{
  "label": "Recomputes a threat-investigation case: evidence integrity and custody, finding grounding, hypothesis status, timeline references, freshness and claim honesty. It does not re-collect evidence or attribute an attacker.",
  "public_key_b64": "Tb35eoLRk8PvShh3F1hDtIHE+8A66ZxeLh2dK7Oj1Bs=",
  "records": [
    {
      "checks": [
        {
          "detail": "custody chain is required",
          "id": "policy.custody_required",
          "ok": true
        },
        {
          "detail": "content hash present",
          "id": "evidence.EV-1.hash",
          "ok": true
        },
        {
          "detail": "integrity verified",
          "id": "evidence.EV-1.integrity",
          "ok": true
        },
        {
          "detail": "0.0 days <= 30.0",
          "id": "evidence.EV-1.fresh",
          "ok": true
        },
        {
          "detail": "custody chain present",
          "id": "evidence.EV-1.custody",
          "ok": true
        },
        {
          "detail": "content hash present",
          "id": "evidence.EV-2.hash",
          "ok": true
        },
        {
          "detail": "integrity verified",
          "id": "evidence.EV-2.integrity",
          "ok": true
        },
        {
          "detail": "0.0 days <= 30.0",
          "id": "evidence.EV-2.fresh",
          "ok": true
        },
        {
          "detail": "custody chain present",
          "id": "evidence.EV-2.custody",
          "ok": true
        },
        {
          "detail": "1 >= 1",
          "id": "F1.evidence_count",
          "ok": true
        },
        {
          "detail": "cites ['EV-1']",
          "id": "F1.evidence_exist",
          "ok": true
        },
        {
          "detail": "a technique is named",
          "id": "F1.technique",
          "ok": true
        },
        {
          "detail": "1 >= 1",
          "id": "F2.evidence_count",
          "ok": true
        },
        {
          "detail": "cites ['EV-2']",
          "id": "F2.evidence_exist",
          "ok": true
        },
        {
          "detail": "a technique is named",
          "id": "F2.technique",
          "ok": true
        },
        {
          "detail": "status 'confirmed'",
          "id": "hypothesis.H1.status",
          "ok": true
        },
        {
          "detail": "a decided hypothesis cites evidence",
          "id": "hypothesis.H1.grounded",
          "ok": true
        },
        {
          "detail": "a high-severity case cannot leave a hypothesis open",
          "id": "hypothesis.H1.not_open",
          "ok": true
        },
        {
          "detail": "status 'refuted'",
          "id": "hypothesis.H2.status",
          "ok": true
        },
        {
          "detail": "a decided hypothesis cites evidence",
          "id": "hypothesis.H2.grounded",
          "ok": true
        },
        {
          "detail": "a high-severity case cannot leave a hypothesis open",
          "id": "hypothesis.H2.not_open",
          "ok": true
        },
        {
          "detail": "evidence 'EV-1'",
          "id": "timeline.0.evidence",
          "ok": true
        },
        {
          "detail": "evidence 'EV-2'",
          "id": "timeline.1.evidence",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.all_findings_grounded",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.custody_intact",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.no_open_high_hypothesis",
          "ok": true
        }
      ],
      "created_at": "2026-11-12T07:59:18Z",
      "engine": "a75-036/1.0.0",
      "extra": {
        "computed": {
          "all_findings_grounded": true,
          "custody_intact": true,
          "no_open_high_hypothesis": true
        },
        "evidence": {
          "EV-1": {
            "collected_at": 99000.0
          },
          "EV-2": {
            "collected_at": 99100.0
          }
        },
        "findings": {
          "F1": {
            "confidence": 0.9,
            "evidence": [
              "EV-1"
            ]
          },
          "F2": {
            "confidence": 0.8,
            "evidence": [
              "EV-2"
            ]
          }
        }
      },
      "failed": [],
      "label": "Recomputes a threat-investigation case: evidence integrity and custody, finding grounding, hypothesis status, timeline references, freshness and claim honesty. It does not re-collect evidence or attribute an attacker.",
      "prev_record_hash": "a0ba0ac79bbde8cf60444febaf4eaf2ce1b018cddaf1bd9f881fe06a1f1f749b",
      "public_key_b64": "Tb35eoLRk8PvShh3F1hDtIHE+8A66ZxeLh2dK7Oj1Bs=",
      "record_hash": "4c2bd34f7055aebf1e3e8e7868ef0a8d5862faa6bf4383fc2566c3457906ef78",
      "schema": "cain42.a75.threat.record.v1",
      "signature_b64": "k1Jz6aBZ3VtogJvcTRBv4eD5n5rsG+mo/FQSNnzMPAS3d2+ZT8/7YupqhA7/xQ/y1BGKPyZHVCgqtDInSzALDg==",
      "sku": "CAIN-A75-036",
      "subject": {
        "case": {
          "analyst": "analyst:kim",
          "id": "CASE-9",
          "now": 100000.0,
          "opened_at": 99000.0,
          "severity": "high"
        },
        "claims": {
          "all_findings_grounded": true,
          "custody_intact": true,
          "no_open_high_hypothesis": true
        },
        "evidence": [
          {
            "collected_at": 99000.0,
            "custody": [
              {
                "at": 99000.0,
                "from": "sensor",
                "to": "analyst:kim"
              }
            ],
            "id": "EV-1",
            "integrity_verified": true,
            "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "source": "edr"
          },
          {
            "collected_at": 99100.0,
            "custody": [
              {
                "at": 99100.0,
                "from": "sensor",
                "to": "analyst:kim"
              }
            ],
            "id": "EV-2",
            "integrity_verified": true,
            "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "source": "edr"
          }
        ],
        "findings": [
          {
            "claim": "credential access via LSASS",
            "confidence": 0.9,
            "evidence_ids": [
              "EV-1"
            ],
            "id": "F1",
            "mitre_technique": "T1003"
          },
          {
            "claim": "lateral movement to file server",
            "confidence": 0.8,
            "evidence_ids": [
              "EV-2"
            ],
            "id": "F2",
            "mitre_technique": "T1021"
          }
        ],
        "hypotheses": [
          {
            "evidence_ids": [
              "EV-1"
            ],
            "id": "H1",
            "statement": "initial access was phishing",
            "status": "confirmed"
          },
          {
            "evidence_ids": [
              "EV-2"
            ],
            "id": "H2",
            "statement": "insider involvement",
            "status": "refuted"
          }
        ],
        "policy": {
          "max_age_days": 30.0,
          "min_evidence_per_finding": 1,
          "require_custody_chain": true
        },
        "schema": "cain42.a75.threat.case.v1",
        "timeline": [
          {
            "at": 99000.0,
            "event": "LSASS access",
            "evidence_id": "EV-1"
          },
          {
            "at": 99100.0,
            "event": "SMB connection",
            "evidence_id": "EV-2"
          }
        ]
      },
      "subject_sha256": "072b73cd52fde0c525a4d0a56de771e0945462e36b67fb440adc1ddd15f64427",
      "verdict": "SOUND"
    }
  ],
  "run_hash": "cc9cbc06d932659d9e9046fe5ae3ad77c42f2a6099b3d96815df975708cd5c2d",
  "schema": "cain42.a75.threat.run.v1",
  "sku": "CAIN-A75-036",
  "verdict": "VERIFIED",
  "verdicts": [
    "SOUND"
  ]
}