Map the question
Identify the claim, alert, finding, control, or objective.
Evidence skills
Proof needs a trail.
Make cybersecurity work reviewable with clear sources, timestamps, scope, conclusions, limitations, and next validation steps.
Evidence workflow
Collect less noise. Preserve more meaning.
An evidence packet is not a screenshot folder. It is a reviewable explanation of what each item supports and where uncertainty remains.
Collect proof
Capture logs, screenshots, exports, commands, and context.
Write the note
Record scope, source, time range, meaning, and confidence.
Track uncertainty
Label assumptions, gaps, and next validation actions.
Packet checklist
Can another person review it?
Use these minimum fields for labs, reports, portfolios, and future verification records.
What are you answering?
Alert, finding, affected scope, hypothesis, control, or project objective.
Where did the record come from?
System, user, log source, command, export, screenshot, and capture time.
What does it prove?
Confirmed fact, supporting clue, impact, affected scope, or ruled-out path.
What does it not prove?
Unknowns, assumptions, false-positive risk, missing sources, and next validation.
North Star rule
If you cannot explain the evidence, it is not ready.
Use the free checklist, then practice the complete workflow inside Lab 001.