Evidence
Evidence FAQ
The service verifies constrained claims; it does not correlate events or write an incident narrative.
What is evidence?
A cited raw observation or deterministic Correlate relationship. ATT&CK knowledge and model prose are not incident evidence.
What is supported?
A claim whose cited material grounds its components, predicates, sequence, and required source coverage without contradiction.
What is a gap?
A missing source class, unresolved reference, unsupported component, or temporal conflict that limits the verdict.
Can a model set status?
No. Verdicts and receipts are produced by deterministic policy and provenance checks.