EVIDENCE & PROVENANCE

From source to finding, and back again.

ARGUS7 treats integrity, lineage, attribution and reproducibility as central parts of the investigation.

IN DEVELOPMENT

01 / LINEAGE

Every transformation preserves its parent item.

The operator can trace a report back to its source and follow a source into every finding it supports.

01SOURCETRANSFORMATION LOGGED↓

02COLLECTIONTRANSFORMATION LOGGED↓

03NORMALIZATIONTRANSFORMATION LOGGED↓

04ANALYSISTRANSFORMATION LOGGED↓

05DERIVED DATATRANSFORMATION LOGGED↓

06EVIDENCEHUMAN REVIEWED↓

07FINDINGHUMAN REVIEWED↓

08REPORTHUMAN REVIEWED

02 / EVIDENCE OBJECT

EV-MOV-002CORROBORATED

TYPE: Vulnerability
SOURCE ID: SRC-MOV-001
PUBLISHER: CISA / FBI
ORIGINAL TITLE: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability
PUBLICATION DATE: 2023-06-07
OBSERVED DATA: CISA describes a previously unknown SQL injection vulnerability exploited by CL0P.
COLLECTION DATE: 2026-07-25
INTEGRITY: SOURCE VERIFIED
USED BY: Cyber · Intel · Research
SUPPORTS: HYP-MOV-001 · FIND-MOV-001

FINDINGFIND-MOV-001

↕

EVIDENCEEV-MOV-002

↕

SOURCESRC-MOV-001

The conceptual master is not modified. Every copy and derivative records its parent, hash and process.

RAG and memory retrieve context; verification, attribution and registration create an Evidence Object.

Unavailable data, a completed search with no result and a rejected hypothesis are different states.