<?xml version="1.0" encoding="UTF-8"?>
<REQ-IF xmlns="http://www.omg.org/spec/ReqIF/20110401/reqif.xsd"
        xmlns:xhtml="http://www.w3.org/1999/xhtml">
  <THE-HEADER>
    <REQ-IF-HEADER IDENTIFIER="header-se-cybersec-ops-centre">
      <CREATION-TIME>2026-04-28T08:40:02.378Z</CREATION-TIME>
      <REQ-IF-TOOL-ID>AIRGen</REQ-IF-TOOL-ID>
      <REQ-IF-VERSION>1.0</REQ-IF-VERSION>
      <SOURCE-TOOL-ID>AIRGen</SOURCE-TOOL-ID>
      <TITLE>se-cybersec-ops-centre</TITLE>
    </REQ-IF-HEADER>
  </THE-HEADER>
  <CORE-CONTENT>
    <REQ-IF-CONTENT>
      <DATATYPES>
        <DATATYPE-DEFINITION-STRING IDENTIFIER="string-type" LAST-CHANGE="2026-04-28T08:40:02.378Z" MAX-LENGTH="65535"/>
        <DATATYPE-DEFINITION-INTEGER IDENTIFIER="int-type" LAST-CHANGE="2026-04-28T08:40:02.378Z" MIN="0" MAX="100"/>
      </DATATYPES>
      <SPEC-TYPES>
        <SPEC-OBJECT-TYPE IDENTIFIER="req-type" LAST-CHANGE="2026-04-28T08:40:02.378Z">
          <SPEC-ATTRIBUTES>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-ref" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Reference">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-text" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Text">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-rationale" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Rationale">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-pattern" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="EARS Pattern">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-verification" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Verification Method">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-INTEGER IDENTIFIER="attr-qaScore" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="QA Score">
              <TYPE><DATATYPE-DEFINITION-INTEGER-REF>int-type</DATATYPE-DEFINITION-INTEGER-REF></TYPE>
            </ATTRIBUTE-DEFINITION-INTEGER>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-complianceStatus" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Compliance Status">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-complianceRationale" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Compliance Rationale">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-tags" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Tags">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
          </SPEC-ATTRIBUTES>
        </SPEC-OBJECT-TYPE>
        <SPEC-RELATION-TYPE IDENTIFIER="trace-link-type" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Trace Link">
          <SPEC-ATTRIBUTES>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-linkType" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Link Type">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-linkDescription" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Description">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-linkRationale" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Rationale">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
          </SPEC-ATTRIBUTES>
        </SPEC-RELATION-TYPE>
        <SPECIFICATION-TYPE IDENTIFIER="spec-type" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Document">
          <SPEC-ATTRIBUTES>
            <ATTRIBUTE-DEFINITION-STRING IDENTIFIER="attr-docName" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Document Name">
              <TYPE><DATATYPE-DEFINITION-STRING-REF>string-type</DATATYPE-DEFINITION-STRING-REF></TYPE>
            </ATTRIBUTE-DEFINITION-STRING>
          </SPEC-ATTRIBUTES>
        </SPECIFICATION-TYPE>
        <RELATION-GROUP-TYPE IDENTIFIER="linkset-type" LAST-CHANGE="2026-04-28T08:40:02.378Z" LONG-NAME="Document Linkset"/>
      </SPEC-TYPES>
      <SPEC-OBJECTS>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:ARC-ARC-RAT-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="ARC-ARC-RAT-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL employ a SIEM-centric hub-and-spoke architecture where the SIEM Engine acts as the central correlation point, receiving telemetry from all detection subsystems (NSM, EDR, IAM, VMS) and forwarding correlated alerts to the SOAR Platform for automated and analyst-driven response.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Hub-and-spoke with SIEM as the central correlator was selected over a fully-meshed subsystem topology because it reduces integration complexity from O(n^2) to O(n) interfaces, concentrates log retention and forensic search in one store, and provides a single correlation context across all detection domains. The alternative — distributed correlation at each subsystem — was rejected due to increased latency for cross-domain detections and duplicated storage costs.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Analysis">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL transmit correlated alert packages to the SOAR Platform via a message queue interface, with each package containing the triggering events, matched rule identifiers, affected asset inventory records, and threat intelligence enrichment data, delivered within 10 seconds of correlation completion.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM-to-SOAR alert handoff is the critical transition from detection to response. The 10-second delivery SLA ensures automated playbooks can execute within the 60-second response target (SYS-SYS-RESPOND-004). Including matched rule identifiers and threat intelligence enrichment in the package eliminates SOAR round-trip queries that would add latency and coupling.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-002" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-002">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Endpoint Detection and Response Subsystem SHALL stream endpoint telemetry to the SIEM Engine in Common Event Format (CEF) or Elastic Common Schema (ECS), including process creation, file modification, registry changes, and network connection events, at a sustained rate matching the endpoint fleet size without event loss.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Endpoint telemetry is the primary data source for host-based threat detection. CEF/ECS format standardisation enables correlation with network-layer events in the SIEM without per-vendor normalisation logic. Zero-loss streaming is required because adversary dwell-time indicators (process trees, registry modifications) are ephemeral and unrecoverable if dropped.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-003" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-003">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Threat Intelligence Platform SHALL push updated indicator-of-compromise watchlists to the SIEM Engine within 5 minutes of indicator ingestion, using STIX 2.1 bundle format, including indicator type, confidence score, TLP marking, and associated threat actor attribution where available.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IoC freshness directly determines detection effectiveness against active campaigns. The 5-minute push interval balances operational urgency with TIP processing overhead for deduplication, confidence scoring, and TLP compliance. STIX 2.1 is mandated by NIS2 information-sharing requirements and interoperability with government CERTs.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-004" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-004">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOAR Platform SHALL issue containment commands to the Endpoint Detection and Response Subsystem via an authenticated REST API, supporting network isolation, process termination, and file quarantine actions, with command acknowledgement returned within 5 seconds and execution confirmation within the 30-second containment SLA.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Automated containment via SOAR-to-EDR API is the mechanism that achieves the 30-second containment SLA (SYS-SYS-RESPOND-003). The 5-second acknowledgement confirms the EDR agent received the command, distinguishing command delivery failures from execution failures. Network isolation, process termination, and file quarantine are the three containment primitives that cover 95% of MITRE ATT&amp;CK response actions.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-005" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-005">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Network Security Monitoring Subsystem SHALL forward IDS alerts, DNS query logs, and NetFlow metadata to the SIEM Engine in near-real-time with end-to-end latency not exceeding 30 seconds, tagging each event with the originating network segment identifier and sensor location.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Network-layer visibility provides detection coverage for threats invisible to endpoint agents (lateral movement, C2 beaconing, DNS exfiltration). The 30-second latency ceiling ensures IDS alerts reach the SIEM before automated response windows expire. Segment tagging is essential for correlating network events to asset inventory and establishing blast radius during incidents.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-006" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-006">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Identity and Access Monitoring Subsystem SHALL stream authentication events, privilege escalation attempts, and UEBA anomaly alerts to the SIEM Engine in Elastic Common Schema format, with event delivery latency not exceeding 15 seconds from event occurrence and including user principal name, source IP, authentication method, and risk score for each event.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Identity-based attacks (credential stuffing, privilege escalation, lateral movement via stolen tokens) account for over 60% of enterprise breaches. The 15-second delivery SLA ensures UEBA anomaly alerts reach the SIEM fast enough to correlate with concurrent network and endpoint indicators. ECS format ensures consistent schema with EDR telemetry for cross-domain correlation.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="interface; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-007" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-007">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Vulnerability Management System SHALL export vulnerability scan results and asset risk scores to the SIEM Engine via a scheduled API integration at intervals not exceeding 1 hour, with each record including CVE identifiers, CVSS base and environmental scores, affected asset identifiers, and remediation status.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Vulnerability context enriches SIEM correlation by linking observed exploit attempts to known vulnerable assets, enabling prioritised alerting. The 1-hour integration interval balances scan result freshness with API rate limits on vulnerability scanners. CVSS environmental scores (not just base) are required for risk-adjusted prioritisation against the organisation's specific attack surface.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="interface; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-IFC-EXTERNAL-008" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-008">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOAR Platform SHALL create and update incident tickets in the IT Service Management system via a bidirectional REST API integration, with ticket creation occurring within 60 seconds of incident declaration, including severity, affected assets, containment actions taken, and remediation tasks, and SHALL receive ticket status updates to maintain incident timeline synchronisation.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="ITSM integration is the boundary between SOC incident response and organisational IT remediation workflows. The 60-second ticket creation SLA ensures affected asset owners are notified before containment actions cause service disruptions. Bidirectional synchronisation prevents timeline divergence between the SOAR case record and the ITSM ticket, which undermines post-incident review accuracy.