Illustrative sample

A sample evidence record.

One redacted, hash-chained record as it lands in your SIEM. Each record links to the one before it — change a single byte and the chain no longer verifies. Values shown are illustrative, not from a real endpoint.

evidence-2026-07-10.jsonl · record 42

{
  "timestamp_utc":      "2026-07-10T04:12:31Z",
  "endpoint_id":        "ep_7f3c12",          // pseudonymous, not a hostname
  "hook":               "PreToolUse",
  "tool":               "Read",
  "action_category":    "cloud_credentials",
  "decision":           "deny",
  "control_ids":        ["H-11"],
  "rule":               "policy/protected-paths.yaml#cloud_credentials",
  "path":               "~/.aws/•••••••••••",   // path redacted in evidence
  "reason_redacted":    "Blocked read of a cloud-credentials path.",
  "redactions_applied": 1,
  "prev_hash":          "00aa3f7c9e21…c19d",   // hash of record 41
  "record_hash":        "5e9d84b1f0a7…7b2f"    // = sha256(this record + prev_hash)
}

The chain is verified by recomputing each record_hash from the record body plus the previous prev_hash. A tamper anywhere breaks every hash downstream, so the exact altered record is pinpointed. No code, file contents or secret values appear in the record — only the category, control and a redacted path.