": "The entity transmits a text message.",
+    "network:remoteInteraction:transfersFile": "The entity sends or receives a file remotely.",
+    "network:routing": "Behaviours that direct network traffic to its destination.",
+    "network:routing:configuresProxy": "The entity sets up traffic to route through a proxy.",
+    "network:routing:forwardsPacket": "The entity passes a packet toward its destination.",
+    "network:routing:redirectsTraffic": "The entity diverts traffic to a different destination.",
+    "network:routing:routesTraffic": "The entity directs network traffic to destinations.",
+    "network:routing:tunnelsTraffic": "The entity encapsulates traffic within another protocol.",
+    "network:trafficControl": "Behaviours that manage and manipulate network traffic flow.",
+    "network:trafficControl:balancesLoad": "The entity distributes requests across destinations.",
+    "network:trafficControl:filtersTraffic": "The entity blocks or allows traffic based on rules.",
+    "network:trafficControl:inspectsTraffic": "The entity examines traffic contents.",
+    "network:trafficControl:interceptsTraffic": "The entity captures traffic in transit.",
+    "network:trafficControl:limitsRate": "The entity restricts traffic volume.",
+    "network:trafficControl:modifiesTraffic": "The entity alters traffic in transit.",
+    "network:trafficControl:shapesTraffic": "The entity manages traffic timing and priority.",
+    "network:transmission": "Behaviours that send and receive data over network connections.",
+    "network:transmission:broadcastsData": "The entity sends data to multiple recipients.",
+    "network:transmission:multicastsData": "The entity sends data to a group of recipients.",
+    "network:transmission:receivesData": "The entity accepts data from the network.",
+    "network:transmission:sendsData": "The entity transmits data over the network.",
+    "network:transmission:streamsData": "The entity continuously transmits or receives data.",
+    "privacy": "Behaviours relating to the collection and processing of personal and sensitive data.",
+    "privacy:collection": "Behaviours that gather personal or sensitive information from individuals or systems.",
+    "privacy:collection:capturesAudio": "The entity records sound via microphone.",
+    "privacy:collection:capturesKeystrokes": "The entity records keyboard input.",
+    "privacy:collection:capturesScreen": "The entity records display contents.",
+    "privacy:collection:capturesVideo": "The entity records images via camera.",
+    "privacy:collection:collectsBehavioralData": "The entity records user actions and patterns.",
+    "privacy:collection:collectsBiometricData": "The entity captures biometric information.",
+    "privacy:collection:collectsCommunicationContent": "The entity captures message or call contents.",
+    "privacy:collection:collectsDeviceInformation": "The entity gathers device identifiers or characteristics.",
+    "privacy:collection:collectsFinancialData": "The entity gathers payment or financial information.",
+    "privacy:collection:collectsHealthData": "The entity gathers protected health information.",
+    "privacy:collection:collectsInBackground": "The entity gathers data without active user engagement.",
+    "privacy:collection:collectsLocationData": "The entity gathers geographical position information.",
+    "privacy:collection:collectsPersonalData": "The entity gathers personally identifiable information.",
+    "privacy:collection:collectsSilently": "The entity gathers data without user awareness.",
+    "privacy:collection:readsBrowserHistory": "The entity accesses web browsing history.",
+    "privacy:collection:readsClipboard": "The entity accesses clipboard contents.",
+    "privacy:deletion": "Behaviours that remove or destroy personal data.",
+    "privacy:deletion:clearsCache": "The entity removes data from temporary storage.",
+    "privacy:deletion:deletesPersonalData": "The entity removes personal data.",
+    "privacy:deletion:erasesSecurely": "The entity irreversibly destroys data.",
+    "privacy:deletion:purgesFromBackup": "The entity removes data from backup systems.",
+    "privacy:deletion:redactsData": "The entity removes specific content from records.",
+    "privacy:inference": "Behaviours that derive personal information through analysis and correlation of data.",
+    "privacy:inference:correlatesData": "The entity combines data from multiple sources.",