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="external; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-DEFS-009" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-009">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Threat Intelligence Platform SHALL expose a synchronous enrichment API to the SOAR Platform, accepting indicator queries (IP, domain, hash, URL) and returning confidence score, associated threat actor, TLP marking, and related indicators within 2 seconds per query, supporting a sustained query rate of at least 100 queries per minute during active incident response.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="During incident response, SOAR playbooks need real-time indicator enrichment to make automated triage and containment decisions. Without a direct TIP-to-SOAR query interface, analysts must manually pivot to the TIP, adding minutes to response time. The 2-second SLA ensures playbook execution stays within the 60-second automated response target. The 100 qpm rate supports large-scale incidents.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="interface; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:IFC-DEFS-010" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IFC-IFC-INTERNAL-010">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOAR Platform SHALL issue network-level containment commands to the Network Security Monitoring Subsystem via an authenticated API, supporting IP address blocking, VLAN isolation, and DNS sinkhole actions, with command acknowledgement within 5 seconds and enforcement at the network perimeter within 30 seconds of command issuance.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Endpoint containment alone (IFC-INTERNAL-004) is insufficient for threats from unmanaged devices, IoT, or OT assets without EDR agents. Network-level containment through firewall rule insertion, VLAN isolation, or DNS sinkholing provides a complementary containment vector. The 30-second enforcement SLA matches EDR containment for consistent response timing. Cross-domain analog: naval CMS uses both close-in and area-defence engagement layers.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="interface; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL detect cyber threats targeting the organisation's IT and OT infrastructure with a mean time to detect (MTTD) not exceeding 15 minutes for high-severity incidents.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="MTTD of 15 minutes for high-severity incidents derives from MITRE ATT&amp;CK dwell-time analysis: adversaries completing lateral movement within 30-60 minutes of initial compromise means detection must occur in the first half of that window to enable effective containment. Exceeding 15 minutes significantly increases the probability of privilege escalation and data exfiltration.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-002" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-002">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL contain confirmed security incidents within 60 minutes of detection for critical-severity incidents and within 4 hours for high-severity incidents.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Containment timelines of 60 minutes (critical) and 4 hours (high) are derived from the NIST SP 800-61 incident response lifecycle and align with insurance underwriter expectations. Critical incidents (ransomware, active intrusion) require sub-hour containment to prevent encryption propagation or data exfiltration at scale.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-003" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-003">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL comply with NIST Cybersecurity Framework, ISO 27001, and all applicable sector-specific cyber security regulations in the jurisdictions where the organisation operates.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Regulatory compliance is a non-negotiable operational requirement. NIST CSF provides the detection and response framework, ISO 27001 the management system baseline, and sector-specific regulations (e.g., NIS2 for critical infrastructure, PCI-DSS for payment processing) impose additional controls with legal penalties for non-compliance.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-004" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-004">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL operate continuously 24 hours per day, 7 days per week, 365 days per year with no planned downtime exceeding 30 minutes per quarter.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Cyber attacks are not bounded by business hours; adversaries deliberately operate during off-peak periods when monitoring attention is lowest. The 30-minute quarterly maintenance window constrains planned downtime to what can be achieved with rolling upgrades and hot-standby failover, maintaining continuous threat detection coverage.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-005" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-005">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL maintain visibility across all organisational IT assets, OT systems, cloud workloads, and remote access infrastructure, with no asset remaining unmonitored for more than 7 days after deployment.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Unmonitored assets are the primary vector for undetected compromise. The 7-day onboarding window balances operational reality (new asset provisioning, network registration, agent deployment) against the risk window. Complete asset visibility is foundational — detection rules and vulnerability scans are ineffective against assets the SOC cannot see.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-006" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-006">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL incorporate current cyber threat intelligence from at least 10 independent sources to inform detection rules, prioritise vulnerabilities, and contextualise alerts with threat actor attribution.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Requiring 10+ independent intelligence sources ensures coverage diversity across commercial threat feeds (e.g., Recorded Future, Mandiant), open-source feeds (e.g., MISP communities, abuse.ch), government advisories (CISA, NCSC), and sector-specific ISACs. Single-source reliance creates blind spots for threats outside that vendor's collection aperture.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-007" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-007">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL generate regulatory breach notifications within the timeframes mandated by applicable law, including GDPR 72-hour notification and NIS2 24-hour early warning, and SHALL produce executive incident summaries within 4 hours of incident declaration.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="GDPR Article 33 mandates 72-hour notification to supervisory authorities; NIS2 Article 23 requires 24-hour early warning. Failure to meet these timelines carries statutory penalties (up to 2% of global turnover under NIS2). The 4-hour executive summary enables incident commander decision-making during the critical early phase of response.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:STK-NEEDS-008" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-STK-NEEDS-008">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL support monitoring of up to 100,000 endpoints and 500 network segments without degradation in detection performance, and SHALL accommodate 25% annual growth in monitored assets without architectural redesign.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="100,000 endpoints and 500 network segments represent a large enterprise baseline. The 25% annual growth accommodation prevents architectural redesign cycles that would introduce detection coverage gaps during migration. Without this headroom, SOC infrastructure becomes the bottleneck during acquisitions, cloud migrations, or rapid expansion.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Analysis">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="stakeholder; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL provide an ad-hoc threat hunting query interface supporting structured and unstructured searches across all ingested telemetry types, with query response time not exceeding 30 seconds for searches spanning the full 90-day hot storage window, and SHALL support saved hunt hypotheses linked to MITRE ATT&amp;CK technique identifiers.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Derives from SYS-SYS-DETECT-013 threat hunting requirement. 30-second query latency matches the parent requirement and is driven by analyst workflow studies showing that interactive threat hunting degrades when query round-trip exceeds 30 seconds. Saved hypothesis linkage to ATT&amp;CK enables systematic coverage tracking across hunt campaigns.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine correlation module SHALL evaluate all ingested events against the active detection rule set within 120 seconds of ingestion, applying both signature-based and statistical anomaly detection, and SHALL maintain a detection rule library of at least 500 rules mapped to MITRE ATT&amp;CK technique identifiers.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="120-second correlation window derives from the parent SYS-SYS-DETECT-001 alert SLA. 500-rule minimum ensures coverage of the top 100 ATT&amp;CK techniques with multiple detection approaches per technique. Without ATT&amp;CK mapping, coverage gap analysis is impossible during purple team exercises.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-002" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-002">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL implement alert suppression, deduplication, and correlation grouping to reduce raw alert volume by at least 80% before analyst presentation, maintaining a per-analyst actionable alert queue not exceeding 25 active alerts per 8-hour shift, with suppression rules configurable per detection rule and auditable for false negative review.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Derives from SYS-SYS-DETECT-014. The 25-alert-per-analyst threshold is based on cognitive load research showing SOC analyst effectiveness drops sharply above 3-4 alerts per hour. 80% reduction target reflects industry benchmarks for mature SIEM tuning. Auditability of suppression rules is critical to prevent false negatives from hiding in suppression logic.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Analysis">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-002" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-002">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine log ingestion pipeline SHALL normalise events from at least 15 distinct log source types (including Windows Event Log, syslog, CEF, ECS, cloud audit trails, and firewall logs) into a unified internal schema within 5 seconds of receipt, preserving all original fields in a raw payload attachment.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOC monitors heterogeneous infrastructure spanning Windows, Linux, cloud, and network appliances. 15 source types covers the typical enterprise log diversity. The 5-second normalisation ceiling is derived from the 120-second end-to-end correlation SLA with budget reserved for correlation and alerting. Raw payload preservation is required for forensic integrity — normalisation is lossy by design.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SUB-SUB-SOAR-003" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-003">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="When the SIEM Engine is unavailable or operating at degraded capacity, the SOAR Platform SHALL activate direct alert ingestion channels from the EDR, NSM, and IAM subsystems, maintaining detection capability for at least the top 50 MITRE ATT&amp;CK techniques at a minimum 60% detection rate relative to nominal SIEM-mediated operation, with analyst notification within 2 minutes of SIEM degradation onset.