Skip to content

Evidence Sources

Purpose

Evidence Sources is the list that decides which relationships Clarity Transform inference treats as traffic, and how much weight each carries. Not every relationship between two devices is a claim about traffic: a runs-on relationship says something quite different from a NetworkFlow one. Only the relationship types and integrations listed here feed inference. The on-screen subtitle reads: "Which relationship types and integrations are trusted as inference evidence, and how each is weighted (observed traffic vs. a firewall permit)."

The Evidence Kind of a source becomes the Evidence value on the suggestions it produces, for example on Suggested App-to-App:

  • Observed: observed traffic.
  • Permitted: a firewall permit. It does not mean the traffic ever happened.

On Suggested App-to-App, Evidence can also show Corroborated, which ranks above Observed.

Where to find it

Discover → Application Inference → Evidence Sources. The page header is Evidence Sources.

What you see

Columns

  • Relationship Type: for example NetworkFlow or FirewallPermits.
  • Integration
  • Evidence Kind: Observed or Permitted.
  • Is Enabled
  • Max Confidence: High, Medium, Low or None.
  • Min Source Confidence: High, Medium or Low.

The grid holds these four rows in this build:

Relationship Type Integration Evidence Kind Is Enabled Max Confidence Min Source Confidence
FirewallPermits * Permitted Yes Low High
NetworkFlow * Observed Yes High High
Communicates * Observed Yes High High
Communicates With * Observed Yes High High

Actions

The grid uses the standard toolbar: Create New, Edit, Remove selected, Clear selection, Reload table data, Enable spreadsheet editing, Export CSV and Import CSV.

Each row has a View Details action (the eye icon).

Form

Create New opens the Create new entry form. Edit opens the Edit entry form for the selected row, with the same fields filled in. The fields, in order:

  • Relationship Type
  • Integration: text. Help: "'*' matches any integration for this relationship_type."
  • Evidence Kind: Observed or Permitted.
  • Is Enabled: a checkbox. Help: "Disabling every row here for a relationship_type/integration pair stops it feeding inference, with no deploy."
  • Max Confidence: High, Medium, Low or None. Help: "None means this evidence kind produces suggestions but never a relationship row."
  • Min Source Confidence: High, Medium or Low. Help: "The producer's own Confidence must meet this floor before the row is used at all."

The footer has Cancel and Save.

Filters

Each column has a filter row, and the grid has a Search: box and a page-size selector (10, 25, 50 or All entries per page).

The grid remembers its Search: text, column filters, sort order and page size between visits. If the grid shows fewer rows than you expect, clear the Search: box and the filter row.

How to

Add an evidence source

  1. Go to Discover → Application Inference → Evidence Sources.
  2. Select Create New. The Create new entry form opens.
  3. Enter the Relationship Type, and the Integration (or * for any integration).
  4. Choose the Evidence Kind, Max Confidence and Min Source Confidence, and select Is Enabled.
  5. Select Save, or Cancel to close the form without saving.

Add a source only where the relationship represents traffic or a permitted path.

Change how much firewall evidence counts

  1. In the grid, select the FirewallPermits row.
  2. Select Edit. The Edit entry form opens.
  3. Set Max Confidence. With None, firewall evidence produces suggestions but never a relationship row. To stop it feeding inference at all, clear Is Enabled.
  4. Select Save.

To see how much of the output rests on firewall evidence, disable the FirewallPermits row and run inference again: select Run inference on Candidate Applications.

Saving a row does not start a run: a change to this list applies on the next inference run. If an inference run on the NetFlow page reports rows "excluded because their relationship type is not a configured evidence source", add a source here for that relationship type and run inference again.