+    "privacy:inference:createsProfile": "The entity builds a profile from collected data.",
+    "privacy:inference:fingerprintsDevice": "The entity identifies device via characteristics.",
+    "privacy:inference:infersPersonalInformation": "The entity derives personal data from other data.",
+    "privacy:inference:linksIdentities": "The entity associates data across contexts.",
+    "privacy:inference:tracksUser": "The entity follows user activity across sessions.",
+    "privacy:minimization": "Behaviours that reduce the amount or sensitivity of personal data processed.",
+    "privacy:minimization:aggregatesData": "The entity combines records into summaries.",
+    "privacy:minimization:anonymizesData": "The entity removes identifying information.",
+    "privacy:minimization:filtersData": "The entity removes unnecessary data elements.",
+    "privacy:minimization:generalizesData": "The entity reduces data precision.",
+    "privacy:minimization:limitsCollection": "The entity gathers only necessary data.",
+    "privacy:minimization:limitsProcessing": "The entity restricts data use to stated purposes.",
+    "privacy:minimization:pseudonymizesData": "The entity replaces identifiers with pseudonyms.",
+    "privacy:privacyEnhancement": "Behaviours that employ technical measures to protect privacy during processing.",
+    "privacy:privacyEnhancement:addsDifferentialPrivacy": "The entity injects noise to protect individuals.",
+    "privacy:privacyEnhancement:computesMultiparty": "The entity performs joint computation privately.",
+    "privacy:privacyEnhancement:processesHomomorphically": "The entity computes on encrypted data.",
+    "privacy:privacyEnhancement:processesLocally": "The entity handles data on-device.",
+    "privacy:retention": "Behaviours that store personal data over time.",
+    "privacy:retention:archivesData": "The entity moves data to long-term storage.",
+    "privacy:retention:backsUpData": "The entity creates copies for recovery.",
+    "privacy:retention:enforcesRetentionPeriod": "The entity deletes data after specified time.",
+    "privacy:retention:retainsBeyondPurpose": "The entity keeps data longer than necessary.",
+    "privacy:retention:retainsInCache": "The entity keeps data in temporary storage.",
+    "privacy:retention:retainsInLog": "The entity keeps data in log files.",
+    "privacy:retention:storesPersonalData": "The entity saves personal data persistently.",
+    "privacy:sharing": "Behaviours that disclose personal data to third parties or across boundaries.",
+    "privacy:sharing:disclosesToThirdParty": "The entity transmits personal data externally.",
+    "privacy:sharing:exportsData": "The entity outputs data in portable format.",
+    "privacy:sharing:publishesData": "The entity makes data publicly available.",
+    "privacy:sharing:sellsData": "The entity provides data in exchange for value.",
+    "privacy:sharing:sharesWithAffiliate": "The entity provides data to related entities.",
+    "privacy:sharing:transfersCrossBorder": "The entity sends data across jurisdictions.",
+    "privacy:subjectRights": "Behaviours that fulfil data subject rights under privacy regulations.",
+    "privacy:subjectRights:correctsData": "The entity modifies inaccurate personal data.",
+    "privacy:subjectRights:exportsDataPortably": "The entity provides data in portable format.",
+    "privacy:subjectRights:honorsErasureRequest": "The entity deletes data upon request.",
+    "privacy:subjectRights:honorsObjection": "The entity ceases processing upon objection.",
+    "privacy:subjectRights:providesDataAccess": "The entity gives individuals their data.",
+    "privacy:subjectRights:restrictsProcessing": "The entity limits data use upon request.",
+    "privacy:transparency": "Behaviours that inform individuals about data processing activities.",
+    "privacy:transparency:disclosesProcessing": "The entity reveals data processing activities.",
+    "privacy:transparency:displaysPrivacyNotice": "The entity presents privacy information.",
+    "privacy:transparency:explainsAutomatedDecision": "The entity describes automated decision logic.",
+    "privacy:transparency:recordsConsent": "The entity stores consent decisions.",
+    "privacy:transparency:requestsConsent": "The entity asks for processing permission.",
+    "privacy:transparency:withdrawsConsent": "The entity processes consent revocation.",