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Derives from SYS-REQS-017 degraded-mode detection requirement. The 60% detection floor and top-50 ATT&amp;CK technique scope match the parent requirement. Placing this capability in the SOAR subsystem reflects the SOAR's role as the operational workflow engine — it must be able to receive alerts even when the SIEM correlation backbone is down. The 2-minute notification threshold ensures analysts know they are operating in degraded mode.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-003" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-003">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine storage tier SHALL support a minimum hot storage capacity of 50 TB with indexed full-text search returning results within 30 seconds for queries spanning the full 90-day hot retention window, and SHALL automatically tier data to warm storage after 90 days with query response time not exceeding 5 minutes.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="50 TB hot capacity is derived from 150K EPS at average 500-byte event size over 90 days (approximately 48 TB). The 30-second search SLA supports the threat hunting interface requirement (SYS-SYS-DETECT-013). Warm tiering with 5-minute response enables historical forensic investigation without the cost of maintaining all data in hot indices.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SUB-SUB-INFRA-004" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-004">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOC Facility Infrastructure SHALL maintain a documented disaster recovery capability including a secondary SOC site or cloud-hosted failover environment, achieving a recovery time objective of 4 hours and recovery point objective of 1 hour for all SIEM correlation data, SOAR case state, and detection rule configurations, with DR procedures tested semi-annually.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Derives from SYS-SYS-INFRA-016 disaster recovery requirement. The 4-hour RTO and 1-hour RPO match the parent requirement. Recovery must preserve SIEM correlation data, SOAR case state, and detection rules because loss of any one of these renders the SOC operationally blind (data), uncoordinated (cases), or undefended (rules). Semi-annual testing is the minimum cadence for DR validation in security-critical infrastructure.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-004" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-004">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOAR Platform playbook engine SHALL support at least 50 automated response playbooks covering the top 20 MITRE ATT&amp;CK techniques by prevalence, with each playbook executing from trigger to completion within 60 seconds for fully automated actions and presenting analyst decision points within 10 seconds for semi-automated actions.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="50 playbooks derives from covering 20 ATT&amp;CK techniques with 2-3 response variants each (e.g., network isolation vs process kill for lateral movement). The 60-second execution SLA flows from the parent SYS-SYS-RESPOND-004. The 10-second decision point presentation ensures analysts are not blocked waiting for the SOAR UI to render containment options during active incidents.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-005" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-005">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOAR Platform case management module SHALL maintain a complete incident timeline for each case, linking all associated alerts, containment actions, analyst annotations, and evidence artefacts, with case data retained for a minimum of 2 years and exportable in a machine-readable format for regulatory reporting.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Incident case records are the primary evidence artefact for regulatory compliance under NIS2 Article 23 and GDPR Article 33. The 2-year retention aligns with the longest applicable regulatory lookback period. Machine-readable export is required for automated submission to national CSIRTs and for integration with GRC platforms.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-006" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-006">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Endpoint Detection and Response agent SHALL collect process creation, file modification, registry change, network connection, and loaded module events from all managed endpoints, with agent CPU utilisation not exceeding 3% average and 8% peak on the endpoint during normal operations.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The five telemetry categories cover the minimum observable events for detecting the MITRE ATT&amp;CK execution, persistence, and discovery tactics. The 3%/8% CPU constraint prevents the EDR agent from degrading endpoint user productivity — exceeding this threshold triggers shadow IT workarounds where users disable the agent, creating detection blind spots.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-007" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-007">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Endpoint Detection and Response Subsystem SHALL execute endpoint isolation (network quarantine) within 30 seconds of receiving a containment command from the SOAR Platform, and SHALL maintain a local event buffer of at least 72 hours of endpoint telemetry accessible for forensic collection from isolated endpoints.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The 30-second isolation SLA derives directly from SYS-SYS-RESPOND-003. The 72-hour local buffer ensures that when an endpoint is network-isolated for containment, forensic investigators can still retrieve pre-isolation telemetry without requiring network connectivity — critical for determining initial access vector and lateral movement paths.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-008" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-008">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Threat Intelligence Platform SHALL deduplicate, score, and normalise indicators from all configured feeds within 5 minutes of ingestion, assigning each indicator a confidence score based on source reliability, corroboration count, and age decay, and SHALL automatically retire indicators whose confidence falls below 20% or whose age exceeds the feed-specific TTL.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Raw threat intelligence feeds contain 30-60% duplicate indicators across sources. Without deduplication and confidence scoring, the SIEM detection rule set grows unboundedly, increasing false positive rates and correlation processing load. The 5-minute processing window aligns with the IFC-IFC-INTERNAL-003 push interval. Automatic retirement prevents stale indicators from generating false positives months after a campaign ends.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-009" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-009">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Network Security Monitoring Subsystem SHALL deploy IDS sensors on all monitored network segments with signature and protocol anomaly detection, maintaining a signature database of at least 30,000 rules updated within 24 hours of vendor release, and SHALL capture full PCAP at aggregate line rate for a minimum rolling retention of 72 hours on each monitored segment.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="30,000 IDS rules reflects the current Emerging Threats/Suricata rule set size needed for comprehensive network threat detection. 24-hour signature update SLA prevents exploitation windows for disclosed vulnerabilities. 72 hours of PCAP retention at full line rate provides the forensic evidence window needed to reconstruct network-level attack chains, including lateral movement and data exfiltration, after initial detection.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-010" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-010">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Identity and Access Monitoring Subsystem SHALL baseline normal authentication patterns per user entity across all monitored identity providers and SHALL generate anomaly alerts when login behaviour deviates beyond 2 standard deviations from the 30-day rolling baseline, including impossible travel, credential stuffing patterns, and service account misuse.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="UEBA baselining per user entity is the primary mechanism for detecting compromised credentials, which are used in over 60% of enterprise breaches. The 2-sigma threshold balances detection sensitivity against false positive volume. The 30-day rolling window adapts to legitimate behavioural changes (travel, role changes) while still detecting acute anomalies. Impossible travel and service account misuse are the highest-value identity-based detections.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-011" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-011">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Vulnerability Management System SHALL maintain a continuously updated asset inventory with at least 99% coverage of all IT and OT assets, and SHALL prioritise vulnerabilities using a risk-based scoring model that incorporates CVSS environmental scores, asset criticality, internet exposure, and active exploitation intelligence from the Threat Intelligence Platform.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Vulnerability prioritisation without asset context leads to alert fatigue — a critical CVSS score on a sandboxed test server does not warrant the same urgency as a medium-severity vulnerability on an internet-facing payment gateway. Integration with TIP exploitation intelligence ensures actively weaponised vulnerabilities are prioritised above theoretical risks. 99% asset coverage is required because unmanaged assets are the primary attack surface blind spot.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-012" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-012">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Communications and Reporting Subsystem SHALL generate automated daily operational dashboards, weekly executive summaries, and ad-hoc regulatory breach notifications, with each report type following a pre-approved template, and SHALL distribute reports via encrypted email and secure web portal within 5 minutes of generation trigger.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Regulatory reporting cadence (daily ops, weekly exec, ad-hoc breach) derives from NIS2 Article 23 notification requirements and ISO 27001 management review obligations. Pre-approved templates prevent ad-hoc formatting that could omit mandatory fields or disclose information beyond the TLP marking. The 5-minute distribution SLA ensures breach notifications reach stakeholders within the overall 30-minute notification budget (SYS-SYS-DATA-009).">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-013" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SUB-SUB-SIEM-013">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOC Facility Infrastructure SHALL provide physical access control using multi-factor authentication (badge plus biometric) with access logging, CCTV coverage of all SOC work areas with 30-day recording retention, and a secure evidence storage room with independent access controls for forensic media and chain-of-custody documentation.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Physical security of the SOC facility is a prerequisite for trustworthy security operations — an adversary with physical access to SOC infrastructure can compromise detection capabilities. MFA for physical access aligns with ISO 27001 Annex A.11. The evidence storage room with independent access controls maintains forensic chain-of-custody required for legal proceedings following a breach.