Documentation / Evidence states
State what the record knows—and where that knowledge ends.
Security conclusions are formed under partial visibility. Evidence state is therefore record content, not an annotation added after an analyst asks whether a conclusion is reliable.
Core states
| State | Meaning | Required interpretation |
|---|---|---|
observed | Present directly in attributable telemetry | The record can name its supporting observation |
partially_observed | Some supporting evidence exists, but coverage is incomplete | Do not generalize observed fragments into a complete sequence |
inferred | Derived from adjacent or correlated evidence | Preserve the derivation and do not present it as directly seen |
not_observed | A known visibility requirement was not satisfied | Absence of evidence is not evidence of absence |
telemetry_gap | A sensor or source was unavailable for a bounded period | State the affected source and time range explicitly |
Why form matters
The site and diagrams distinguish evidence states by border and fill as well as color:
observed solid accent border
inferred solid muted border
not observed dashed neutral border with hatch fill
This prevents meaning from depending on hue alone and makes an unobserved region read as absence rather than as another observation category.
Decision boundary
A reasoner—human or software—should be able to determine whether a conclusion crosses beyond available evidence. A confidence score without the shape of missing coverage cannot answer that question.
Common interpretation errors
not_observeddoes not mean an action did not happen.inferreddoes not become observed because several systems repeat the inference.- a telemetry gap should name its source and time window when those are known.
- infrastructure uptime and security-record observability are different concerns.
Return to the Behavior schema or inspect traceability.