Skip to content
Agent Threat Rules (ATR)中文
V. Evidence and audit

Auditor kit

How an auditor checks that an organization really runs ATR, in the configuration it claims. Every step can be checked against public material. There is no need to ask the ATR maintainers.

For
Internal audit, third-party auditors, procurement review
Inputs
Pinned version, deployment configuration, sample detection records, self-test and conformance results
Output
One finding per question: verified, partly verified or not verifiable
Evidence
Evidence guide EV-01 to EV-08
No audits by ATRATR does not audit or certify organizations or their deployments. It has authorized no one to do so on its behalf. Engine conformance is self-declared against the public test suite. This kit only helps an auditor check what one deployment claims.
  1. 01

    Which version of the rules is running?

    Request
    The dependency lockfile or image manifest.
    Verify
    Compare the pinned version with the npm registry and the release tag. Old versions stay listed in the changelog.
    Evidence
    EV-01
  2. 02

    Which lane runs, and may it block?

    Request
    The deployment configuration for lane and blocking.
    Verify
    Check the claim against the lane counts in rules/index.json. The enforce lane loads only stable rules.
    Evidence
    EV-02
  3. 03

    Are the rules actually evaluated?

    Request
    A sample of detection records from the period under review.
    Verify
    In a staging environment, send one of a rule's published true-positive inputs. Confirm that a record names the rule ID.
    Evidence
    EV-03
  4. 04

    Do the rules behave as published?

    Request
    The self-test output for the pinned version.
    Verify
    Re-run the self-tests yourself on the same version. They need no network and no account.
    Evidence
    EV-04
  5. 05

    Does the engine follow the specification?

    Request
    Conformance results for the engine in use.
    Verify
    Results are self-declared. Re-run the suite, then look up the engine's declaration in the implementer report.
    Evidence
    EV-05
  6. 06

    How accurate are the rules?

    Request
    The measurement files the organization cites, with the lane.
    Verify
    A figure without its lane, version and caveat can't be compared. Several corpora are partly the same ones the rules were written from.
    Evidence
    EV-06
  7. 07

    What is known not to work?

    Request
    What the organization knows of LIMITATIONS.md and the errata for that version.
    Verify
    Inert rules are draft or deprecated and fire in no lane. They do not count as coverage.
    Evidence
    EV-08
Page generated 2026-11-10Something wrong or missing? Open an issue