{
  "dataset": "corrobore-proof-carrying-kestrel",
  "version": "1.0.0",
  "description": "An attribution question whose honest answer must carry supporting evidence, counter-evidence and the gaps that prevent a stronger conclusion.",
  "license": "CC0-1.0",
  "generated_by": "corrobore-website/usecases/proof-carrying.mjs",
  "facts": {
    "supporting_evidence": 4,
    "counter_evidence": 3,
    "unresolved_unknowns": 3,
    "weakest_support": "evidence--feed-assertion"
  },
  "memories": [
    {
      "identity_key": "question--kestrel-attribution",
      "kind": "analysis.question",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Is the intrusion at the four affected organizations attributable to the Kestrel cluster?",
          "properties": {
            "requested_by": "incident-review-board"
          }
        }
      },
      "provenance": [
        {
          "source_id": "review-board",
          "locator": "question#1",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "question"
      ]
    },
    {
      "identity_key": "statement--attribution-plausible",
      "kind": "analysis.statement",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Attribution to Kestrel is plausible but not established: the strongest technical overlaps are explainable by a public tool leak.",
          "properties": {
            "verdict": "plausible"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analyst",
          "locator": "assessment#1",
          "observed_at": null
        }
      ],
      "confidence": 0.62,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "statement"
      ]
    },
    {
      "identity_key": "evidence--beacon-interval",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Beacon interval and jitter match the profile documented in two prior Kestrel intrusions.",
          "properties": {
            "stance": "supports",
            "source_reliability": "high"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--beacon-interval",
          "locator": "evidence--beacon-interval#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.86,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "supports"
      ]
    },
    {
      "identity_key": "evidence--loader-hash",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Loader hash is byte-identical to a sample attributed to Kestrel eleven months ago.",
          "properties": {
            "stance": "supports",
            "source_reliability": "high"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--loader-hash",
          "locator": "evidence--loader-hash#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.86,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "supports"
      ]
    },
    {
      "identity_key": "evidence--language-artifact",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Build artifacts carry a locale string consistent with previously reported Kestrel tooling.",
          "properties": {
            "stance": "supports",
            "source_reliability": "medium"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--language-artifact",
          "locator": "evidence--language-artifact#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.64,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "supports"
      ]
    },
    {
      "identity_key": "evidence--feed-assertion",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "A commercial feed asserts the attribution without publishing its basis.",
          "properties": {
            "stance": "supports",
            "source_reliability": "low"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--feed-assertion",
          "locator": "evidence--feed-assertion#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.32,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "supports"
      ]
    },
    {
      "identity_key": "evidence--tool-leaked",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The loader family was publicly leaked seven months ago and has since been used by at least three unrelated operators.",
          "properties": {
            "stance": "challenges",
            "source_reliability": "high"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--tool-leaked",
          "locator": "evidence--tool-leaked#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.86,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "challenges"
      ]
    },
    {
      "identity_key": "evidence--timing-mismatch",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Operating hours in this intrusion do not match the pattern established in prior Kestrel activity.",
          "properties": {
            "stance": "challenges",
            "source_reliability": "medium"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--timing-mismatch",
          "locator": "evidence--timing-mismatch#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.64,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "challenges"
      ]
    },
    {
      "identity_key": "evidence--infra-resold",
      "kind": "analysis.evidence",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The staging address block changed hands after the earlier intrusions.",
          "properties": {
            "stance": "challenges",
            "source_reliability": "high"
          }
        }
      },
      "provenance": [
        {
          "source_id": "collection--infra-resold",
          "locator": "evidence--infra-resold#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.86,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "evidence",
        "challenges"
      ]
    },
    {
      "identity_key": "unknown--primary-auth-log",