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL correlate ingested security events against detection rules and produce alerts within 120 seconds of event ingestion for rule-based detections and within 300 seconds for behavioural anomaly detections.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The 120-second rule-based and 300-second behavioural detection windows derive from the 15-minute MTTD stakeholder requirement (STK-NEEDS-001). Correlation must complete well within the MTTD budget to leave time for alert triage, enrichment, and analyst notification. Behavioural analytics require longer windows due to baseline comparison computation.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-002" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-002">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL sustain ingestion of at least 150,000 events per second at steady state and absorb bursts of up to 500,000 events per second for periods of up to 10 minutes without event loss or increased correlation latency.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="150K EPS steady-state derives from 100K endpoints generating an average of 1.5 events/sec each across OS telemetry, EDR, network flow, and authentication logs. The 500K EPS burst capacity accommodates incident-triggered log surges (e.g., mass scanning, worm propagation) when event volumes spike 3-4x. Event loss during these bursts would create detection blind spots precisely when they are most dangerous.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-003" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-003">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Endpoint Detection and Response subsystem SHALL execute remote endpoint containment actions (network isolation, process termination) within 30 seconds of command issuance by the SOAR platform or analyst console.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="30-second containment execution derives from the 60-minute critical incident containment target (STK-NEEDS-002). Automated containment actions (network isolation, process kill) must execute near-instantly once the decision is made, as each second of delay allows additional lateral movement, data staging, or encryption. The 30-second ceiling accounts for agent communication latency across WAN-connected endpoints.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-004" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-004">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOAR Platform SHALL execute automated response playbooks for known alert categories within 60 seconds of alert receipt, and SHALL route alerts requiring human judgement to the appropriate analyst tier within 120 seconds.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="60-second automated playbook execution for known alert types reduces analyst cognitive load and ensures consistent response for high-volume, well-understood threats (phishing, malware beaconing, brute-force). The 120-second routing SLA for human-judgement alerts ensures tier-appropriate analyst engagement before the MTTD budget is consumed.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-005" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-005">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Threat Intelligence Platform SHALL ingest and normalise indicators from at least 20 intelligence feeds using STIX/TAXII 2.1, with feed update intervals not exceeding 4 hours for commercial feeds and 1 hour for critical advisories.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="20 feeds exceeds the 10-source stakeholder minimum (STK-NEEDS-006) to provide the TIP with sufficient indicator volume for cross-correlation. STIX/TAXII 2.1 is the OASIS standard for structured threat intelligence exchange, ensuring interoperability across commercial and government feeds. The 4-hour/1-hour update intervals balance API rate limits against indicator freshness for critical advisories (e.g., zero-day IOCs).">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-006" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-006">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL retain searchable security event logs for a minimum of 90 days in hot storage and 365 days in warm storage, with archived logs retrievable within 4 hours for forensic investigation.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="90-day hot storage enables immediate forensic investigation of incidents discovered during routine threat hunting or retrospective IOC matching. 365-day warm storage satisfies regulatory retention requirements (ISO 27001 A.12.4, PCI-DSS Requirement 10.7). The 4-hour retrieval SLA for archived logs supports investigation timelines without requiring cost-prohibitive all-hot architectures.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-007" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-007">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Vulnerability Management System SHALL scan 100% of IT assets on a rolling 7-day cycle and 100% of OT assets on a rolling 30-day cycle, maintaining a real-time asset inventory with accuracy of 98% or greater.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="7-day IT scan cycle aligns with common vulnerability disclosure timelines and patch management SLAs. 30-day OT cycle reflects operational constraints — OT systems often cannot tolerate active scanning during production windows. 98% asset inventory accuracy ensures vulnerability coverage aligns with actual deployed infrastructure, preventing false confidence from scanning stale asset lists.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-008" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-008">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre platform SHALL achieve 99.95% availability measured monthly, with no single point of failure in the detection and alerting pipeline from event ingestion through analyst notification.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="99.95% monthly availability allows approximately 22 minutes of unplanned downtime per month, consistent with Tier 3+ data centre SLAs and the 30-minute quarterly planned maintenance window (STK-NEEDS-004). The no-single-point-of-failure requirement ensures that component failure in the detection pipeline does not create an unmonitored window exploitable by adversaries.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Analysis">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-009" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-009">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Communications and Reporting Subsystem SHALL generate pre-populated regulatory breach notification documents within 30 minutes of incident classification, covering GDPR Article 33, NIS2 Directive Article 23, and applicable sector-specific templates.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="30-minute notification document generation directly supports the GDPR 72-hour and NIS2 24-hour regulatory timelines (STK-NEEDS-007). Pre-populated templates eliminate the risk of incomplete mandatory fields under time pressure. GDPR Article 33, NIS2 Article 23, and sector templates must be maintained as living documents reflecting current regulatory interpretations.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-010" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-010">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Network Security Monitoring Subsystem SHALL capture full packet data on all monitored network segments at aggregate throughput of 10 Gbps, retaining packet captures for a minimum of 72 hours, and SHALL process IDS signatures with update latency not exceeding 4 hours from rule publication.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Full packet capture at 10 Gbps aggregate provides forensic evidence for incident investigation that metadata-only approaches cannot — payload inspection, protocol anomaly analysis, and malware sample extraction. 72-hour retention covers the typical investigation initiation window. 4-hour IDS rule update latency ensures signature coverage for newly disclosed vulnerabilities within the same operational cycle as vendor advisory publication.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-011" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-011">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Identity and Access Monitoring Subsystem SHALL perform User and Entity Behaviour Analytics across all Active Directory, Azure AD, and PAM authentication events, detecting credential compromise indicators with a false positive rate not exceeding 5% of total identity alerts.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Identity is the primary attack surface in modern enterprise environments — over 80% of breaches involve credential compromise (Verizon DBIR). UEBA across AD, Azure AD, and PAM covers the full authentication surface. The 5% false positive ceiling ensures analyst trust in identity alerts; higher rates lead to alert fatigue and missed true positives in the identity domain.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-012" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-012">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SOC Facility Infrastructure SHALL provide uninterruptible power for a minimum of 72 hours using UPS and backup generators, maintain physical access control with two-factor authentication, and sustain operations during loss of primary commercial power or primary internet connectivity.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="72-hour UPS/generator runtime covers extended utility outages during severe weather events or grid failures, maintaining SOC operations during the period when cyber threats may increase (adversaries exploit infrastructure disruptions). Two-factor physical access prevents unauthorised facility entry that could enable physical tampering with SOC infrastructure, keyboard loggers, or insider threat scenarios.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="system; session-291">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-013" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-013">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL provide an interactive threat hunting interface supporting ad-hoc queries across all ingested telemetry with query response time not exceeding 30 seconds for searches spanning 7 days of data, and SHALL maintain a library of at least 50 reusable hunt hypotheses mapped to MITRE ATT&amp;CK techniques.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Threat hunting addresses the detection gap between known-bad indicators (covered by detection rules) and novel adversary TTPs. The 30-second query response time over 7-day windows ensures analysts can iterate on hunt hypotheses without workflow disruption. The 50-hypothesis library mapped to ATT&amp;CK ensures coverage of common adversary technique chains even with analyst turnover.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="detection; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-014" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-014">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine SHALL implement alert suppression, deduplication, and correlation grouping to maintain a per-analyst alert volume not exceeding 25 actionable alerts per hour during steady-state operations, and SHALL provide tuning metrics showing false positive rates per detection rule category on a rolling 30-day basis.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Without alert tuning, SOC analysts face alert fatigue that degrades detection effectiveness. The 25-alert/hour/analyst ceiling is derived from cognitive load research showing analyst accuracy drops below 80% above this threshold. Rolling 30-day false-positive metrics per rule category enable evidence-based tuning decisions and prevent regression when new detection rules are deployed.