At a hospital, an endpoint alert says a file hash ran, and the proxy log shows that same host fetched the file one minute earlier. What is the proxy log in relation to the endpoint alert?
Select an answer to reveal the explanation.
Short Explanation
A second witness to the same handoff supports the first account without replacing it. You should treat the proxy log as corroboration, because it shows the same host fetched the file a minute before the hash ran. The trap is calling that log a replacement for the alert, an unconnected hint, or the custody paperwork.
Full Explanation
Corroborative evidence is a second source that agrees with the first. The endpoint alert says a hash ran, and the proxy log shows the same host fetched that file a minute earlier, so the log supports the alert without becoming the alert. The proxy log is Corroborative evidence: a second source that agrees the same host fetched that file. The original alert remains the endpoint's own record of execution. Best evidence that replaces the original endpoint alert as the primary record overreaches, because a second source does not erase or replace the original it agrees with. Indirect evidence, a hint that never connects the host to the fetched file is the wrong class here, because this log does connect the host and the file in time. Chain of custody, the paperwork that tracks who handled the saved proxy log is the handling history of an item, not the class of what the log shows. Exam caveat: corroboration supports a finding, and it does not automatically become a substitute for the original record. Operational check: align the host identifier and the file reference across the endpoint alert and the proxy log, and keep both originals when you write the finding.