# title
Evidence Analysis (Open Evidence Schema v1)

# description
Structured output of an AI-assisted analysis of a single piece of incident evidence (log, screenshot, forensic report, attestation). Produced by the ResilienceChain Evidence Agent and conforming implementations.

# properties.summary.description
One to three sentences describing what the evidence shows, written for a security analyst who hasn’t seen it yet.

# properties.suspected_iocs.description
Indicators of compromise visibly present in the evidence. Empty is a valid answer; do not invent IoCs to fill the list.

# properties.mitre_tactics.description
Human-readable MITRE ATT&CK tactic names (e.g. InitialAccess, CredentialAccess).

# properties.confidence.description
Agent’s confidence in its own assessment. LOW confidence should always trigger requires_human_review = true.

# properties.requires_human_review.description
True when the evidence needs human triage before any automated remediation: low confidence, PII needing redaction, or signs of active compromise.

# examples[].summary
SSH brute-force from 185.220.101.42 succeeded on svc_backup; attacker downloaded /tmp/implant.sh via curl and contacted C2 at 209.141.34.12:4444.

# examples[].suspected_iocs[].context
source of brute-force and implant download

# examples[].suggested_actions[].action
Block 185.220.101.42 at the edge firewall

# examples[].review_reason
Credentials compromised; needs coordinator sign-off before remediation.