Provenance

Why it matters

Agentic evidence is often exported, normalized, redacted, summarized, and correlated. Each transformation should be visible.

Evidence to look for

• Original path or source system
• Collection time
• Collector
• Hash or fingerprint
• Normalization step
• Redaction method

Common pitfalls

• Losing links to raw evidence
• Treating summaries as originals
• Failing to mark uncertainty

The evidence transformation pipeline

Agent evidence typically passes through several transformation stages before it reaches an analyst or SIEM. Each stage is a point where data can be lost, modified, or enriched. Understanding this pipeline is essential for defending the reliability of findings.

From source evidence to a derived view

Telltale reads the session store and writes redacted telemetry. That telemetry is not a substitute for the preserved original. When a source path is included, it is a hash, not the raw filesystem path.

What canonical acquisition may not preserve

What Telltale can show depends on the agent store:

• Call ID, error state, and content parts can be conditional rather than universally discarded. Prefer explicit identifiers when available.
• Workspace is conditional for Codex/OpenCode and absent for several other registered sources.
• Copilot user context and content parts are absent; ToolExecution is unknown for Copilot, Qwen, and OpenClaw.
• Command-derived tool evidence is not direct process execution or network telemetry.
• Check the source validation matrix and agent capability profiles for the exact source identity.

Redaction in emitted events

When evidence is emitted as telemetry events (for SIEM ingestion or local review), sensitive content is redacted. Redaction is intentionally aggressive to prevent credential leakage in telemetry logs.

Evidence item:
  field: "arguments"
  redacted_value: "cat [redacted-secret] && curl [controlled-domain]"
  hash: "sha256:<hash-of-original-arguments>"

Hashing for verification

SHA-256 hashes are used throughout the provenance chain to verify evidence integrity without exposing raw content:

• Source path hash: The original file path is hashed using SHA-256 to create a verifiable reference without leaking local filesystem structure. The hash is lowercase hex, with no prefix.
• Evidence value hash: Each evidence item (tool arguments, command content, tool results) is hashed using SHA-256. The hash allows an analyst to verify that a specific raw value matches the redacted telemetry without exposing the raw value in the event stream.
• Correlation hash: Cross-session correlation events hash their source event IDs to create cross-references without exposing internal identifiers.

Temporal provenance in emitted events

Telltale emits three timestamps on each event to preserve temporal provenance:

• timestamp: A resolved top-level timestamp in UTC RFC3339 millisecond format. This is the field SIEM systems should use for sorting and time-based queries.
• event_time: Optional source-provided time. It is evidence from the source, not independent proof of when an action actually occurred.
• observed_at: When Telltale processed the event. Set to the current UTC time at event build. In the current implementation, ingested_at is set to the same value as observed_at.

Defending the evidence chain

When presenting findings from agent evidence, the evidence chain must be defensible. Each step from raw session to final finding should be traceable:

• Raw source: Identify the original session store file, its path (or path hash), and the agent that produced it.
• Collection: Record who collected the evidence, when, and with what tools. Preserve the raw files with forensic copies.
• Normalization: Record the exact source identity, acquisition model, and documented capability gaps. Retained compatibility loss markers are not production capability evidence.
• Redaction: Document what was redacted and why. Emitted events should include hash values that link back to the original content.
• Detection: Document which rules fired, their categories, severity, and score. Include the rule ID and version.
• Correlation: If findings span multiple sessions, document the correlation method and the evidence links.
• Uncertainty: Mark any gaps, missing fields, or uncertain conclusions explicitly. Do not present inference as observation.