+    "safety": "Behaviours relating to the prevention of harm to users and the environment.",
+    "safety:autonomousBehavior": "Behaviours that govern decision-making boundaries and human oversight of autonomous systems.",
+    "safety:autonomousBehavior:acceptsOverride": "The entity yields to human command.",
+    "safety:autonomousBehavior:enforcesHumanInLoop": "The entity requires human involvement.",
+    "safety:autonomousBehavior:explainsDecision": "The entity provides rationale for its action.",
+    "safety:autonomousBehavior:requestsGuidance": "The entity asks for human direction.",
+    "safety:autonomousBehavior:respectsDecisionBoundary": "The entity stays within authorised decision scope.",
+    "safety:contentSafety": "Behaviours that detect and filter harmful or inappropriate content.",
+    "safety:contentSafety:detectsHarmfulContent": "The entity identifies potentially harmful content.",
+    "safety:contentSafety:detectsMisinformation": "The entity identifies false or misleading content.",
+    "safety:contentSafety:enforcesAgeRestriction": "The entity limits access by user age.",
+    "safety:contentSafety:filtersContent": "The entity blocks or restricts content.",
+    "safety:contentSafety:labelsContent": "The entity marks content with warnings or ratings.",
+    "safety:harmPrevention": "Behaviours that actively protect users and bystanders from physical or psychological harm.",
+    "safety:harmPrevention:preventsEnvironmentalHarm": "The entity acts to protect the environment.",
+    "safety:harmPrevention:preventsPropertyDamage": "The entity acts to protect physical property.",
+    "safety:harmPrevention:preventsUserHarm": "The entity acts to protect users from injury.",
+    "safety:harmPrevention:protectsBystanders": "The entity considers safety of non-users.",
+    "safety:hazardManagement": "Behaviours that identify and mitigate potentially dangerous conditions.",
+    "safety:hazardManagement:assessesRisk": "The entity evaluates severity and likelihood of harm.",
+    "safety:hazardManagement:identifiesHazard": "The entity detects a potentially harmful condition.",
+    "safety:hazardManagement:mitigatesHazard": "The entity reduces hazard severity or likelihood.",
+    "safety:hazardManagement:reportsHazard": "The entity communicates a hazardous condition.",
+    "safety:humanInteraction": "Behaviours that manage communication and interaction with human operators.",
+    "safety:humanInteraction:adaptsForAccessibility": "The entity adjusts for users with disabilities.",
+    "safety:humanInteraction:managesCognitiveLoad": "The entity limits information to prevent overwhelm.",
+    "safety:humanInteraction:requestsConfirmation": "The entity requires human approval for action.",
+    "safety:humanInteraction:warnsOperator": "The entity alerts human to abnormal condition.",
+    "safety:operationalSafety": "Behaviours that enforce safe operating limits and conditions.",
+    "safety:operationalSafety:acceptsManualOverride": "The entity yields control to human operator.",
+    "safety:operationalSafety:enforcesInterlock": "The entity prevents unsafe operation combinations.",
+    "safety:operationalSafety:enforcesOperatingLimits": "The entity prevents operation outside safe bounds.",
+    "safety:operationalSafety:executesEmergencyStop": "The entity immediately halts dangerous operation.",
+    "safety:operationalSafety:monitorsWatchdog": "The entity checks for uncontrolled operation.",
+    "safety:operationalSafety:validatesSafetyCondition": "The entity confirms safe operating state.",
+    "security": "Behaviours relating to the protection of systems and data from unauthorised access and threats.",
+    "security:auditing": "Behaviours that record security-relevant events for accountability and forensic analysis.",
+    "security:auditing:logsEvent": "The entity records an occurrence.",
+    "security:auditing:logsSecurityEvent": "The entity records a security-relevant occurrence.",
+    "security:auditing:protectsAuditLog": "The entity prevents tampering with log records.",
+    "security:auditing:purgesLog": "The entity deletes old log records.",
+    "security:auditing:rotatesLog": "The entity archives and starts new log files.",
+    "security:auditing:signsLogEntry": "The entity cryptographically signs audit records.",
+    "security:auditing:timestampsEvent": "The entity records when an event occurred.",
