# Events and evidence

Supported event shapes, retained originals and provenance.

Contract: console-v1. Stage: private evaluation. Source snapshot: 23fdccfaa88f69e858769f1dad70f82739e2740f.

## Pinned target, partial coverage

OCSF 1.1.0 is the normalization target. Current handwritten mappings are partial, not generated coverage of the OCSF catalog. Native source/account/customer identity, event keys and timestamps are validated against configured scope. Invalid or unsupported data is durably quarantined; do not assume every producer event normalizes successfully.

## Evidence fields

Query event items include id, source_id, source_key, event_time_ms, class_uid, status_id, activity_name, actor, ocsf and raw_reference. UUIDs identify console entities; public API timestamps are epoch milliseconds unless a producer-native payload preserves its own representation. GET /api/v1/events/{id} is tenant-authorized and includes raw_base64 and raw_digest from the retained request batch. The batch may contain multiple records; use record ordinal and provenance, not an assumption that one batch equals one event. Raw references can be null while archive delivery is pending.

## CloudWatch sample bounds

Worker envelopes contain message, event_id, timestamp_ms, ingestion_time_ms, log_group and optional log_stream. The native JSON message must satisfy the supported synthetic shape, log-group allowlist, numeric schema_version and five-minute occurrence/timestamp skew checks. A successful sample does not qualify arbitrary application logs or sensitive audit payloads.

## Narratives cite evidence, not confidence theater

A deterministic alert narrative includes summary, observed_facts, citations, timeline, uncertainty, suggested_review and inference status. citations/evidence_ids reference retained event UUIDs. Check the original native evidence, rule version and scope before asserting intent. A rule match is not proof of compromise, an ATT&CK tag is candidate metadata, and a missing field is not evidence that an activity did not occur. Inference is disabled and delivery_independent:true.

## Retention is a deployment policy

Customer-owned raw evidence is canonical. ClickHouse query retention is not the same as raw-byte retention or Iceberg historical reach. Qualify storage encryption/access, holds, archival/retrieval, snapshot maintenance, deletion propagation, backup and restore in the approved deployment. This evaluation does not make regulatory compliance, immutability or unlimited retention claims.