Evidence Fabric

Service Requests

Access requests, role provisioning approvals, and hardware or software requests

Incidents

Incident tracking, Sev-1/Sev-2 response times, MTTR evidence, and post-incident reviews

Change Requests

Standard & emergency RFCs, CAB approvals, risk scores, and rollback plans

Problem Management

Root-cause analysis (RCA), known error database, and preventive fixes

CMDB & Configuration Items

Configuration Item inventory, server topologies, and business service mapping

IT Asset Management (ITAM)

Hardware & software asset register, physical custody, and asset disposal records

Access & User Groups

User directory, role-based access assignments, and group separation of duties audits

GRC & Policy Compliance

Policy exceptions, control attestations, and compliance statement mappings

Risk Register

Risk assessments, impact scoring, and risk treatment action plans

System Audit Logs

Immutable field update logs, configuration changes, and administrator actions

Change & Releases

Workflow status transitions, sprint release approvals, deployment sign-offs

Security & Bug Tracking

Vulnerability issues, CVSS severity tracking, remediation SLAs, fix verification

Jira Service Management (JSM)

IT service requests, user access tickets, customer incident handling

Project Permissions & ACLs

Project permission schemes, administrative delegation, access control lists

PagerDuty

On-call schedules, escalation policies, incident acknowledgment & resolution timelines

Freshservice

Change approvals, ticket resolution SLAs, IT asset discovery

Linear

Development cycle tracking, security issue labels, PR release links

Asana

Task milestone sign-offs, workflow approval records, change logs

Zendesk

Customer issue audits, data privacy ticket tracking, SLA adherence

MFA Enforcement

Universal MFA status, authenticator enrollment, passwordless WebAuthn policies

Lifecycle Management (LCM)

Automated joiner-mover-leaver (JML) logs, deprovisioning timestamps, HR sync

Application Access & SSO

SSO application assignments, least-privilege group rules, session timeout configs

System Log & Security Audits

Sign-in anomalies, failed authentication attempts, administrator privilege escalations

Auth0

User authentication logs, MFA enrollment, tenant security rules, API scopes

Ping Identity

Enterprise SSO, federated identity protocols, adaptive policy evaluation

CyberArk

Vault access session recordings, privileged credential rotations, checkout audits

JumpCloud

Multi-OS device policies, cloud LDAP/RADIUS authentication, user lifecycle

Keycloak

Realm security settings, client role mappings, session management (self-hosted)

Security & Cloud SIEM

Real-time threat detection rules, monitor alert thresholds, notification routing

Log Retention & Archives

Immutable log archive configurations, 365-day compliance retention proofs, index controls

Splunk

Centralized security log ingestion, correlation searches, compliance dashboard proofs

New Relic

System performance metrics, alert incident lifecycle, synthetic monitoring

Elastic / ELK

Security analytics, audit log indexing, centralized search evidence

Dynatrace

Automated root-cause detection, service availability SLAs, anomaly logs

Grafana Cloud

Dashboard snapshot verification, Prometheus alerting rules, infrastructure status

Sumo Logic

Cloud-native audit log aggregation, threat correlation, log retention evidence

Prometheus

System health metrics, scrape target validation, alert manager dispatch history

Branch Protection

Required pull request reviews, status check enforcement, no force-push restrictions

PR Approvals

Peer review logs, committer separation of duties, CI build approvals

Security & Secret Scanning

Dependency vulnerability alerts, exposed credentials alerts, resolution histories

Organization 2FA & Access

Enforced 2-factor authentication status, external collaborator audits, token governance

GitLab

Merge request approvals, branch protection, CI/CD pipeline security audits

Bitbucket

Atlassian branch permissions, required reviewer configurations, merge checks

Azure DevOps

Multi-stage release approval gates, build validation policies, repo permissions

Jenkins

Pipeline build logs, role-based strategy authorization, credential binding

CircleCI

Context security restrictions, automated test completion logs, build artifacts

Argo CD

Continuous delivery deployment sync status, GitOps audit trail, drift detection

HCL AppScan

Application security, static analysis, dynamic scanning & flaw remediation

Qualys

Network vulnerability detection, VMDR scanning schedules, CVSS remediation SLAs

Tenable

Vulnerability assessments, asset discovery, compliance benchmark audits

Rapid7 InsightVM

Live risk scoring, vulnerability prioritization, remediation workflow evidence

CrowdStrike Spotlight

Real-time vulnerability assessment without scan windows, patch gap detection

Snyk

Open-source dependency scanning, container vulnerabilities, IaC misconfigurations

Wiz

Cloud risk graph, vulnerability findings across VMs and containers, toxic combinations

Patch Compliance

OS and application patch levels, missing security update remediation, patch verification

Asset Inventory

Discovered hardware, OS version distribution, unmanaged device detection

CrowdStrike Falcon

EDR agent installation coverage, threat detection alerts, host isolation audit trails

SentinelOne

Autonomous endpoint detection & response, agent health status, rollback actions

Microsoft Defender

Endpoint security baseline compliance, attack surface reduction rules, EDR alerts

Palo Alto Cortex XDR

Unified endpoint and network telemetry, automated threat investigation, containment logs

Carbon Black

Enterprise endpoint activity tracking, behavioral threat detection, file integrity audit

Veeam

Backup job success logs, immutability & hardened repository status, recovery point objectives

Commvault

Enterprise backup coverage, air-gapped copy verification, SLA compliance reporting

Rubrik

Immutable backups, ransomware anomaly detection, disaster recovery orchestration

Cohesity

Snapshot retention policies, cyber recovery vault verification, test restore evidence

Security Awareness Training

Annual compliance training completions, curriculum audit records, certification dates

Phishing Simulations

Simulated phishing campaign results, user click rates, mandatory remedial training logs

Workday

Formal employee onboarding & offboarding records, background check verification logs

BambooHR

Employee lifecycle records, acceptable use policy sign-offs, role change tracking

Rippling

Unified IT provisioning & HR offboarding, device encryption status, user departure locks

Slack

DLP message retention policies, external channel sharing controls, admin audit logs

Zoom

Meeting encryption settings, waiting room enforcement, recording retention policies

Mimecast

Inbound/outbound email hygiene, anti-phishing protection, URL re-writing logs

Confluence

Policy pages, security manual revisions, annual policy review metadata

SharePoint Online

Compliance document libraries via Graph API, version history, access permissions

Amazon S3

Policy repositories, immutable Object Lock (WORM), server-side encryption

Notion

Information security wiki pages, SOP documentation, review approval stamps

Google Drive

Shared drive security policies, external sharing restrictions, audit activity logs

Box

Enterprise retention policies, legal hold records, classification labels

HashiCorp Vault

Secrets access audit logging, dynamic credential lifecycles, key rotation policies