States
An operation holds one of three states at any moment.The evidence timeline
Reconify compares each received event against the flow definition and records five things about it:- The event ID and type.
- When the event occurred.
- When Reconify received it.
- The role the evidence plays in the flow.
- Whether later evidence superseded it.
Late and out-of-order evidence
Reconify stores both the event time and the received time, so evidence arriving out of order still reconstructs correctly. Evidence that arrives after the deadline explains aresolved_late finding rather than erasing the history of the breach.
Next: findings.