Skip to main content

Evidence

Evidence is how the Cybergraph stays accountable. A node or finding carries a link back to the operation work that created or last changed it, so you can trace any fact in the graph to where it came from.

At a glance​

  • What it is — the Cybergraph's link from a node or finding back to the operation work that created or last changed it.
  • When to use it — trace any graph fact back to the operation and thread point that produced it, for verification or reporting.
  • Inputs — a Cybergraph node with an evidence reference, populated automatically by the agent as it works (best-effort, not guaranteed on every node).
  • Outputs — a link from the node to the backing operation and the point in its thread.
  • Related objects — Cybergraph, File System, Operations, Reporting.
  • Common actions — Open (a node's details), Follow (its evidence link).
  • API / tool links — UI only — no public API.

Provenance on every node​

Open a node's details in the Cybergraph and follow its evidence link to the operation — and the point in that operation's thread — that produced or last changed the node. When several pieces of work contributed to a node, Cracken surfaces the most recent one that ties back to an operation.

Every node type carries this evidence reference, so any node — not just Finding and Evidence nodes — can point back at the work that backs it. The links are populated by the agent as it works and are best-effort: they show what Cracken recorded, not a guarantee that every node is backed.

Evidence and artifacts​

Artifacts are the raw text and image evidence captured from tool output during an operation. Evidence links are the Cybergraph's pointers from a node or finding back to that work. Artifacts are the captured material; evidence links are how the graph references it.

Next steps​

  • Cybergraph — the graph these evidence links live in.
  • File System — where captured tool-output evidence is stored.
  • Operations — the work evidence links point back to.
  • Reporting — where findings and their evidence become a deliverable.