Evidence guide
An organization running ATR can produce eight kinds of evidence, for internal review, customer questionnaires or a third-party audit. This is evidence of detection. It is not a compliance guarantee.
| ID | Evidence | Reference engine command | Usually kept in |
|---|---|---|---|
EV-01 Config | Rule set and version Which ATR release is deployed. Each rule also carries its own rule_version. | npm ls agent-threat-rules | Dependency lockfile |
EV-02 Config | Lane and blocking The lane, enforce, alert or hunt, decides which maturities may fire. The setting also says whether a match may block. Blocking is off until someone turns it on. | atr guard --lane enforce --blocking # or ATR_LANE / ATR_BLOCKING | Deployment configuration |
EV-03 Logs | Detection records Each match names the rule ID and severity, so a record traces back to a published rule. | atr scan events.json --json # or --sarif | Logging or SIEM |
EV-04 Test | Rule self-tests The deployed rules still match their own true positives and stay silent on their true negatives. | atr test rules/ | CI output |
EV-05 Test | Engine conformance The engine evaluates rules the way the specification says. Results are self-declared and reproducible. | conformance/v1.0 runner | Conformance report |
EV-06 Measurement | Published measurements Recall and false-positive figures for each lane, tied to the ATR version that was measured, with their caveats. | data/measurements/<source>/latest.json | ATR repository |
EV-07 Config | Data egress Detections stay on the machine. Sending a report anywhere takes an explicit flag and an endpoint the operator picks. None is built in. | --report-to-cloud is off by default; --tc-url is required with it | Deployment configuration |
EV-08 Document | Known limits and errata What the rules do not cover, which rules are inert, and errors found in published versions. | LIMITATIONS.md · /errata · rules/index.json (lanes) | ATR repository and site |