      "kind": "analysis.unknown",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The primary authentication log for the staging window has not been obtained.",
          "properties": {
            "impact": "high"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "unknown--primary-auth-log#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "unknown",
        "impact-high"
      ]
    },
    {
      "identity_key": "unknown--c2-operator-artifacts",
      "kind": "analysis.unknown",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "No operator-side artifacts have been recovered from the command infrastructure.",
          "properties": {
            "impact": "high"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "unknown--c2-operator-artifacts#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "unknown",
        "impact-high"
      ]
    },
    {
      "identity_key": "unknown--victim-notification",
      "kind": "analysis.unknown",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Two of the four affected organizations have not yet responded to notification.",
          "properties": {
            "impact": "medium"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "unknown--victim-notification#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "kestrel",
        "unknown",
        "impact-medium"
      ]
    }
  ],
  "relationships": [
    {
      "identity_key": "rel--question-statement",
      "source_key": "question--kestrel-attribution",
      "target_key": "statement--attribution-plausible",
      "kind": "answered_by",
      "properties": {},
      "provenance": [
        {
          "source_id": "analyst",
          "locator": "assessment#1",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--beacon-interval",
      "source_key": "evidence--beacon-interval",
      "target_key": "statement--attribution-plausible",
      "kind": "supports",
      "properties": {
        "source_reliability": "high"
      },
      "provenance": [
        {
          "source_id": "collection--beacon-interval",
          "locator": "evidence--beacon-interval#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--loader-hash",
      "source_key": "evidence--loader-hash",
      "target_key": "statement--attribution-plausible",
      "kind": "supports",
      "properties": {
        "source_reliability": "high"
      },
      "provenance": [
        {
          "source_id": "collection--loader-hash",
          "locator": "evidence--loader-hash#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--language-artifact",
      "source_key": "evidence--language-artifact",
      "target_key": "statement--attribution-plausible",
      "kind": "supports",
      "properties": {
        "source_reliability": "medium"
      },
      "provenance": [
        {
          "source_id": "collection--language-artifact",
          "locator": "evidence--language-artifact#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--feed-assertion",
      "source_key": "evidence--feed-assertion",
      "target_key": "statement--attribution-plausible",
      "kind": "supports",
      "properties": {
        "source_reliability": "low"
      },
      "provenance": [
        {
          "source_id": "collection--feed-assertion",
          "locator": "evidence--feed-assertion#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--tool-leaked",
      "source_key": "evidence--tool-leaked",
      "target_key": "statement--attribution-plausible",
      "kind": "challenges",
      "properties": {
        "source_reliability": "high"
      },
      "provenance": [
        {
          "source_id": "collection--tool-leaked",
          "locator": "evidence--tool-leaked#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--timing-mismatch",
      "source_key": "evidence--timing-mismatch",
      "target_key": "statement--attribution-plausible",
      "kind": "challenges",
      "properties": {
        "source_reliability": "medium"
      },
      "provenance": [
        {
          "source_id": "collection--timing-mismatch",
          "locator": "evidence--timing-mismatch#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--evidence--infra-resold",
      "source_key": "evidence--infra-resold",
      "target_key": "statement--attribution-plausible",
      "kind": "challenges",
      "properties": {
        "source_reliability": "high"
      },
      "provenance": [
        {
          "source_id": "collection--infra-resold",
          "locator": "evidence--infra-resold#excerpt",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--unknown--primary-auth-log",
      "source_key": "unknown--primary-auth-log",
      "target_key": "statement--attribution-plausible",
      "kind": "limits",
      "properties": {
        "impact": "high"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "unknown--primary-auth-log#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--unknown--c2-operator-artifacts",
      "source_key": "unknown--c2-operator-artifacts",
      "target_key": "statement--attribution-plausible",
      "kind": "limits",
      "properties": {
        "impact": "high"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "unknown--c2-operator-artifacts#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--unknown--victim-notification",
      "source_key": "unknown--victim-notification",
      "target_key": "statement--attribution-plausible",
      "kind": "limits",
      "properties": {
        "impact": "medium"
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "unknown--victim-notification#gap",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    }
  ]
}