Feature request: Add explicit evidence semantics to IOC matches #986

Motivation

MVT currently identifies matches between forensic artifacts and indicators of compromise. It could be useful to make the evidentiary meaning of each match more explicit and machine-readable.

For example, a spyware domain found in an incoming SMS is fundamentally different from the same domain observed in a DNS or network connection log. Neither automatically establishes a successful compromise.

Proposal

Consider adding optional evidence-context metadata to IOC matches, distinguishing categories such as:

• "received": Indicator appears in incoming content, such as an SMS.
• "referenced": Indicator appears as a passive reference, such as a URL in a document.
• "configured": Indicator appears in a configuration or profile.
• "contacted": An artifact supports that a network interaction occurred.
• "on-device": Indicator matches an observed file, package, or other device object.
• "device-log": Indicator appears in a device log, without necessarily proving execution or communication.

These are illustrative categories rather than a proposed fixed taxonomy. Artifact source and observed activity may be better represented as separate fields.

Benefits

• Reduce overinterpretation of IOC matches in forensic reports.
• Improve automated triage and prioritization.
• Distinguish passive references from observed activity.
• Make downstream analysis less dependent on interpreting module names.

Implementation considerations

Evidence semantics should be determined by the artifact module rather than the IOC type alone.

The metadata could initially be optional to preserve compatibility with existing outputs and alert behavior. Missing metadata should indicate unknown semantics rather than absence of evidence.

Related project

"Zero Breach Toolkit" (https://github.com/interplains/Zero-Breach-Toolkit) implements explicit evidence categories in its result model, including "EV_REFERENCED", "EV_RECEIVED", "EV_CONTACTED", and "EV_ON_DEVICE".

This could serve as inspiration for an independent implementation in MVT.