27. Evidence bundles
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
An evidence bundle is an audit-ready export: everything the platform holds for a chosen scope - a compliance scan, a host, an investigation, a date range or a module - gathered into one record you can export as JSON or HTML and hand to an auditor. Review-queue items are included automatically in date-range and investigation bundles.
Secrets (passwords, tokens, keys, credentials) are redacted before anything is stored or exported. The JSON export carries an integrity block that this installation can verify later (27.4).
Permissions:
| Task | Permission | Four-eyes |
|---|---|---|
| See bundles, open details, export JSON or HTML | View evidence | - |
| Create a bundle | Run scans | no |
| Delete a bundle | Delete evidence | no |
27.1 What you see#
Path: Evidence. The page title is Evidence & Audit bundles.
- Tiles: Total bundles, Ready, Failed, Evidence items.
- Filters: Search bundles..., All scopes, All statuses, Clear x.
- Table: Name, Scope, Status, Items, Created, Generated, Actions.
- Actions per row: View details, Export JSON, Export HTML, Delete bundle.
27.2 Procedure: create a bundle#
- Open Evidence and expand New evidence bundle.
- Fill the form:
| Field | Meaning |
|---|---|
| Bundle name * | For example "Q2 2026 Compliance audit" |
| Description | Optional notes |
| Scope type * | One of the scopes below |
| (scope value) | The ID, module or dates the scope needs |
| Scope type | What to enter | What is collected |
|---|---|---|
| Compliance scan | The scan ID | Every control result of that scan, per host |
| Asset | The agent (asset) ID | The host's latest result per framework, its DLP incidents, FIM events and network evidence |
| Investigation | The investigation ID | The case's findings, artefact hashes, timeline events and linked review items |
| Date range | From * and To * | Records in that period from every module, plus review items |
| Module | Module * (compliance, dlp, fim, forensics, network, intelligence) | That module's records |
- Press Create bundle. The button shows Building... while the platform collects.
What you see: the bundle in the table with status ready and its item count.
If it fails: the form marks the field in error (for example a missing ID). A bundle with status failed shows the reason in its details; check the ID exists and try again.
Where to find the IDs: a scan ID is in the scan page address; an agent ID in Environment > Hosts; an investigation ID in Forensics.
27.3 Procedure: export and hand over#
- Press View details to check Bundle details (Scope, From, To, Created, Generated, Created by) and Summary (Total items, Highest severity, Modules).
- Press Export JSON for a machine-checkable file, or Export HTML for a readable document. The file downloads to your computer.
- Hand the file over by your organisation's approved channel.
Use JSON when the file must be checkable later. HTML exports carry no integrity seal.
27.4 Verify an exported JSON file#
The JSON export's integrity block holds the SHA-256 of every item and of the whole document, and a signature that only this installation can check. Verification shows whether the file was changed, and which items were changed, added or removed.
There is no button for this in the console. Use the API with a service-account key that has View evidence (API keys: chapter 15):
curl -sS -X POST "https://<server>/api/v1/evidence/verify" \
-H "Authorization: Bearer lwk_..." \
-H "Content-Type: application/json" \
--data-binary @evidence-bundle.jsonWhat you see: the answer says valid, whether the digests and the signature match, and lists the item ids that differ. A file whose digests were recomputed after an edit still fails on the signature. Only the installation that made the export can check its signature.
On a self-signed certificate, add --cacert with your CA file rather than turning off certificate checks (TLS and certificates).
27.5 Procedure: delete a bundle#
Permission: Delete evidence. Risk: the bundle and all its items are removed permanently. Rollback: none - export it first if it may be needed.
- Press Delete bundle on the row (or in the details drawer).
- Confirm Delete this bundle?
The source records in the modules are not deleted; only the bundle is.
A bundle cannot be edited or rebuilt. To change its name, description or scope, create a new bundle (27.2) and delete the old one (27.5).
27.6 If it fails#
| What you see | Cause | Fix |
|---|---|---|
| Access denied "You do not have permission to view evidence bundles." | No View evidence | Ask an administrator |
| Create button refused | No Run scans | Ask an administrator |
| Bundle has 0 items | Nothing matched the scope (wrong ID, empty range) | Check the scope value |
| Verification says the signature does not match | The file was edited, or it came from another installation | Obtain the original export |