k0nsult.cloud / ai-truth / ipIII / evidence-board / en

Evidence Board

The evidence layer of the system. Every incident exists operationally only to the extent that it is proven. The board sorts reports into columns by evidence status, maintains the chain of custody, and computes % GAP as a systemic-risk indicator — the more claims without proof, the weaker the organization's audit and procedural position.

Executive Overview Cyber Map AI Risk Map Evidence Board Legal Board Response Board

SIMULATION / demonstration data. All incident identifiers, evidence items, confidence values, and chain-of-custody entries on this page are illustrative (demo). They do not reflect real breaches. The evidence-status framework is methodical and production-grade — the data within it is simulated.

Doctrine: claim ≤ proof

A claim about an incident cannot be "stronger" than the proof behind it. A report without evidence carries the status GAP, not CONFIRMED. Classification, priority, and legal reporting all inherit from the weakest evidentiary link.

REPORT→EVIDENCE→STATUS→CLASSIFICATION→RISK→PLAYBOOK→VALIDATION→REPORT

Systemic risk indicator — % GAP SIMULATION

Metric: the share of incidents without sufficient proof among all open cases. A high % GAP means the organization "sees" events but cannot document them — a weak position before an auditor, a regulator, and in proceedings.

Open incidents

all evidence statuses

31%

% GAP (no proof)

13 / 42 — alert threshold >25%

45%

% CONFIRMED

19 / 42 — full proof

Awaiting verification

analyst queue

Bar: share of GAP in the incident portfolio. Operational goal: keep below 25% (amber threshold), below 10% (mature target).

Column board — evidence status

GAP — no proof 13

INC-2041 GAP P1Reported phishing against the lending team — email/headers not collected.

INC-2038 GAP P2Suspected prompt injection in the assistant — no prompt/response log.

INC-2033 GAP P2Signal of a "leak" from an external channel — no data sample.

Weak evidence 3

INC-2040 MEDIA P1Media signal of a ransomware campaign in the sector — no local IOCs.

INC-2036 PUBLIC P2Public claim of a vendor vulnerability — unconfirmed in our environment.

INC-2029 DISPUTED P2Disputed DDoS alert — possible WAF false positive.

CONFIRMED 19

INC-2044 CONFIRMED P0Credential theft — 4625/4624 logs, session capture, IOC confirmed.

INC-2039 CONFIRMED P1Exploited CVE on the VPN gateway — PCAP + version + patch diff.

INC-2031 CONFIRMED P2Misconfigured S3-like bucket — policy snapshot + access audit.

Awaiting verification 7

EVD-5102 INTERNALSIEM log to correlate with INC-2041 — awaiting an analyst.

EVD-5099 INTERNALPCAP 240 MB — hash integrity check.

EVD-5093 INTERNALAgent prompt capture — source and timestamp validation.

Chain of custody active

INC-2044 CONFIRMED4 transfers · hash consistent · no time gaps.

INC-2039 CONFIRMED3 transfers · analyst signature · integrity OK.

INC-2029 DISPUTED14-min gap in custody — lowers evidentiary weight.

Evidence table (evidence_layer) SIMULATION

evidence_id	incident_id	type	confidence	collected_by	visibility	status
`EVD-5110`	INC-2044	auth log (4624/4625)	96	SOC-analyst-2	internal	CONFIRMED
`EVD-5108`	INC-2044	RDP session capture	92	DFIR-lead	restricted	CONFIRMED
`EVD-5104`	INC-2039	VPN gateway PCAP	88	NetSec-1	internal	CONFIRMED
`EVD-5102`	INC-2041	email headers	41	reporter@bank	internal	AWAITING VERIFICATION
`EVD-5099`	INC-2040	article/OSINT	28	threat-intel	public	MEDIA
`EVD-5093`	INC-2038	agent prompt log	35	ai-safety-off.	restricted	AWAITING VERIFICATION
`EVD-5090`	INC-2029	WAF metrics	52	SOC-analyst-1	internal	DISPUTED
`—`	INC-2033	(no data sample)	0	—	—	GAP

confidence 0–100: evidentiary weight = f(source type, custody integrity, reproducibility, correlation). Thresholds: <40 weak · 40–74 partial · ≥75 strong. An incident can only be CONFIRMED with at least one item ≥75 and a consistent chain of custody.

Chain of custody — sample record

The chain of custody documents every transfer of evidence: who, when, hash before/after, purpose. A time gap or hash mismatch lowers confidence and may move the incident to DISPUTED.

{
  "evidence_id": "EVD-5108",              // SIMULATION
  "incident_id": "INC-2044",
  "type": "rdp_session_capture",
  "sha256": "9f2a...c71e",
  "confidence": 92,
  "sealed": true,
  "chain_of_custody": [
    { "seq": 1, "ts": "2026-07-04T08:12:03Z", "actor": "SOC-analyst-2",
      "action": "collect", "from": "host WKS-114", "hash_after": "9f2a...c71e" },
    { "seq": 2, "ts": "2026-07-04T08:19:40Z", "actor": "DFIR-lead",
      "action": "transfer", "to": "evidence-vault-01", "hash_before": "9f2a...c71e",
      "hash_after": "9f2a...c71e", "integrity": "OK" },
    { "seq": 3, "ts": "2026-07-04T09:02:11Z", "actor": "Analyst-review",
      "action": "review", "verdict": "supports_incident", "confidence_delta": +6 },
    { "seq": 4, "ts": "2026-07-04T09:40:55Z", "actor": "Legal/DPO",
      "action": "legal_hold", "reason": "possible NIS2/GDPR reporting", "integrity": "OK" }
  ],
  "gaps": [],                              // no time gaps → weight preserved
  "status": "CONFIRMED"
}

Evidence board principles

1. No proof = GAP, not fact. A report without an artifact stays in the GAP column and cannot be raised above priority P2 without additional analyst justification.

2. Integrity > quantity. One item with a hash and a consistent custody chain weighs more than five unsigned screenshots.

3. Role-driven visibility. visibility (public/internal/restricted) decides who sees the artifact — the Public Viewer never sees restricted items.

4. % GAP is a management metric. Reported to the Executive Overview as a measure of evidentiary maturity, not just an incident count.

Evidence Board

Systemic risk indicator — % GAP SIMULATION

Column board — evidence status

GAP — no proof 13

Weak evidence 3

CONFIRMED 19

Awaiting verification 7

Chain of custody active

Evidence table (evidence_layer) SIMULATION

Chain of custody — sample record

Evidence board principles

Related

Legal Board →

Response Board →

Incident Intake →

Classification Engine →