{% macro identity(ref) -%}
Logical resource
{{ ref.service }} / {{ ref.resource_type }} / {{ ref.resource_id }}
Account and region
{{ ref.account_id }} / {{ ref.region if ref.region is not none else 'Global / not applicable' }}
ARN locator
{{ ref.resource_arn if ref.resource_arn is not none else 'Unavailable — no ARN fabricated' }}
{%- endmacro %}

AWSherlock · Investigation Evidence Pack

{{ pack.lead.title }}

Lead priority: {{ pack.lead.priority }} · Evidence export: {{ pack.status }}

Full Lead ID: {{ pack.lead.lead_id }}

{{ pack.lead.why_it_matters }}

{{ pack.disclaimer }} COMPLETE describes supporting evidence export, never a security PASS.

Exact subjects and related resources

{% for ref in pack.lead.subjects %}

Lead subject

{{ identity(ref) }}{% endfor %} {% for ref in pack.lead.related_resources %}

Related resource

{{ identity(ref) }}{% endfor %}

Supporting Findings

{% for finding in pack.findings %}

{{ finding.check_id }} — {{ finding.title }}

Finding severity: {{ finding.severity }} (separate from Lead priority)

{{ identity(finding.resource) }}

Observed normalized evidence

{{ evidence_text[loop.index0] }}

Source scan: {{ finding.provenance.scan_id }}. API operation: unavailable; not persisted with the Finding.

    {% for reference in finding.references %}
  • {% if links[reference] is not none %}{{ reference }}{% else %}{{ reference }} (not linked){% endif %}
    • {% endfor %}
{% endfor %}

Supporting positive Relationships

{% for edge in pack.relationships %}

{{ edge.type }}

Source

{{ identity(edge.source) }}

Target

{{ identity(edge.target) }}

Stored evidence provenance

    {% for evidence in edge.evidence %}
  • {{ evidence.service if evidence.service is not none else 'Unavailable' }} / {{ evidence.fact if evidence.fact is not none else 'Unavailable' }} / operation: {{ evidence.operation if evidence.operation is not none else 'Unavailable — not persisted or not safe to export' }}
    • {% endfor %}
{% else %}

No supporting relationships in this Lead. Unsupported or uncollected relationships do not establish absence.

{% endfor %}
{% for kind, heading in [('observed', 'Observed facts'), ('unknown', 'Unknown facts'), ('not_proven', 'What is not proven')] %}

{{ heading }}

{% endfor %}

Suggested manual investigation

    {% for step in pack.manual_steps %}
  1. {{ step }}
    2. {% endfor %}

Relevant coverage and limitations

Service coverage is not per-Lead check completeness or exhaustive relationship inventory.

{% for row in pack.coverage %}

{{ row.service }} — {{ row.status }}

    {% for issue in row.issues %}
  • {{ issue.reason_code }} / {{ issue.operation if issue.operation is not none else 'Operation unavailable' }} / {{ issue.resource_id if issue.resource_id is not none else 'Service scope' }}
    • {% endfor %}
{% endfor %}

Source snapshot and derivation

Scan ID
{{ pack.source_snapshot.scan_id }}
Account / region
{{ pack.source_snapshot.account_id }} / {{ pack.source_snapshot.region if pack.source_snapshot.region is not none else 'Global / not configured' }}
Collection started
{{ pack.source_snapshot.collection_started_at }}
Snapshot schema / producer
{{ pack.source_snapshot.schema_version }} / {{ pack.source_snapshot.producer_version }}
Evaluator / correlation implementation
{{ pack.evaluation.evaluator_version }} / {{ pack.evaluation.correlation_version }}
Evidence Pack schema / export policy / locator policy
{{ pack.schema_version }} / {{ pack.export_policy_version }} / {{ pack.evaluation.locator_policy_version }}

Explanations come from existing registered Lead rules. Source metadata and stored evidence are not AWS attestation or proof of authenticity.