Begin with the evidence
Nova keeps the source record and its origin available as context moves into findings, detections, investigations, and decisions. This lets a reviewer ask what was observed, when it was observed, where it came from, and what changed afterward.
A conclusion may combine several records, but it should not erase their differences. Cloud configuration evidence, identity behavior, external threat context, and analyst judgment each carry a different meaning.
Questions to ask when reviewing evidence
- Is this record observed, inferred, simulated, or supplied as external context?
- Which customer and organization scope does it describe?
- Is the source healthy and is the evidence recent enough for this decision?
- Can the assessment be followed back to the records that support it?
- Which facts remain unknown or outside the connected scope?
Evidence informs action but does not authorize it
Evidence may show that an incident is urgent. Any response must still follow the customer's policies, permissions and approval requirements. Nova keeps the proposed action linked to the investigation.