+    "security:auditing:transmitsLog": "The entity sends log data to a remote destination.",
+    "security:authentication": "Behaviours that verify the identity of users and entities.",
+    "security:authentication:authenticatesDevice": "The entity confirms device identity.",
+    "security:authentication:authenticatesService": "The entity confirms service identity.",
+    "security:authentication:authenticatesUser": "The entity confirms user identity.",
+    "security:authentication:bypassesAuthentication": "The entity permits access without authentication.",
+    "security:authentication:capturesBiometric": "The entity collects biometric data for authentication.",
+    "security:authentication:delegatesAuthentication": "The entity relies on external identity provider.",
+    "security:authentication:failsAuthentication": "The entity rejects invalid credentials.",
+    "security:authentication:locksAccount": "The entity prevents further authentication attempts.",
+    "security:authentication:performsMultiFactorAuthentication": "The entity requires multiple authentication factors.",
+    "security:authentication:promptsForCredentials": "The entity requests authentication information.",
+    "security:authentication:unlocksAccount": "The entity restores authentication capability.",
+    "security:authentication:validatesBiometric": "The entity verifies biometric data.",
+    "security:authentication:validatesCredentials": "The entity verifies supplied credentials.",
+    "security:authorization": "Behaviours that determine and enforce access permissions.",
+    "security:authorization:checksPermission": "The entity verifies access rights.",
+    "security:authorization:delegatesAuthority": "The entity transfers access rights to another.",
+    "security:authorization:deniesAccess": "The entity refuses a requested action.",
+    "security:authorization:enforcesRole": "The entity restricts actions based on assigned role.",
+    "security:authorization:escalatesPrivilege": "The entity gains elevated permissions.",
+    "security:authorization:evaluatesAttributes": "The entity uses attributes for access decisions.",
+    "security:authorization:evaluatesPolicy": "The entity applies rules to make access decisions.",
+    "security:authorization:grantsAccess": "The entity permits a requested action.",
+    "security:authorization:grantsImpersonation": "The entity permits another to act within its security context.",
+    "security:authorization:impersonatesUser": "The entity performs actions within another user's security context.",
+    "security:authorization:requestsImpersonation": "The entity initiates a request to act as another user.",
+    "security:authorization:revokesAccess": "The entity withdraws previously granted permissions.",
+    "security:authorization:revokesImpersonation": "The entity terminates another's permission to act on its behalf.",
+    "security:cryptography": "Behaviours that employ cryptographic operations to protect data confidentiality and integrity.",
+    "security:cryptography:authenticates": "The entity verifies the identity of a user, process, or device.",
+    "security:cryptography:checksRevocation": "The entity queries certificate revocation status.",
+    "security:cryptography:decryptsData": "The entity restores encrypted data to readable form.",
+    "security:cryptography:decryptsDataAtRest": "The entity restores stored encrypted data to readable form.",
+    "security:cryptography:decryptsDataInTransit": "The entity restores data received over a network to readable form.",
+    "security:cryptography:decryptsDisk": "The entity unlocks and decrypts contents of an encrypted disk.",
+    "security:cryptography:decryptsSecret": "The entity retrieves and decrypts a secured credential or metadata.",
+    "security:cryptography:destroysKey": "The entity securely erases a key.",
+    "security:cryptography:encryptsData": "The entity transforms data to prevent unauthorised reading.",
+    "security:cryptography:encryptsDataAtRest": "The entity protects stored data by converting it to unreadable form.",
+    "security:cryptography:encryptsDataInTransit": "The entity protects data moving across a network.",
+    "security:cryptography:encryptsDisk": "The entity applies full-disk encryption to protect all data on a drive.",
+    "security:cryptography:encryptsSecret": "The entity secures sensitive credentials or metadata.",