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="detection; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-015" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-015">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL encrypt all security event data in transit using TLS 1.3 or later on all inter-subsystem and external communication channels, and SHALL encrypt data at rest using AES-256 or equivalent for all stored security events, threat intelligence, and incident case data.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Security event data contains PII (usernames, IP addresses), threat intelligence under TLP restrictions, and forensic evidence with legal chain-of-custody requirements. TLS 1.3 is mandated over TLS 1.2 to eliminate known downgrade attacks against inter-subsystem channels that carry high-value telemetry. AES-256 at-rest encryption is required by ISO 27001 control A.10.1.1 and by GDPR Article 32 for processing security-relevant personal data.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="infrastructure; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-016" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-016">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL maintain a documented disaster recovery capability with a recovery time objective of 4 hours and a recovery point objective of 1 hour for the detection and alerting pipeline, verified through quarterly DR exercises, and SHALL support geographic failover to an alternate facility.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="A SOC must remain operational during regional infrastructure failures (power outages, natural disasters, physical security incidents) because adversaries actively exploit degraded defensive posture. The 4-hour RTO ensures detection pipeline restoration before typical adversary dwell times allow lateral movement. The 1-hour RPO limits telemetry data loss to a window recoverable via endpoint log replay. Geographic failover is required because single-site SOCs are a single point of failure for the entire organisation's security posture.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Demonstration">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="infrastructure; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-017" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-017">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="When the SIEM Engine becomes unavailable or operates at degraded capacity, the Cybersecurity Operations Centre SHALL maintain detection capability through direct alert forwarding from EDR, NSM, and IAM subsystems to the SOAR Platform, sustaining a minimum detection rate of 60% of high-severity alerts with mean time to detect not exceeding 30 minutes, until SIEM service is restored.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM-centric hub-and-spoke architecture creates a single point of failure in the detection pipeline, contradicting the no-SPOF requirement (SYS-INFRA-008). Cross-domain analogs from nuclear reactor protection and naval combat management implement diverse detection paths to maintain safety-critical alerting during primary system failure. The 60% detection floor and 30-minute MTTD represent minimum acceptable degraded performance during SIEM outage.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="degraded-mode; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:SYS-REQS-018" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-SYS-DETECT-018">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The Cybersecurity Operations Centre SHALL maintain a minimum staffing level of 2 Tier-1 analysts and 1 Tier-2 analyst per shift during 24/7 operations, with documented shift handover procedures including transfer of open incident context, pending playbook actions, and active threat hunt status, completed within 15 minutes of shift change.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="STK-NEEDS-004 mandates 24/7 continuous operation but no system-level requirement defines the staffing model. Industry standards (NIST SP 800-61, FIRST CSIRT frameworks) recommend minimum dual-analyst coverage for Tier-1 triage to avoid single-analyst fatigue-induced detection gaps during overnight shifts. The shift handover requirement prevents context loss between shifts, which is a known root cause of delayed incident escalation in SOC operations.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="staffing; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-VER-METH-001" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-001">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The detection and alerting pipeline SHALL be verified through quarterly purple team exercises simulating at least 20 MITRE ATT&amp;CK techniques across initial access, execution, persistence, lateral movement, and exfiltration tactics, with all test events required to produce alerts within the specified MTTD thresholds.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Purple team exercises are the only verification method that validates the end-to-end detection pipeline under realistic adversary conditions — from initial access through exfiltration. Quarterly cadence ensures detection coverage is verified after each detection rule update cycle. The 20-technique minimum across 5 ATT&amp;CK tactic categories ensures breadth of coverage testing, not just depth against a single attack chain.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="verification; validation; session-293">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-METHODS-002" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-002">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The SIEM Engine failover capability SHALL be verified through semi-annual failover exercises that simulate primary SIEM node failure and measure time-to-failover, event loss during switchover, and degraded-mode detection rate, with acceptance criteria of failover completion within 5 minutes, zero event loss exceeding 60 seconds, and degraded detection rate meeting the 60% minimum threshold.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-REQS-017 introduces a degraded-mode detection requirement that must be verified independently of the quarterly purple team exercises (VER-METH-001). Failover testing validates both the SIEM HA architecture and the bypass alert paths from EDR/NSM/IAM to SOAR. Without dedicated failover exercises, the degraded-mode capability may exist on paper but fail under actual SIEM outage conditions.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="verification; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-METHODS-003" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-003">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The end-to-end detection and response pipeline from event ingestion through SIEM correlation to SOAR playbook execution and containment action SHALL be verified through monthly automated integration tests injecting synthetic events at each subsystem boundary, with each test validating end-to-end latency against SLA thresholds and confirming correct alert enrichment, routing, and containment command execution.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The verification plan currently covers only quarterly purple team exercises (VER-METH-001), which test detection effectiveness but not integration health. Monthly automated integration tests catch regression in inter-subsystem interfaces (message queue connectivity, API schema changes, TLS certificate expiry) before they impact real incident response. This mirrors the hospital patient monitoring approach where integration tests run continuously on the alerting pipeline.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="verification; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-METHODS-004" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-004">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The data retention and regulatory compliance capabilities SHALL be verified through quarterly audits confirming that hot storage retains 90 days of searchable events, warm storage retains 365 days of retrievable events, case data is retained for 2 years, and regulatory notification templates produce complete and accurate documents for GDPR Article 33 and NIS2 Article 23 reporting.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Multiple requirements specify data retention periods (SYS-DATA-006, REQ-SECYBERSECOPSCENTRE-003, REQ-005) and regulatory notification generation (SYS-DATA-009), but no verification activity confirms these capabilities are maintained over time. Storage tier migration, schema changes, or capacity pressure can silently break retention compliance. Quarterly audit frequency aligns with the 90-day hot retention window, ensuring at least one audit covers each retention boundary.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Inspection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="verification; validation; session-297">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-VER-METH-005" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-005">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The incident response and containment pipeline SHALL be verified through quarterly tabletop exercises and semi-annual live containment tests, simulating endpoint isolation via EDR, automated playbook execution via SOAR, and network-level containment via NSM, with acceptance criteria of endpoint isolation within 30 seconds, playbook execution within 60 seconds, and full incident lifecycle closure including post-incident review within 4 hours of detection.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The response pipeline spans EDR containment (REQ-007), SOAR playbook execution (REQ-004/005), and SOAR-to-EDR/NSM command interfaces (IFC-004, IFC-010). Without end-to-end response testing, individual subsystem tests may pass while the integrated containment workflow fails under realistic incident conditions. Quarterly tabletop plus semi-annual live test balances operational disruption against verification confidence.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298; verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-VER-METH-006" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-006">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The network security monitoring and identity monitoring subsystems SHALL be verified through quarterly sensor coverage audits confirming IDS deployment on all monitored segments at 10 Gbps aggregate, and through semi-annual UEBA accuracy assessments measuring false positive rate against a baseline of normal authentication patterns, with acceptance criteria of 100% segment coverage, PCAP retention of 72 hours minimum, and UEBA false positive rate not exceeding 5% of generated alerts.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Network monitoring (REQ-009) and identity monitoring (REQ-010) are passive detection subsystems whose effectiveness degrades silently — a missing sensor or drifted UEBA baseline produces no visible failure signal. Periodic coverage audits and accuracy assessments are the only way to maintain confidence that these subsystems are detecting threats across the full monitored surface.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298; verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      <SPEC-OBJECT IDENTIFIER="uht-bot:se-cybersec-ops-centre:VER-VER-METH-007" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-VER-METH-007">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-ref</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The threat intelligence ingestion and enrichment pipeline SHALL be verified through monthly feed health checks confirming that all configured intelligence feeds are active and delivering indicators within specified latencies, and through quarterly enrichment accuracy tests measuring the proportion of SIEM alerts correctly enriched with TIP context, with acceptance criteria of at least 20 active feeds, indicator delivery within 5 minutes of publication, and enrichment coverage of at least 90% of correlated alerts containing at least one TIP-sourced IOC match.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-text</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The TIP subsystem (REQ-008) and its interfaces to SIEM (IFC-003) and SOAR (IFC-009) form a critical enrichment chain — without current intelligence, SIEM correlation operates on signatures alone and SOAR playbooks lack threat context for triage prioritisation. Feed health degrades silently (expired API keys, deprecated endpoints), so proactive verification is essential.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-rationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Test">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-verification</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="session-298; verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-tags</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-OBJECT-TYPE-REF>req-type</SPEC-OBJECT-TYPE-REF></TYPE>
