Skip to main content
Evidence responses support or weaken specific claims. Use focused evidence calls so each result maps to a clear question.

​
Response Envelope

/v2/evidence returns: Batch evidence responses use the standard batch envelope described in Batch responses.

​
Claim Types

Use only these claim types:
  • active_exploitation
  • sector_targeting
  • actor_association
  • campaign_association
  • malware_association
  • relevance_to_environment
  • observed_in_the_wild

​
Key Fields

Look for evidence IDs, evidence type, source, published time, matched subject, confidence, and any pagination cursor fields. For IOC sector_targeting evidence, attributes may include targeted industries, targeted countries, record count, max confidence, and feed sources.

​
IOC Sector Targeting

sector_targeting can be used with IOC subjects (ip, domain, url, hash, or email) when target-industry context is available. Supplying context.sector filters evidence to that sector. Omitting context.sector lets agents discover the targeted sectors returned by Kyberis.

​
Hydration

Use GET /v2/evidence/{evidence_id} when a high-impact conclusion depends on details from a specific evidence item. Identifier-style IDs such as ip--... or actor--... can return synthetic hydration with no report payload. Prefer hydrating report-backed evidence IDs such as report--... when available.

​
Agent Guidance

Evidence can be sparse. If evidence is weak, say so and recommend validation instead of presenting a decisive conclusion.