CONSOLE V1 / CUSTOMER GUIDE

Events and evidence

Supported event shapes, retained originals and provenance.

Pinned target, partial coverage

OCSF 1.1.0 is the normalization target. Current handwritten mappings are partial, not generated coverage of the OCSF catalog. Native source/account/customer identity, event keys and timestamps are validated against configured scope. Invalid or unsupported data is durably quarantined; do not assume every producer event normalizes successfully.

Evidence fields

Query event items include id, source_id, source_key, event_time_ms, class_uid, status_id, activity_name, actor, ocsf and raw_reference. UUIDs identify console entities; public API timestamps are epoch milliseconds unless a producer-native payload preserves its own representation. GET /api/v1/events/{id} is tenant-authorized and includes raw_base64 and raw_digest from the retained request batch. The batch may contain multiple records; use record ordinal and provenance, not an assumption that one batch equals one event. Raw references can be null while archive delivery is pending.

CloudWatch sample bounds

Worker envelopes contain message, event_id, timestamp_ms, ingestion_time_ms, log_group and optional log_stream. The native JSON message must satisfy the supported synthetic shape, log-group allowlist, numeric schema_version and five-minute occurrence/timestamp skew checks. A successful sample does not qualify arbitrary application logs or sensitive audit payloads.

Narratives cite evidence, not confidence theater

A deterministic alert narrative includes summary, observed_facts, citations, timeline, uncertainty, suggested_review and inference status. citations/evidence_ids reference retained event UUIDs. Check the original native evidence, rule version and scope before asserting intent. A rule match is not proof of compromise, an ATT&CK tag is candidate metadata, and a missing field is not evidence that an activity did not occur. Inference is disabled and delivery_independent:true.

Retention is a deployment policy

Customer-owned raw evidence is canonical. ClickHouse query retention is not the same as raw-byte retention or Iceberg historical reach. Qualify storage encryption/access, holds, archival/retrieval, snapshot maintenance, deletion propagation, backup and restore in the approved deployment. This evaluation does not make regulatory compliance, immutability or unlimited retention claims.