      </SPEC-OBJECT>
      </SPEC-OBJECTS>
      <SPEC-RELATIONS>
      <SPEC-RELATION IDENTIFIER="rel-0" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-INFRA-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SOC DR infrastructure requirement to failover verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The semi-annual failover exercises in VER-METHODS-002 partially verify the DR capability specified in SUB-SUB-INFRA-004 by testing recovery of SIEM correlation data and detection capability, though full DR site activation may warrant separate DR-specific exercises.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-1" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-001</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SIEM threat hunting subsystem requirement to purple team verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Purple team exercises (VER-METH-001) validate that the SIEM threat hunting interface can successfully surface adversary activity across ATT&amp;CK techniques, complementing the automated detection rule testing with manual hunt effectiveness assessment.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-2" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SOAR-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SOAR degraded-mode detection requirement to SIEM failover verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METHODS-002 failover exercises directly test the SOAR's ability to maintain detection via direct EDR/NSM/IAM alert ingestion when the SIEM fails, verifying the 60% detection floor specified in SUB-SUB-SOAR-003.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-3" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-007</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="TIP-to-SIEM watchlist interface to TIP enrichment verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-007 enrichment accuracy tests verify that TIP indicators are successfully pushed to the SIEM per IFC-003's 5-minute delivery requirement, and that SIEM alerts contain TIP-sourced IOC matches.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-4" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-008</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-007</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="TIP indicator processing subsystem requirement to feed health verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-007 monthly feed health checks verify that the TIP is actively ingesting, deduplicating, and scoring indicators per REQ-008's 5-minute processing window.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-5" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-010</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-006</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IAM UEBA subsystem requirement to UEBA accuracy verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-006 semi-annual UEBA accuracy assessments directly verify the baselining and anomaly detection capability specified in REQ-010, including false positive rate measurement.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-6" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-009</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-006</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="NSM subsystem requirement to sensor coverage audit verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-006 quarterly coverage audits confirm IDS deployment across all monitored segments with 10 Gbps aggregate, directly verifying REQ-009's sensor deployment requirement.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-7" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-005</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SOAR-to-EDR containment interface to response pipeline verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-005 live containment tests exercise the SOAR→EDR command interface defined in IFC-004, verifying command delivery, acknowledgement, and execution across the integration.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-8" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-005</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SOAR playbook execution subsystem requirement to response pipeline verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-005 exercises the full playbook execution chain, verifying the 60-second automated response time and incident lifecycle closure specified across REQ-004 and REQ-005.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-9" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-007</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-005</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="EDR containment subsystem requirement to response pipeline verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="VER-METH-005 live containment tests directly verify the 30-second endpoint isolation time specified in REQ-007.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-10" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-016</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-INFRA-004</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System-level DR requirement decomposed to facility infrastructure DR capability">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-INFRA-016 defines the system-level RTO/RPO requirements. SUB-SUB-INFRA-004 specifies the facility infrastructure implementation including secondary site, specific data recovery scope, and semi-annual testing cadence.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-11" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-017</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SOAR-003</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System-level degraded-mode detection decomposed to SOAR direct alert ingestion bypass">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-REQS-017 requires detection continuity when the SIEM fails. SUB-SUB-SOAR-003 implements this through the SOAR platform's direct alert ingestion from EDR/NSM/IAM, specifying the 60% detection floor and 2-minute notification threshold.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-12" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-014</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System-level alert volume management decomposed to SIEM subsystem suppression and deduplication">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-DETECT-014 defines the system-level alert volume management requirement. SUB-SUB-SIEM-002 specifies the SIEM subsystem's implementation including 80% raw reduction, per-analyst queue limits, and suppression rule auditability.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-13" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-013</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-001</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System-level threat hunting requirement decomposed to SIEM subsystem hunting query capability">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SYS-DETECT-013 defines the system-level threat hunting interface requirement. SUB-SUB-SIEM-001 decomposes this into the specific SIEM subsystem capability including query performance, telemetry coverage, and ATT&amp;CK hypothesis tracking.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-14" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-001</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SIEM correlation subsystem requirement to purple team detection verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The quarterly purple team exercise (VER-VER-METH-001) directly verifies that the SIEM correlation module (REQ-001) detects simulated ATT&amp;CK techniques within specified MTTD thresholds.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-15" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-004</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SIEM storage tier requirement to data retention compliance audit">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The quarterly retention audit (VER-METHODS-004) directly verifies that the SIEM storage tier (REQ-003) maintains 50TB hot storage with 90-day indexed search and warm tiering, by querying historical data across the full retention window.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-16" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SIEM correlation subsystem requirement to failover verification">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The failover exercise (VER-METHODS-002) verifies that SIEM correlation capability (REQ-001) has adequate failover mechanisms by measuring correlation performance during simulated node failure.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-17" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-DEFS-010</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-003</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SOAR-NSM containment interface to end-to-end integration testing">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The monthly integration test (VER-METHODS-003) validates SOAR-to-NSM network containment commands (IFC-DEFS-010) by confirming acknowledgement within 5 seconds and enforcement within 30 seconds as part of the containment test scenarios.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-18" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-DEFS-009</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-003</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="TIP-SOAR enrichment interface to end-to-end integration testing">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The monthly integration test (VER-METHODS-003) validates the TIP-SOAR enrichment API (IFC-DEFS-009) by verifying enrichment query response within the 2-second SLA as part of the end-to-end pipeline test.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-19" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-005</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System SOAR response automation to SOAR case management subsystem requirement">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Case management (REQ-005) derives from the automated response requirement (SYS-RESPOND-004) because incident case tracking is a core output of automated and analyst-driven response workflows. Every playbook execution and manual response action creates case artefacts that must be maintained.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-20" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-018</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Continuous operation stakeholder need to SOC staffing and shift handover">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Staffing requirements (SYS-REQS-018) derive from the 24/7 operational mandate (STK-NEEDS-004) because continuous operation is meaningless without defined minimum staffing levels and handover procedures to prevent context loss between shifts.