A Standard of Proof

What is it?

A standard of proof is how strong the evidence must be before you state a conclusion. Not every claim needs the same strength: 'the account signed in from a new country' needs one log line; 'the account was compromised and exfiltrated data' needs a corroborated chain.

Why it matters

Conclude on weak evidence and you raise false incidents that burn the team's trust; demand courtroom certainty for everything and you never escalate a real intrusion in time. A senior analyst matches the bar to the claim and to the cost of being wrong.

Where you see it

In the conclusion field of a case, and in the escalation decision: 'confidence: high, based on three independent sources' versus 'confidence: low, single unverified log'. The standard is stated, not left implicit.

What normal looks like

Strong evidence is corroborated (several independent sources agree), consistent (nothing credible contradicts it) and causally ordered (each step explains the next). One source can raise suspicion; corroboration is what supports a conclusion.

What suspicious looks like

A conclusion resting on a single source, on evidence that has a plausible benign explanation left unchecked, or on a chain with a missing link the analyst simply assumed.

How analysts investigate

For each claim, ask three things: how many independent sources support it, is there a benign explanation you have not ruled out, and is the causal chain complete? State the confidence that answer earns.

Common beginner mistakes

Treating two logs from the same source (a SIEM copy of an endpoint event) as independent corroboration — they are one source, not two.
Stating high confidence without ever writing down the benign explanation you rejected and why.

The three tests for evidence strength

Corroboration — do independent sources agree? (A SIEM copy of the same log is not independent.)
Consistency — does anything credible contradict the chain?
Causality — does each step explain the next, with no assumed missing link?

Worked example. Claim: 'j.rai's account was used to exfiltrate the finance share.' Evidence: (1) a sign-in from a new ASN, (2) endpoint telemetry showing a 4 GB archive created on the file server, (3) a proxy log of a 4 GB POST to an unfamiliar host minutes later. Three independent sources, causally ordered, with no benign explanation for the archive-then-upload pairing: this earns high confidence. Drop source (3) and you have suspicion, not proof — the archive could be a backup.

  CLAIM: account used to exfiltrate the finance share
  ┌───────────────┬────────────────────┬────────────────────┐
  │ new-ASN sign  │ 4GB archive built  │ 4GB POST to unknown │
  │ (identity)    │ (endpoint)         │ (proxy)             │  3 independent
  └───────┬───────┴─────────┬──────────┴──────────┬─────────┘  sources, in
          └──── explains ──▶ └──── explains ──────▶            causal order
  Remove any one column  ─▶  suspicion, not proof (benign story reappears)

Confidence comes from independent, consistent, causally-ordered sources — remove one and a benign story returns.

Quick check

You have one strong log: a firewall record of a large outbound transfer to a new host. What confidence does the claim 'this was data exfiltration by an attacker' deserve?

A quick self-check — it doesn't affect your XP or progress.