SIS CLI

Verdict & Data Model

How sis models a scan result, and how to read the malware verdict. (The AI-ingestion decision is a separate axis — see sis docs assess.)

Report model

A scan report is composed of:

  1. findings — atomic detector outcomes with evidence and metadata
  2. chains — correlated trigger/action/payload sequences
  3. intent_summary — behavioural intent buckets with scored contributions
  4. verdict — final label, score, confidence, and top intent
  5. policy — policy provenance (embedded/runtime bundle) and load status
  6. profiling/telemetry blocks (when enabled)

Finding model

Each finding carries:

  • id — content-hash identity, sis-<64 hex> (used by sis explain; see sis docs explain)
  • kind — stable detector ID (e.g. pdf:open_action_present, vbs:suspicious_api)
  • severity — Critical | High | Medium | Low | Info
  • impact — Critical | High | Medium | Low | None
  • confidence — Certain | Strong | Probable | Tentative | Weak
  • title, description, evidence, objects, positions
  • meta — structured context used by triage/query/correlation
  • optional graph metadata (chain stage, subgraph context)

severity/impact/confidence are operational, not cosmetic — read all three together, and treat any change to them as a behavioural change requiring regression review.

Format identity

sis separates three identities:

  • Claimed — path/transport hint (e.g. extension)
  • Detected — content-verified root type (authoritative)
  • Subgraph — format of a nested artefact

A claimed/detected conflict produces a mismatch finding. Nested artefacts keep their native lineage via a canonical subgraph path, e.g. html:root/zip:payload.zip/pe:payload.exe, so evidence is traceable from root trigger to nested payload. Nesting is one bounded graph with recursion-depth, decode/extraction-byte, container-entry, and timeout budgets enforced.

Intent taxonomy

Findings map into intent buckets (e.g. Execution, Phishing, ExploitPrimitive, DataExfiltration, DenialOfService, ModelPoisoning). Intent scoring feeds chain ranking and verdict-promotion floors, and is exposed in report JSON and query surfaces — so you can triage by behavioural class, not just detector family.

Verdict

The verdict is a policy-governed classification:

  • label — Clean | Anomalous | Suspicious | Malicious
  • score
  • confidence
  • top intent
  • policy telemetry — triggered_by, floor_applied, policy stage metadata where emitted
  • soft-lane telemetry (when the adjudicator’s soft combiner produced the verdict) — verdict.soft_lane names the producing lane (hard_rail / malicious_trigger = a confirmed primitive or fired malicious trigger; suspicious_trigger / anomalous_trigger = a specific gated threat class; soft / soft_capped_* = built from soft-evidence accumulation), and verdict.soft_evidence carries the breakdown behind the score: the prior, the raw/calibrated posteriors, the evidence-group count, and the top signed group contributions. This turns a soft-posterior Suspicious/Malicious verdict from a black box into an answerable “which evidence groups summed past the prior”. Both are omitted when absent (legacy path), so default output is unchanged.

Read the label alongside chain completeness, intent mix, and confidence composition — a high score from a single low-confidence finding is not the same as one corroborated across an independent chain. The thresholds and floors are policy-driven and tunable without a rebuild.

Inspecting it via query

sis query <file> findings --json
sis query <file> findings.composite --json
sis query <file> chains --chain-summary events --json
sis query <file> correlations --json
sis query <file> iocs --json
sis query <file> urls --json
sis query <file> policy.active --json
  • sis docs investigate · sis docs query · sis docs explain