Forensic exhibit
Sealed verdict over live endpoint telemetry
Adjudicated verdict
—
Score
—
Confidence
—
MITRE ATT&CK
none corroborated
Agent investigation log · what the agent decided, step by step
ML triage · events the surprisal ensemble nominated for review
The model surfaces candidates in bits of surprisal — it never decides. Only the deterministic engine sealed the verdict above.
Attacker-controlled evidence · the genuine threat of an LLM in DFIR
1 · The attacker wrote this into the telemetry
2 · Two different models narrate the same case
3 · One sealed verdict, both narrators — produced before any model ran
4 · The guard caught the lie
Specialized fleet · strictly disjoint tool contracts, one sealed chain
Run an investigation to freeze evidence windows and seal their verdicts.