{
  "dataset": "corrobore-next-best-evidence",
  "version": "1.0.0",
  "description": "Seven candidate collection actions against four open gaps, under a 48-hour deadline and a bounded budget. The highest-gain action is not the right one.",
  "license": "CC0-1.0",
  "generated_by": "corrobore-website/usecases/next-best-evidence.mjs",
  "facts": {
    "candidate_actions": 7,
    "open_gaps": 4,
    "deadline_hours": 48,
    "actions_closing_nothing": 2
  },
  "memories": [
    {
      "identity_key": "investigation--deadline",
      "kind": "analysis.investigation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Intrusion review with a board briefing in 48 hours and a collection budget of one unit.",
          "properties": {
            "deadline_hours": 48,
            "budget": 1
          }
        }
      },
      "provenance": [
        {
          "source_id": "review-board",
          "locator": "charter",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "investigation"
      ]
    },
    {
      "identity_key": "gap--primary-auth-log",
      "kind": "analysis.gap",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The primary authentication log for the staging window is missing.",
          "properties": {
            "impact": "high",
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--primary-auth-log#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "gap",
        "open"
      ]
    },
    {
      "identity_key": "gap--operator-artifacts",
      "kind": "analysis.gap",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "No operator-side artifacts have been recovered.",
          "properties": {
            "impact": "high",
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--operator-artifacts#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "gap",
        "open"
      ]
    },
    {
      "identity_key": "gap--staging-owner",
      "kind": "analysis.gap",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The account holder behind the staging address block is unknown.",
          "properties": {
            "impact": "medium",
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--staging-owner#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "gap",
        "open"
      ]
    },
    {
      "identity_key": "gap--change-window",
      "kind": "analysis.gap",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Nobody has confirmed who owned the change window during the push.",
          "properties": {
            "impact": "medium",
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--change-window#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "gap",
        "open"
      ]
    },
    {
      "identity_key": "action--dns-history",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Pull historical DNS for the staging domain from the existing subscription.",
          "properties": {
            "expected_gain": 0.42,
            "cost": 0.15,
            "hours": 2,
            "risk": 0.05,
            "authority": "granted"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--dns-history#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    },
    {
      "identity_key": "action--disk-image",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Acquire and analyse a full disk image of the compromised build host.",
          "properties": {
            "expected_gain": 0.88,
            "cost": 0.8,
            "hours": 96,
            "risk": 0.25,
            "authority": "granted"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--disk-image#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    },
    {
      "identity_key": "action--provider-subpoena",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Compel the hosting provider to disclose the account holder for the address block.",
          "properties": {
            "expected_gain": 0.91,
            "cost": 0.55,
            "hours": 240,
            "risk": 0.4,
            "authority": "requires_legal"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--provider-subpoena#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    },
    {
      "identity_key": "action--auth-log-request",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Request the primary authentication log from the customer's identity provider.",
          "properties": {
            "expected_gain": 0.79,
            "cost": 0.1,
            "hours": 8,
            "risk": 0.1,
            "authority": "granted"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--auth-log-request#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    },
    {
      "identity_key": "action--vendor-enrichment",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Buy an enrichment report from the commercial feed that already asserted the attribution.",
          "properties": {
            "expected_gain": 0.18,
            "cost": 0.35,
            "hours": 1,
            "risk": 0.05,
            "authority": "granted"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--vendor-enrichment#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    },
    {
      "identity_key": "action--victim-interview",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Interview the release engineer who owned the change window.",
          "properties": {
            "expected_gain": 0.55,
            "cost": 0.2,
            "hours": 24,
            "risk": 0.15,
            "authority": "granted"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--victim-interview#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    },
    {
      "identity_key": "action--sandbox-detonation",
      "kind": "analysis.action",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Detonate the loader in a sandbox to re-derive behaviour already documented in the report.",
          "properties": {
            "expected_gain": 0.31,
            "cost": 0.25,
            "hours": 6,
            "risk": 0.2,
            "authority": "granted"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--sandbox-detonation#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "nbe",
        "action"
      ]
    }
  ],
  "relationships": [
    {
      "identity_key": "rel--inv-gap--primary-auth-log",
      "source_key": "investigation--deadline",
      "target_key": "gap--primary-auth-log",
      "kind": "blocked_by",
      "properties": {
        "impact": "high"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--primary-auth-log#gap",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-gap--operator-artifacts",
      "source_key": "investigation--deadline",
      "target_key": "gap--operator-artifacts",
      "kind": "blocked_by",
      "properties": {
        "impact": "high"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--operator-artifacts#gap",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-gap--staging-owner",
      "source_key": "investigation--deadline",
      "target_key": "gap--staging-owner",
      "kind": "blocked_by",
      "properties": {
        "impact": "medium"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--staging-owner#gap",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-gap--change-window",
      "source_key": "investigation--deadline",
      "target_key": "gap--change-window",
      "kind": "blocked_by",
      "properties": {
        "impact": "medium"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "gap--change-window#gap",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--dns-history",
      "source_key": "investigation--deadline",
      "target_key": "action--dns-history",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--dns-history#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--closes-action--dns-history",
      "source_key": "action--dns-history",
      "target_key": "gap--staging-owner",
      "kind": "would_close",
      "properties": {
        "expected_gain": 0.42
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--dns-history#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--disk-image",
      "source_key": "investigation--deadline",
      "target_key": "action--disk-image",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--disk-image#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--closes-action--disk-image",
      "source_key": "action--disk-image",
      "target_key": "gap--operator-artifacts",
      "kind": "would_close",
      "properties": {
        "expected_gain": 0.88
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--disk-image#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--provider-subpoena",
      "source_key": "investigation--deadline",
      "target_key": "action--provider-subpoena",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--provider-subpoena#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--closes-action--provider-subpoena",
      "source_key": "action--provider-subpoena",
      "target_key": "gap--staging-owner",
      "kind": "would_close",
      "properties": {
        "expected_gain": 0.91
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--provider-subpoena#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--auth-log-request",
      "source_key": "investigation--deadline",
      "target_key": "action--auth-log-request",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--auth-log-request#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--closes-action--auth-log-request",
      "source_key": "action--auth-log-request",
      "target_key": "gap--primary-auth-log",
      "kind": "would_close",
      "properties": {
        "expected_gain": 0.79
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--auth-log-request#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--vendor-enrichment",
      "source_key": "investigation--deadline",
      "target_key": "action--vendor-enrichment",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--vendor-enrichment#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--victim-interview",
      "source_key": "investigation--deadline",
      "target_key": "action--victim-interview",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--victim-interview#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--closes-action--victim-interview",
      "source_key": "action--victim-interview",
      "target_key": "gap--change-window",
      "kind": "would_close",
      "properties": {
        "expected_gain": 0.55
      },
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--victim-interview#entry",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--inv-action--sandbox-detonation",
      "source_key": "investigation--deadline",
      "target_key": "action--sandbox-detonation",
      "kind": "considers",
      "properties": {},
      "provenance": [
        {
          "source_id": "collection-catalogue",
          "locator": "action--sandbox-detonation#entry",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    }
  ]
}