+    "security:cryptography:ensuresAccountability": "The entity ensures actions can be traced to a specific individual or process.",
+    "security:cryptography:ensuresConfidentiality": "The entity protects sensitive information from unauthorised access.",
+    "security:cryptography:ensuresIntegrity": "The entity guarantees that data has not been altered or tampered with.",
+    "security:cryptography:ensuresNonRepudiation": "The entity provides proof of origin and integrity to prevent denial.",
+    "security:cryptography:exchangesKey": "The entity shares a key with another party.",
+    "security:cryptography:generatesKey": "The entity creates a cryptographic key.",
+    "security:cryptography:generatesRandomValue": "The entity produces a cryptographically secure random value.",
+    "security:cryptography:hashesData": "The entity generates a cryptographic hash.",
+    "security:cryptography:hashesPassword": "The entity applies a cryptographic hash function to a password.",
+    "security:cryptography:identifies": "The entity establishes a unique identity for an actor within the system.",
+    "security:cryptography:issuesCertificate": "The entity creates and signs a digital certificate.",
+    "security:cryptography:preservesPrivacy": "The entity protects personally identifiable information and user data.",
+    "security:cryptography:presentsClientCertificate": "The entity provides a client certificate for authentication.",
+    "security:cryptography:presentsServerCertificate": "The entity provides a server certificate for authentication.",
+    "security:cryptography:retrievesKey": "The entity obtains a stored key.",
+    "security:cryptography:revokesCertificate": "The entity invalidates a certificate.",
+    "security:cryptography:rotatesKey": "The entity replaces a key with a new one.",
+    "security:cryptography:signsCode": "The entity applies a digital signature to executable code.",
+    "security:cryptography:signsData": "The entity creates a digital signature.",
+    "security:cryptography:signsDocument": "The entity applies a digital signature to a document.",
+    "security:cryptography:storesKey": "The entity saves a key securely.",
+    "security:cryptography:usesIdentity": "The entity utilises established identity credentials for operations.",
+    "security:cryptography:validatesCertificate": "The entity verifies certificate authenticity.",
+    "security:cryptography:validatesToken": "The entity verifies the authenticity and expiration of a security token.",
+    "security:cryptography:verifiesCodeSignature": "The entity validates a digital signature on executable code.",
+    "security:cryptography:verifiesDataSignature": "The entity validates a digital signature on data.",
+    "security:cryptography:verifiesDocumentSignature": "The entity validates a digital signature on a document.",
+    "security:cryptography:verifiesHash": "The entity validates data against a hash.",
+    "security:cryptography:verifiesSignature": "The entity validates a digital signature.",
+    "security:cryptography:wrapsKey": "The entity encrypts a key for secure storage or transport.",
+    "security:errorHandling": "Behaviours that manage error conditions to prevent information disclosure.",
+    "security:errorHandling:catchesException": "The entity intercepts an error condition.",
+    "security:errorHandling:disclosesErrorDetails": "The entity reveals internal information in error messages.",
+    "security:errorHandling:failsClosed": "The entity denies access when controls fail.",
+    "security:errorHandling:failsOpen": "The entity permits access when controls fail.",
+    "security:errorHandling:generatesError": "The entity produces an error condition.",
+    "security:errorHandling:logsError": "The entity records an error condition.",
+    "security:errorHandling:propagatesError": "The entity passes an error to caller.",
+    "security:errorHandling:returnsGenericError": "The entity provides minimal error information.",
+    "security:errorHandling:suppressesError": "The entity hides an error condition.",
+    "security:inputHandling": "Behaviours that validate and sanitise input data to prevent injection attacks.",
+    "security:inputHandling:escapesInput": "The entity encodes special characters in input.",
+    "security:inputHandling:normalizesInput": "The entity converts input to standard form.",
