如何阅读
研判记录（Trace）

// 示例记录 · 不是真实客户数据，也不是真实运行记录
{
  "trace_id": "VT-EXAMPLE-0001",
  "input_hash": "sha256:9f3a…c21e",
  "sources": [
    {"type": "mail_gateway", "range": "09:00~09:20"},
    {"type": "edr_sysmon",   "host": "fin-ws-0412", "range": "09:00~09:20"}
  ],
  "steps": [
    {"n": 1,
     "observation": "带宏附件（견적서_1021.docm），发件域名注册第 3 天",
     "tool_calls": ["mail.search(message_id=…)", "intel.domain_whois(\"invoice-notice.example\")"],
     "evidence": [{"id": "E1", "ref": "mailgw/2026/10/21/09.log#L2207", "sha256": "1c0d…7be2", "verified": true},
                  {"id": "E2", "ref": "intel/whois/invoice-notice.example", "verified": true}],
     "reasoning": "E1+E2：可能为鱼叉式钓鱼附件", "attack": ["T1566.001"]},
    {"n": 2,
     "observation": "WINWORD.EXE → powershell.exe -NoP -W Hidden -enc …",
     "tool_calls": ["edr.process_tree(host=\"fin-ws-0412\", from=\"09:12\", to=\"09:20\")",
                    "baseline.parent_child(host=\"fin-ws-0412\", window=\"30d\")"],
     "evidence": [{"id": "E3", "ref": "sysmon:EventID=1 RecordID=884213", "verified": true},
                  {"id": "E4", "ref": "baseline/fin-ws-0412/parent_child", "verified": true}],
     "reasoning": "E3：Office 应用执行了编码的 PowerShell，E4：30 天内无先例",
     "attack": ["T1059.001"]},
    {"n": 3,
     "observation": "生成 upd.exe 后执行 vssadmin.exe delete shadows /all /quiet",
     "tool_calls": ["edr.process_tree(…)", "intel.hash_lookup(\"sha256:3b7e…a19f\")"],
     "evidence": [{"id": "E5", "ref": "sysmon:EventID=11 RecordID=884240", "verified": true},
                  {"id": "E6", "ref": "sysmon:EventID=1 RecordID=884251", "verified": true}],
     "reasoning": "E6：删除恢复手段，判断为加密前阶段", "attack": ["T1490"]}
  ],
  "verdict": {"label": "true_positive", "severity": "critical",
              "summary": "勒索软件执行准备阶段",
              "confidence": 0.91,
              "confidence_notes": ["未观察到大量文件变更", "upd.exe 哈希在情报中无匹配"]},
  "recommended_actions": [
    {"action": "isolate_host", "target": "fin-ws-0412", "requires_approval": true},
    {"action": "recall_mail", "match": "attachment_sha256", "requires_approval": false},
    {"action": "block", "targets": ["invoice-notice.example", "203.0.113.45"], "requires_approval": false}
  ],
  "approval": {"action": "isolate_host", "by": "analyst-07", "decision": "approved",
               "at": "2026-10-21T09:17:40+09:00", "comment": "请确认文件服务器的 SMB 会话"},
  "versions": {"model": "correlator-model-x.y", "prompt_template": "triage-vNN", "policy": "auto-response-YYYY.MM"},
  "replay": {"at": "2026-10-22T10:05:12+09:00", "same_input_hash": true,
             "label_match": true, "severity_match": true, "confidence": 0.89,
             "text_diff": "依据语句措辞部分不同"}
}

verified 是自动核对的结果，表示引用的日志是否真实存在于原始存储中。只要有一处为 false，研判就会暂缓并转交分析师。这项核对怎么统计，写在 AI 研判质量页面 的输出捏造检测一项中。