{ "created_at": "2026-11-12T07:59:12Z", "result": { "engine": "threat_evidence", "limits": "Reviews the case record. It does not re-collect evidence, prove authenticity, or confirm attribution. The run is Ed25519-signed; pin the issuer key out of band.", "module": "cain_a75_engines/threatevidence/engine.py", "profile": "high_severity_case", "run": { "label": "Recomputes a threat-investigation case: evidence integrity and custody, finding grounding, hypothesis status, timeline references, freshness and claim honesty. It does not re-collect evidence or attribute an attacker.", "public_key_b64": "Tb35eoLRk8PvShh3F1hDtIHE+8A66ZxeLh2dK7Oj1Bs=", "records": [ { "checks": [ { "detail": "custody chain is required", "id": "policy.custody_required", "ok": true }, { "detail": "content hash present", "id": "evidence.EV-1.hash", "ok": true }, { "detail": "integrity verified", "id": "evidence.EV-1.integrity", "ok": true }, { "detail": "0.0 days <= 30.0", "id": "evidence.EV-1.fresh", "ok": true }, { "detail": "custody chain present", "id": "evidence.EV-1.custody", "ok": true }, { "detail": "content hash present", "id": "evidence.EV-2.hash", "ok": true }, { "detail": "integrity verified", "id": "evidence.EV-2.integrity", "ok": true }, { "detail": "0.0 days <= 30.0", "id": "evidence.EV-2.fresh", "ok": true }, { "detail": "custody chain present", "id": "evidence.EV-2.custody", "ok": true }, { "detail": "1 >= 1", "id": "F1.evidence_count", "ok": true }, { "detail": "cites ['EV-1']", "id": "F1.evidence_exist", "ok": true }, { "detail": "a technique is named", "id": "F1.technique", "ok": true }, { "detail": "1 >= 1", "id": "F2.evidence_count", "ok": true }, { "detail": "cites ['EV-2']", "id": "F2.evidence_exist", "ok": true }, { "detail": "a technique is named", "id": "F2.technique", "ok": true }, { "detail": "status 'confirmed'", "id": "hypothesis.H1.status", "ok": true }, { "detail": "a decided hypothesis cites evidence", "id": "hypothesis.H1.grounded", "ok": true }, { "detail": "a high-severity case cannot leave a hypothesis open", "id": "hypothesis.H1.not_open", "ok": true }, { "detail": "status 'refuted'", "id": "hypothesis.H2.status", "ok": true }, { "detail": "a decided hypothesis cites evidence", "id": "hypothesis.H2.grounded", "ok": true }, { "detail": "a high-severity case cannot leave a hypothesis open", "id": "hypothesis.H2.not_open", "ok": true }, { "detail": "evidence 'EV-1'", "id": "timeline.0.evidence", "ok": true }, { "detail": "evidence 'EV-2'", "id": "timeline.1.evidence", "ok": true }, { "detail": "claimed True, computed True", "id": "claims.all_findings_grounded", "ok": true }, { "detail": "claimed True, computed True", "id": "claims.custody_intact", "ok": true }, { "detail": "claimed True, computed True", "id": "claims.no_open_high_hypothesis", "ok": true } ], "created_at": "2026-11-12T07:59:12Z", "engine": "a75-036/1.0.0", "extra": { "computed": { "all_findings_grounded": true, "custody_intact": true, "no_open_high_hypothesis": true }, "evidence": { "EV-1": { "collected_at": 99000.0 }, "EV-2": { "collected_at": 99100.0 } }, "findings": { "F1": { "confidence": 0.9, "evidence": [ "EV-1" ] }, "F2": { "confidence": 0.8, "evidence": [ "EV-2" ] } } }, "failed": [], "label": "Recomputes a threat-investigation case: evidence integrity and custody, finding grounding, hypothesis status, timeline references, freshness and claim honesty. It does not re-collect evidence or attribute an