+    "security:inputHandling:rejectsInvalidInput": "The entity refuses malformed or dangerous input.",
+    "security:inputHandling:sanitizesInput": "The entity removes potentially harmful content from input.",
+    "security:inputHandling:truncatesInput": "The entity shortens input to acceptable length.",
+    "security:inputHandling:validatesFormat": "The entity verifies input conforms to expected format.",
+    "security:inputHandling:validatesRange": "The entity ensures values fall within acceptable bounds.",
+    "security:inputHandling:validatesSchema": "The entity checks input against a defined schema.",
+    "security:integrity": "Behaviours that verify and protect the integrity of data and code.",
+    "security:integrity:attestsIntegrity": "The entity provides evidence of its own integrity.",
+    "security:integrity:detectsTampering": "The entity identifies modification attempts.",
+    "security:integrity:respondsToTampering": "The entity reacts to detected tampering.",
+    "security:integrity:validatesComponent": "The entity verifies authenticity of a dependency.",
+    "security:integrity:verifiesIntegrity": "The entity confirms data or code has not been altered.",
+    "security:integrity:verifiesProvenance": "The entity confirms origin and history.",
+    "security:outputHandling": "Behaviours that encode and filter output data to prevent information leakage.",
+    "security:outputHandling:encodesOutput": "The entity transforms output to prevent injection.",
+    "security:outputHandling:enforcesContentPolicy": "The entity restricts content sources.",
+    "security:outputHandling:escapesOutput": "The entity encodes special characters in output.",
+    "security:outputHandling:filtersOutput": "The entity removes sensitive content from output.",
+    "security:outputHandling:masksOutput": "The entity obscures sensitive data in output.",
+    "security:outputHandling:setsSecurityHeader": "The entity adds security-related HTTP headers.",
+    "security:session": "Behaviours that manage authenticated user sessions.",
+    "security:session:createsSession": "The entity establishes an authenticated session.",
+    "security:session:detectsSessionHijacking": "The entity identifies unauthorised session use.",
+    "security:session:invalidatesSession": "The entity revokes session validity.",
+    "security:session:refreshesSession": "The entity extends session lifetime.",
+    "security:session:regeneratesSessionId": "The entity creates a new session identifier.",
+    "security:session:terminatesSession": "The entity ends an authenticated session.",
+    "security:session:validatesSession": "The entity verifies session validity.",
+    "security:threatResponse": "Behaviours that detect and respond to security threats and incidents.",
+    "security:threatResponse:blocksRequest": "The entity refuses a suspicious request.",
+    "security:threatResponse:blocksSource": "The entity prevents further requests from a source.",
+    "security:threatResponse:collectsForensicData": "The entity gathers evidence for investigation.",
+    "security:threatResponse:detectsAnomaly": "The entity recognises deviation from normal patterns.",
+    "security:threatResponse:detectsIntrusion": "The entity identifies a potential security breach.",
+    "security:threatResponse:initiatesIncidentResponse": "The entity triggers security response procedures.",
+    "security:threatResponse:quarantinesElement": "The entity isolates a suspicious item.",
+    "security:threatResponse:raisesAlert": "The entity notifies of a security event.",
+    "system": "Behaviours relating to operating system interactions and the management of computational resources.",
+    "system:configuration": "Behaviours that read and modify system configuration settings.",
+    "system:configuration:deletesRegistryKey": "The entity removes entries from the registry.",
+    "system:configuration:modifiesGroupPolicy": "The entity changes group policy settings.",
+    "system:configuration:readsConfigurationFile": "The entity loads settings from a configuration file.",
+    "system:configuration:readsEnvironmentVariable": "The entity retrieves an environment variable value.",
+    "system:configuration:readsGroupPolicy": "The entity retrieves group policy settings.",
+    "system:configuration:readsRegistry": "The entity retrieves values from the system registry.",
+    "system:configuration:setsEnvironmentVariable": "The entity modifies an environment variable.",
