Evidence relationships for incident response

Connect the evidence
behind an incident.

Evidenx™ sits above the evidence collection tools you already use. It connects artifacts, observations and entities, keeps provenance attached, and shows supporting and contradicting evidence, gaps and unresolved questions. AI assists. The investigator assesses significance and owns the conclusions.

Discuss a paid pilot Experience the method
Evidence relationshipsProvenance preservedStarting with DFIR

Evidence does not explain itself. Understanding is constructed.

What it connects

One case structure, starting with DFIR.

Artifact · Implemented
A source item, kept with its provenance.
Forensic and endpoint artifacts produced by the collection tools a team already uses.
Observation · Implemented
Something identified in that source.
A fact the artifact contains, with its source and timing attached.
Entity · Implemented
The person, account, system or file observations concern.
One entity ties together observations drawn from different artifacts.
Hypothesis · Prototype
A proposed explanation, tested against the evidence.
Supporting and contradicting evidence, gaps and unresolved questions are shown side by side.
Claim · The analyst
A statement the investigator can defend.
Its evidential basis and limits stay inspectable. Claims remain with the analyst.
Above collection
Evidenx™ does not collect evidence.
It ingests what collection tools already produce, between collection and the report.
The method

How a hypothesis is tested.

Question
Start with an explanation to test.
The starting question is made visible, not hidden inside a score or an alert.
Prediction
Say what evidence should exist.
Expected observations are declared before the evidence is weighed, so the reasoning can be reviewed.
Evidence
Map each observation to what it supports.
Source, timing, and provenance stay attached to every fact.
Absence
Handle what is missing with care.
A missing permanent record and a missing live snapshot do not mean the same thing.
Alternatives
Keep competing explanations in view.
Evidenx™ shows which facts are shared, which distinguish, and which explanations remain open.
Conclusion
The call is yours.
Evidenx™ structures the evidence and stops. It does not score, and it does not conclude.

The output

A card that shows its work.

A hypothesis card is a walkthrough: the question, the supporting and contradicting evidence, the alternatives, and what is still missing. It ends where a verdict would go, with the reasoning laid bare for the person who decides. Hypothesis generation is in prototype, and the cards shown are output from real DFIR pipeline runs on proof-of-concept cases.

See the demonstrations
Evidenx™
Hypothesis card · prototype
12345678
Step 4 of 8
What else could explain this?
The same evidence fits more than one explanation. Evidenx™ shows which observations are shared across all of them and which one is distinguishing, then leaves the weighing to you.
Data→Information→Understanding→Your conclusion

Scope a paid investigation pilot.

A fixed fee, bounded evidence, agreed acceptance criteria and a measured outcome. Start with a discussion.

Discuss a paid pilotExperience the method