Map SOC-Copilot to Detection Evidence