+    "system:configuration:writesConfigurationFile": "The entity saves settings to a configuration file.",
+    "system:configuration:writesRegistry": "The entity stores values in the system registry.",
+    "system:informationGathering": "Behaviours that collect information about the host system and its configuration.",
+    "system:informationGathering:detectsOsVersion": "The entity determines the operating system version.",
+    "system:informationGathering:gathersSystemInformation": "The entity collects system configuration details.",
+    "system:informationGathering:queriesHardwareInformation": "The entity retrieves hardware specifications.",
+    "system:informationGathering:retrievesHostname": "The entity obtains the system hostname.",
+    "system:kernelInteraction": "Behaviours that interact directly with the operating system kernel.",
+    "system:kernelInteraction:hooksKernelFunction": "The entity intercepts kernel-level calls.",
+    "system:kernelInteraction:installsDriver": "The entity loads a kernel-mode driver.",
+    "system:kernelInteraction:readsKernelMemory": "The entity accesses kernel memory space.",
+    "system:kernelInteraction:writesKernelMemory": "The entity modifies kernel memory space.",
+    "system:lifecycle": "Behaviours associated with an entity's initialisation, operation, maintenance, and retirement.",
+    "system:lifecycle:appliesUpdate": "The entity installs software or firmware updates.",
+    "system:lifecycle:decommissions": "The entity securely retires from service.",
+    "system:lifecycle:initializes": "The entity performs start-up routines and loads configuration.",
+    "system:lifecycle:performsSelfTest": "The entity verifies its own operational readiness.",
+    "system:lifecycle:provisions": "The entity configures itself for deployment.",
+    "system:lifecycle:rollsBack": "The entity reverts to a previous known-good state.",
+    "system:lifecycle:shutsDown": "The entity executes orderly cessation of operations.",
+    "system:operationalState": "Behaviours that govern an entity's functional status and mode of operation.",
+    "system:operationalState:entersFailSafeState": "The entity transitions to a known safe state upon detecting a fault.",
+    "system:operationalState:entersFailSecureState": "The entity denies access or ceases sensitive operations upon detecting a security fault.",
+    "system:operationalState:operatesInDegradedMode": "The entity continues operation with reduced functionality.",
+    "system:operationalState:operatesNormally": "The entity performs its intended functions within designed parameters.",
+    "system:operationalState:performsEmergencyShutdown": "The entity immediately halts to prevent harm or damage.",
+    "system:persistence": "Behaviours that establish mechanisms for an entity to survive system restarts.",
+    "system:persistence:createsScheduledTask": "The entity schedules itself for recurring execution.",
+    "system:persistence:installsAsService": "The entity registers itself as a system service.",
+    "system:persistence:loadsAsKernelModule": "The entity loads itself into the kernel.",
+    "system:persistence:registersForStartup": "The entity configures itself to execute at system boot.",
+    "system:persistence:removesPersistence": "The entity removes its persistence mechanism.",
+    "system:processControl": "Behaviours that create and manipulate operating system processes.",
+    "system:processControl:createsProcess": "The entity starts a new process.",
+    "system:processControl:dumpsProcessMemory": "The entity extracts memory contents from a process.",
+    "system:processControl:enumeratesProcesses": "The entity lists running processes.",
+    "system:processControl:hooksFunction": "The entity intercepts and redirects function calls.",
+    "system:processControl:injectsCodeIntoProcess": "The entity inserts executable code into another process.",
+    "system:processControl:modifiesProcess": "The entity changes attributes of a running process.",
+    "system:processControl:resumesProcess": "The entity continues paused process execution.",
+    "system:processControl:suspendsProcess": "The entity pauses process execution.",
+    "system:processControl:terminatesProcess": "The entity ends a running process.",
+    "system:resilience": "Behaviours that enable an entity to detect faults and maintain operation despite adverse conditions.",
