Process and analysis
What is Provenance?
The record of where a piece of evidence came from and when you collected it. What makes a claim defensible six months later.
Provenance is the record of where a piece of evidence came from, when it was collected, by whom and how. In CTI it covers both technical data and claims from sources.
Without provenance, a finding cannot be checked or defended later. With it, another analyst can retrace the steps, a lawyer can rely on it and a future report can say whether old evidence is still valid.