attacker.", "prev_record_hash": "a0ba0ac79bbde8cf60444febaf4eaf2ce1b018cddaf1bd9f881fe06a1f1f749b", "public_key_b64": "Tb35eoLRk8PvShh3F1hDtIHE+8A66ZxeLh2dK7Oj1Bs=", "record_hash": "26d627dac7b68a4b7274f428d95dc5cde7dddb3107420e06367fdeca6fbc1349", "schema": "cain42.a75.threat.record.v1", "signature_b64": "0fY2JA6rL8ja4yHnc+cjuZMNCPX7QRYlaim6Ty+SvF3TaNd/FPLrJDXxYYtFLetFi0Fb39nsHDdEgquX7I11Ag==", "sku": "CAIN-A75-036", "subject": { "case": { "analyst": "analyst:kim", "id": "CASE-9", "now": 100000.0, "opened_at": 99000.0, "severity": "high" }, "claims": { "all_findings_grounded": true, "custody_intact": true, "no_open_high_hypothesis": true }, "evidence": [ { "collected_at": 99000.0, "custody": [ { "at": 99000.0, "from": "sensor", "to": "analyst:kim" } ], "id": "EV-1", "integrity_verified": true, "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "source": "edr" }, { "collected_at": 99100.0, "custody": [ { "at": 99100.0, "from": "sensor", "to": "analyst:kim" } ], "id": "EV-2", "integrity_verified": true, "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "source": "edr" } ], "findings": [ { "claim": "credential access via LSASS", "confidence": 0.9, "evidence_ids": [ "EV-1" ], "id": "F1", "mitre_technique": "T1003" }, { "claim": "lateral movement to file server", "confidence": 0.8, "evidence_ids": [ "EV-2" ], "id": "F2", "mitre_technique": "T1021" } ], "hypotheses": [ { "evidence_ids": [ "EV-1" ], "id": "H1", "statement": "initial access was phishing", "status": "confirmed" }, { "evidence_ids": [ "EV-2" ], "id": "H2", "statement": "insider involvement", "status": "refuted" } ], "policy": { "max_age_days": 30.0, "min_evidence_per_finding": 1, "require_custody_chain": true }, "schema": "cain42.a75.threat.case.v1", "timeline": [ { "at": 99000.0, "event": "LSASS access", "evidence_id": "EV-1" }, { "at": 99100.0, "event": "SMB connection", "evidence_id": "EV-2" } ] }, "subject_sha256": "072b73cd52fde0c525a4d0a56de771e0945462e36b67fb440adc1ddd15f64427", "verdict": "SOUND" } ], "run_hash": "1caef12c6928779b3110a3392c45ff4c504fface331b3cd33ef790ff8606cf51", "schema": "cain42.a75.threat.run.v1", "sku": "CAIN-A75-036", "verdict": "VERIFIED", "verdicts": [ "SOUND" ] }, "scenarios": [ { "evidence": 2, "findings": 2, "name": "high_severity_threat_case", "run_hash": "1caef12c6928779b3110a3392c45ff4c504fface331b3cd33ef790ff8606cf51", "verdict": "VERIFIED" }, { "expected": "SOUND", "name": "honest_threat_case", "verdict": "SOUND" }, { "expected": "UNSOUND", "name": "finding_without_evidence", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "finding_cites_unknown_evidence", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "custody_missing", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "integrity_not_verified", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "stale_evidence", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "confirmed_without_evidence", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "high_case_open_hypothesis", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "timeline_dangling", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "confidence_out_of_range", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "duplicate_finding", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "claim_overstates", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "unknown_claim", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "wrong_schema", "verdict": "UNSOUND" }, { "expected": "UNSOUND", "name": "garbage", "verdict": "UNSOUND" } ], "summary": "VERIFIED: evidence integrity/custody, finding grounding, hypotheses and timeline recomputed; 15/15 case-failure cases as expected" }, "schema": "cain42.agentic75.findings.v1", "sku": "CAIN-A75-036" }