+    "system:resilience:activatesRedundancy": "The entity activates backup systems or alternative processing paths.",
+    "system:resilience:degradesGracefully": "The entity progressively reduces functionality rather than failing abruptly.",
+    "system:resilience:detectsFault": "The entity identifies an internal fault or anomalous condition.",
+    "system:resilience:recoversFromFailure": "The entity restores normal operation following a failure.",
+    "system:resilience:toleratesFault": "The entity continues operation despite the presence of a fault.",
+    "system:resourceManagement": "Behaviours that allocate and deallocate computational resources such as memory and threads.",
+    "system:resourceManagement:allocatesMemory": "The entity reserves memory for use.",
+    "system:resourceManagement:deallocatesMemory": "The entity releases previously allocated memory.",
+    "system:resourceManagement:handlesResourceExhaustion": "The entity responds to depleted resources.",
+    "system:resourceManagement:managesPowerState": "The entity transitions between power consumption states.",
+    "system:resourceManagement:readsFromStorage": "The entity retrieves data from persistent storage.",
+    "system:resourceManagement:resumesThread": "The entity continues paused thread execution.",
+    "system:resourceManagement:spawnsThread": "The entity creates a new execution thread.",
+    "system:resourceManagement:suspendsThread": "The entity pauses thread execution.",
+    "system:resourceManagement:terminatesThread": "The entity ends an execution thread.",
+    "system:resourceManagement:writesToStorage": "The entity saves data to persistent storage.",
+    "system:serviceControl": "Behaviours that manage system services and daemons.",
+    "system:serviceControl:createsService": "The entity installs a system service or daemon.",
+    "system:serviceControl:deletesService": "The entity removes a system service.",
+    "system:serviceControl:enumeratesServices": "The entity lists installed services.",
+    "system:serviceControl:modifiesService": "The entity changes service configuration.",
+    "system:serviceControl:startsService": "The entity initiates service execution.",
+    "system:serviceControl:stopsService": "The entity halts service execution.",
+    "system:synchronization": "Behaviours that coordinate access to shared resources across concurrent execution contexts.",
+    "system:synchronization:acquiresMutex": "The entity obtains exclusive access via mutex.",
+    "system:synchronization:releasesMutex": "The entity relinquishes mutex ownership.",
+    "system:synchronization:signalsEvent": "The entity triggers a synchronisation event.",
+    "system:synchronization:signalsSemaphore": "The entity releases a semaphore.",
+    "system:synchronization:waitsOnEvent": "The entity blocks until an event is signalled.",
+    "system:synchronization:waitsOnSemaphore": "The entity blocks until semaphore is available.",
+    "system:timing": "Behaviours that govern temporal aspects of execution including scheduling and synchronisation.",
+    "system:timing:delaysExecution": "The entity postpones an operation.",
+    "system:timing:enforcesDeadline": "The entity ensures completion within a timing constraint.",
+    "system:timing:executesScheduledTask": "The entity performs a task at a predetermined time.",
+    "system:timing:resetsWatchdog": "The entity signals continued operation to a watchdog monitor.",
+    "system:timing:synchronizesClock": "The entity aligns its internal clock with an external source.",
+    "system:timing:triggersTimeout": "The entity acts upon detecting an unresponsive condition.",
+    "system:timing:waits": "The entity pauses execution for a specified duration.",
+    "system:userManagement": "Behaviours that create and manipulate user accounts and privileges.",
+    "system:userManagement:createsUserAccount": "The entity adds a new user account.",
+    "system:userManagement:deletesUserAccount": "The entity removes a user account.",
+    "system:userManagement:elevatesPrivileges": "The entity gains higher access permissions.",
+    "system:userManagement:enumeratesUsers": "The entity lists user accounts.",
+    "system:userManagement:impersonatesUser": "The entity assumes another user's identity.",
+    "system:userManagement:modifiesUserAccount": "The entity changes user account properties."
+  }
+}