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-21" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-017</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Continuous operation stakeholder need to degraded-mode detection capability">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The degraded-mode requirement (SYS-REQS-017) derives directly from the 24/7 continuous operation mandate (STK-NEEDS-004) because maintaining detection capability during SIEM failure is essential to avoid unmonitored windows that violate the continuous operation commitment.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-22" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-DEFS-010</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System automated response to SOAR-NSM network containment interface">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Network-level containment (IFC-DEFS-010) derives from the SOAR automated response requirement (SYS-RESPOND-004) because automated playbooks must be able to execute network containment actions as part of their response repertoire, not just endpoint containment.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-23" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-005</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-DEFS-009</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System intel ingestion capability to TIP-SOAR enrichment interface">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="The TIP enrichment API (IFC-DEFS-009) derives from the system requirement for threat intelligence ingestion and normalisation (SYS-INTEL-005) because the enrichment service operates on the same normalised indicator data. Without ingested and scored indicators, the enrichment API has nothing to serve.">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-24" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-012</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-013</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System infrastructure availability to facility physical security">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SOC infrastructure availability requires physical security to prevent unauthorized access that could compromise detection capability">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-25" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-006</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System detection capability to EDR agent telemetry collection">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SIEM detection depends on comprehensive endpoint telemetry; EDR agent collection provides the host-based observables required for correlation">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-26" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-009</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-012</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System reporting SLA to Comms subsystem pipeline">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="30-minute breach notification generation drives Comms subsystem templating and distribution pipeline">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-27" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-007</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-011</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System vuln scanning to VMS prioritisation model">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="IT/OT scan coverage and cycle requirements drive VMS asset inventory and risk-based prioritisation model">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-28" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-011</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-010</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System identity monitoring to IAM UEBA baselining">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="UEBA across all identity providers drives IAM subsystem baselining and anomaly detection requirements">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-29" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-010</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-009</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System network monitoring to NSM sensor deployment">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Full packet capture at 10 Gbps aggregate drives NSM sensor deployment and PCAP retention architecture">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-30" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-005</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-008</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System intel ingestion to TIP processing pipeline">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="20-feed intelligence ingestion requirement drives TIP deduplication, confidence scoring, and normalisation pipeline">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-31" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-007</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System containment SLA to EDR isolation">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="30-second containment SLA directly drives EDR isolation execution timing">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-32" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-004</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System response automation to SOAR playbook engine">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="60-second playbook execution SLA decomposes to playbook engine timing constraints">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-33" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-006</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-003</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System data retention to SIEM storage tier">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="90-day hot retention drives SIEM storage tier capacity and tiering architecture">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-34" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-002</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System ingestion capacity to SIEM normalisation pipeline">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="150K EPS capacity drives ingestion pipeline normalisation and 5-second processing ceiling">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-35" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-001</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System detection SLA to SIEM correlation module">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkDescription</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="SIEM correlation module implements the 120-second correlation SLA from the parent detection requirement">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkRationale</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-36" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-015</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-37" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-016</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-38" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-014</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-39" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-013</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-40" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-EXTERNAL-008</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-41" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-007</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-007</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-42" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-011</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-006</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-43" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-44" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-010</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-005</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-45" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-005</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-003</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-46" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-004</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-47" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-001</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-48" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-49" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-009</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-50" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-008</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-007</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-51" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-008</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-002</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-52" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-007</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-009</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-53" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-006</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-005</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-54" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-005</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-010</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-55" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-005</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-007</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-56" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-012</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-57" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-004</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-008</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-58" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-003</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-006</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-59" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-002</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-004</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-60" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-002</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-003</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-61" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-011</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-62" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-010</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      <SPEC-RELATION IDENTIFIER="rel-63" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <SOURCE><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></SOURCE>
        <TARGET><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-001</SPEC-OBJECT-REF></TARGET>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="derives">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-linkType</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <TYPE><SPEC-RELATION-TYPE-REF>trace-link-type</SPEC-RELATION-TYPE-REF></TYPE>
      </SPEC-RELATION>
      </SPEC-RELATIONS>
      <SPECIFICATIONS>
      <SPECIFICATION IDENTIFIER="spec-architecture-decisions" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <TYPE><SPECIFICATION-TYPE-REF>spec-type</SPECIFICATION-TYPE-REF></TYPE>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Architecture Decisions">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-docName</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <CHILDREN>
          <SPEC-HIERARCHY IDENTIFIER="hier-sec-section-1773839210921">
            <CHILDREN>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:ARC-ARC-RAT-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:ARC-ARC-RAT-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
            </CHILDREN>
          </SPEC-HIERARCHY>
        </CHILDREN>
      </SPECIFICATION>
