Contextual investigations

Priority describes configuration review urgency, not impact or confidence. PROVISIONAL means effective access, reachability or business criticality remains unknown. Missing evidence does not establish safety.

{% if not investigation.contextual %}

No contextual investigation data. Review findings and coverage; no absence or safety conclusion follows.

{% endif %} {% for item in investigation.contextual %}

{{ item.priority }} · {{ item.priority_status }} — {{ item.title }}

{{ item.id }}
Account {{ item.account_id }} · {{ item.region or 'Global' }}

{{ factor.code }} +{{ factor.points }}: {{ factor.explanation }}
Evidence: {% for ref in factor.evidence %}{{ ref.id }} {% endfor %}

{% for field in ['observed', 'inferred', 'unknown'] %}

{{ condition.code }}: {{ condition.text }}{% if condition.assumptions %}
Assumptions: {{ condition.assumptions | join(' ') }}
{% endif %}{% if condition.evidence %}
Evidence: {% for ref in condition.evidence %}{{ ref.id }} {% endfor %}
{% endif %}

{% endfor %}

Resources

{{ ref.account_id }} / {{ ref.region or 'Global' }} / {{ ref.service }} / {{ ref.resource_type }} / {{ ref.resource_id }}{% if ref.resource_arn %}
{{ ref.resource_arn }}{% endif %}

Supporting evidence references

{{ finding.id }}: {{ finding.reference.check_id }} / {{ finding.reference.service }} / {{ finding.reference.resource_id }}
{{ edge.id }}: {{ edge.reference.source.resource_id }} → {{ edge.reference.type }} → {{ edge.reference.target.resource_id }}

Coverage limitations

{{ gap.id }}: {{ gap.code }} / {{ gap.service or 'Supporting evidence' }} / {{ gap.status }}{% if gap.reason_code %} / {{ gap.reason_code }}{% endif %}{% if gap.operation %} / {{ gap.operation }}{% endif %}
No supporting coverage gap detected. Effective access and exhaustive inventory remain unverified.

Recommended investigation actions

{{ action.text }}

{% endfor %}

Investigation Graph

Solid blue lines: observed configuration relationships. Dashed gray lines: inferred review associations. Neither establishes verified access or an attack path. Findings and coverage gaps are evidence nodes.

{% if investigation.graph.investigations %}

Select investigationHighlight nodes Show inferred associations

Inspect selected investigation evidence

Select a node to read its full label.

Legend: purple = investigation; blue = resource or IAM role; orange = supporting finding; red = coverage gap. Graph limits: {{ investigation.graph.limits.nodes_per_investigation }} nodes and {{ investigation.graph.limits.edges_per_investigation }} edges per selection. {{ investigation.graph.omitted_investigations }} additional investigations omitted from the graph; their text remains above.

{% else %}

No graph data. Missing graph nodes do not establish safety or absent relationships.