Open Evidence Schema

Why publish this?

Cyber-incident tooling is locked to vendor formats by default — each SIEM, SOAR, and ticketing system publishes its own alert shape and expects integrators to conform. Evidence chains don’t survive the hops. ResilienceChain publishes its formats as a versioned open schema so a customer who exports to us, or a regulator who audits us, can do their own validation without asking for docs. An integration built against v1 stays valid forever; breaking changes ship as /schema/v2.

Discovery

The full list of schemas is reachable machine-first at /.well-known/openevidence.json, an RFC 8615 manifest crawlers can GET without prior coordination.

Verify an event chain in 30 lines of Python

This snippet recomputes an incident’s event hash chain from a JSON export, using only the Python standard library. No ResilienceChain dependencies.

import hashlib, json

GENESIS = "0" * 64

def canonical_json(v):
    if isinstance(v, dict):
        items = sorted(v.items(), key=lambda kv: kv[0])
        return "{" + ",".join(json.dumps(k) + ":" + canonical_json(vv) for k, vv in items) + "}"
    if isinstance(v, list):
        return "[" + ",".join(canonical_json(x) for x in v) + "]"
    return json.dumps(v, separators=(",", ":"))

def compute_event_hash(prev_hash, row):
    canonical = "|".join([
        row["event_id"], row["tenant_id"], row["entity_type"], row["entity_id"],
        row["event_type"], row["occurred_at"],
        row.get("actor_user_id") or "",
        row["source_channel"],
        row.get("related_order_id") or "",
        row.get("related_action_item_id") or "",
        canonical_json(row.get("payload", {})),
    ])
    return hashlib.sha256((prev_hash + "|" + canonical).encode()).hexdigest()

def verify_chain(events):
    prev = GENESIS
    for r in sorted(events, key=lambda e: e["chain_sequence_no"]):
        expected = compute_event_hash(r["prev_event_hash"] or GENESIS, r)
        if expected != r["event_hash"]:
            return False, r["chain_sequence_no"]
        prev = r["event_hash"]
    return True, None

# events = json.load(open("incident-events.json"))["data"]
# ok, first_broken = verify_chain(events)
# assert ok, f"chain broken at sequence {first_broken}"

Conformance for receivers

• Outbound webhook receivers SHOULD verify X-RC-Signature: sha256=<hex> against the endpoint’s signing secret with HMAC-SHA256 over the raw (unmodified) body bytes.
• Receivers MAY reject deliveries whose timestamp is older than 5 minutes to mitigate replay.
• The delivery_id is also present in the X-RC-Delivery-Id header to help receivers correlate logs and detect retries.
• Regulators requesting an evidence chain proof SHOULD accept any report that conforms to event-chain-proof; they do not need ResilienceChain credentials to interpret it.
• Each chained event carries an RFC 3161 time-stamp token — see tsa-anchoring. A regulator can verify the token offline with openssl ts -verify against the TSA’s public certificate, proving the event existed by wall-clock time T without touching ResilienceChain infrastructure.