KK-ShieldEnterprise · Sentinel
Docsv5.0.0

INVESTIGATE

Evidence handling.

Source, capture context, hashes, and replay references remain close to findings.

Fields

  • identifier and type
  • source plugin and acquisition method
  • target and capture time
  • redacted value and SHA-256
  • replay and lineage

Store

python scanner.py evidence put --store data/evidence --object-id scan-1.kfif --file report.kfif.json
python scanner.py evidence verify --store data/evidence --object-id scan-1.kfif

Boundary

Local create-once/content-addressed storage is not external WORM without an external adapter.