Connected Finding and Evidence Contract

This workbench depicts a cross-product evidence contract that preserves provenance as results move through the full analysis lifecycle. A capability output, scanner finding, adversarial observation, and artifact context are normalized into shared evidence with stable identifiers, source attribution, and explicit claim and lifecycle state. That contract lets entities and relationships flow consistently into downstream analysis, where authority graph enrichment and Path qualification and validation can operate without losing the original evidence trail. From there, the same record supports control selection and retest planning, then returns remediation status and retest results back into the lifecycle. The result is an integration round trip in which scanner, range, graph, Attack Path Analysis, and reporting systems can exchange findings, actions, and outcomes while maintaining traceable provenance for export, audit, and decision-making.