      <SPECIFICATION IDENTIFIER="spec-interface-requirements" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <TYPE><SPECIFICATION-TYPE-REF>spec-type</SPECIFICATION-TYPE-REF></TYPE>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Interface Requirements">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-docName</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <CHILDREN>
          <SPEC-HIERARCHY IDENTIFIER="hier-sec-section-1773839211379">
            <CHILDREN>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-002">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-002</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-003">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-003</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-004">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-004</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-005">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-005</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-006">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-006</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-007">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-INTERNAL-007</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-IFC-EXTERNAL-008">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-IFC-EXTERNAL-008</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-DEFS-009">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-DEFS-009</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:IFC-DEFS-010">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:IFC-DEFS-010</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
            </CHILDREN>
          </SPEC-HIERARCHY>
        </CHILDREN>
      </SPECIFICATION>
      <SPECIFICATION IDENTIFIER="spec-stakeholder-requirements" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <TYPE><SPECIFICATION-TYPE-REF>spec-type</SPECIFICATION-TYPE-REF></TYPE>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Stakeholder Requirements">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-docName</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <CHILDREN>
          <SPEC-HIERARCHY IDENTIFIER="hier-sec-section-1773839001257">
            <CHILDREN>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-002">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-002</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-003">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-003</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-004">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-004</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-005">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-005</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-006">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-006</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-007">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-007</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:STK-NEEDS-008">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:STK-NEEDS-008</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
            </CHILDREN>
          </SPEC-HIERARCHY>
        </CHILDREN>
      </SPECIFICATION>
      <SPECIFICATION IDENTIFIER="spec-subsystem-requirements" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <TYPE><SPECIFICATION-TYPE-REF>spec-type</SPECIFICATION-TYPE-REF></TYPE>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Subsystem Requirements">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-docName</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <CHILDREN>
          <SPEC-HIERARCHY IDENTIFIER="hier-sec-section-1773839212352">
            <CHILDREN>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-002">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SIEM-002</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-002">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-002</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SUB-SUB-SOAR-003">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-SOAR-003</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-003">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-003</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SUB-SUB-INFRA-004">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SUB-SUB-INFRA-004</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-004">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-004</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-005">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-005</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-006">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-006</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-007">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-007</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-008">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-008</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-009">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-009</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-010">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-010</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-011">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-011</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-012">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-012</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-013">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:REQ-SECYBERSECOPSCENTRE-013</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
            </CHILDREN>
          </SPEC-HIERARCHY>
        </CHILDREN>
      </SPECIFICATION>
      <SPECIFICATION IDENTIFIER="spec-system-requirements" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <TYPE><SPECIFICATION-TYPE-REF>spec-type</SPECIFICATION-TYPE-REF></TYPE>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="System Requirements">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-docName</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <CHILDREN>
          <SPEC-HIERARCHY IDENTIFIER="hier-sec-section-1773839001737">
            <CHILDREN>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-002">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-002</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-003">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-003</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-004">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-004</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-005">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-005</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-006">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-006</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-007">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-007</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-008">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-008</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-009">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-009</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-010">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-010</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-011">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-011</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-012">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-012</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-013">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-013</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-014">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-DETECT-014</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-015">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-015</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-016">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-SYS-INFRA-016</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-017">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-017</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:SYS-REQS-018">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:SYS-REQS-018</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
            </CHILDREN>
          </SPEC-HIERARCHY>
        </CHILDREN>
      </SPECIFICATION>
      <SPECIFICATION IDENTIFIER="spec-verification-plan" LAST-CHANGE="2026-04-28T08:40:02.378Z">
        <TYPE><SPECIFICATION-TYPE-REF>spec-type</SPECIFICATION-TYPE-REF></TYPE>
        <VALUES>
          <ATTRIBUTE-VALUE-STRING THE-VALUE="Verification Plan">
            <DEFINITION><ATTRIBUTE-DEFINITION-STRING-REF>attr-docName</ATTRIBUTE-DEFINITION-STRING-REF></DEFINITION>
          </ATTRIBUTE-VALUE-STRING>
        </VALUES>
        <CHILDREN>
          <SPEC-HIERARCHY IDENTIFIER="hier-sec-section-1773839222010">
            <CHILDREN>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-VER-METH-001">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-001</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-METHODS-002">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-002</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-METHODS-003">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-003</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-METHODS-004">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-METHODS-004</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-VER-METH-005">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-005</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-VER-METH-006">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-006</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
              <SPEC-HIERARCHY IDENTIFIER="hier-uht-bot:se-cybersec-ops-centre:VER-VER-METH-007">
                <OBJECT><SPEC-OBJECT-REF>uht-bot:se-cybersec-ops-centre:VER-VER-METH-007</SPEC-OBJECT-REF></OBJECT>
              </SPEC-HIERARCHY>
            </CHILDREN>
          </SPEC-HIERARCHY>
        </CHILDREN>
      </SPECIFICATION>
      </SPECIFICATIONS>
      <SPEC-RELATION-GROUPS>
      <RELATION-GROUP IDENTIFIER="rg-linkset-1773835333304">
        <SOURCE-SPECIFICATION><SPECIFICATION-REF>spec-interface-requirements</SPECIFICATION-REF></SOURCE-SPECIFICATION>
        <TARGET-SPECIFICATION><SPECIFICATION-REF>spec-verification-plan</SPECIFICATION-REF></TARGET-SPECIFICATION>
        <TYPE><RELATION-GROUP-TYPE-REF>linkset-type</RELATION-GROUP-TYPE-REF></TYPE>
      </RELATION-GROUP>
      <RELATION-GROUP IDENTIFIER="rg-linkset-1773835332900">
        <SOURCE-SPECIFICATION><SPECIFICATION-REF>spec-subsystem-requirements</SPECIFICATION-REF></SOURCE-SPECIFICATION>
        <TARGET-SPECIFICATION><SPECIFICATION-REF>spec-verification-plan</SPECIFICATION-REF></TARGET-SPECIFICATION>
        <TYPE><RELATION-GROUP-TYPE-REF>linkset-type</RELATION-GROUP-TYPE-REF></TYPE>
      </RELATION-GROUP>
      <RELATION-GROUP IDENTIFIER="rg-linkset-1773835332477">
        <SOURCE-SPECIFICATION><SPECIFICATION-REF>spec-system-requirements</SPECIFICATION-REF></SOURCE-SPECIFICATION>
        <TARGET-SPECIFICATION><SPECIFICATION-REF>spec-interface-requirements</SPECIFICATION-REF></TARGET-SPECIFICATION>
        <TYPE><RELATION-GROUP-TYPE-REF>linkset-type</RELATION-GROUP-TYPE-REF></TYPE>
      </RELATION-GROUP>
      <RELATION-GROUP IDENTIFIER="rg-linkset-1773835331964">
        <SOURCE-SPECIFICATION><SPECIFICATION-REF>spec-system-requirements</SPECIFICATION-REF></SOURCE-SPECIFICATION>
        <TARGET-SPECIFICATION><SPECIFICATION-REF>spec-subsystem-requirements</SPECIFICATION-REF></TARGET-SPECIFICATION>
        <TYPE><RELATION-GROUP-TYPE-REF>linkset-type</RELATION-GROUP-TYPE-REF></TYPE>
      </RELATION-GROUP>
      <RELATION-GROUP IDENTIFIER="rg-linkset-1773835331284">
        <SOURCE-SPECIFICATION><SPECIFICATION-REF>spec-stakeholder-requirements</SPECIFICATION-REF></SOURCE-SPECIFICATION>
        <TARGET-SPECIFICATION><SPECIFICATION-REF>spec-system-requirements</SPECIFICATION-REF></TARGET-SPECIFICATION>
        <TYPE><RELATION-GROUP-TYPE-REF>linkset-type</RELATION-GROUP-TYPE-REF></TYPE>
      </RELATION-GROUP>
      </SPEC-RELATION-GROUPS>
    </REQ-IF-CONTENT>
  </CORE-CONTENT>
</REQ-IF>