Corroboration
Definition
The practice of confirming an observed attacker action by finding evidence of the same action in at least two independent data sources, for example, a suspicious process in EDR telemetry confirmed by a corresponding outbound connection in network flow data. Corroboration reduces the risk of acting on a single-source false positive during scoping.
- Requirement
- Same action confirmed in 2+ independent data sources
- Example pairing
- EDR process telemetry plus network flow data
- Purpose
- Reduces risk of acting on single-source false positive
- Applies during
- Incident scoping and confirmation
Common questions
Why is corroboration especially important during the scoping phase of an incident?+
Scoping decisions, such as which hosts to isolate or preserve, are often made under time pressure with incomplete data, so confirming a suspected attacker action across two independent telemetry sources reduces the chance of committing containment resources based on a single tool's false alarm.
What counts as truly independent data sources for corroboration purposes?+
Sources are independent when a failure or blind spot in one does not also affect the other, such as endpoint telemetry and network flow logs collected by separate systems, whereas two alerts generated by the same detection engine from the same log feed do not provide real corroboration.
How does corroboration in incident response compare to corroboration of a witness account?+
Both rely on the same logic of seeking independent confirmation to reduce reliance on a single fallible source, though incident response corroboration draws on machine-generated telemetry while witness corroboration draws on separate human accounts or physical evidence.
Related terms
- Bharatiya Sakshya Adhiniyam 2023 (BSA)
- India’s evidence statute operative from 1 July 2024, with savings for specified existing proceedings. Section 39 concerns expert opinion, section 45 its...
- Blast Radius
- The full set of systems, accounts, and data that an attacker has accessed or could access given their current level of compromise....
- Circumstantial Evidence
- Evidence that requires an inference to connect it to the fact in dispute. A forensic finding such as DNA concordance between a...
- Compliant False Confession
- A false confession given to escape an aversive situation (prolonged questioning, a threat to family, exhaustion) even though the confessor knows they...
- Declaration Threshold
- The criteria defined in an organisation's IR plan that a suspected event must meet before it is formally declared a confirmed incident,...
- Direct Evidence
- Evidence that proves a fact in issue without requiring the fact-finder to draw an inference, such as eyewitness testimony to the act...
- Documentary Evidence
- Any document produced before a court to prove the truth of its contents. The category includes paper documents, electronic records, photographs, audio...
- Dwell Time
- The duration between key-down and key-up for one key under the recorder’s event definitions, commonly expressed in milliseconds. Timing resolution and event...
- Dying Declaration
- Statement of a person about cause of death or circumstances of the transaction resulting in death. Admissible under BSA 2023 Section 26...
- Extra-Judicial Confession
- A confession made outside court, to a person other than a magistrate, such as a friend, cellmate or family member, and treated...
- Gatekeeping
- The judicial function, codified in the United States by Daubert v. Merrell Dow Pharmaceuticals (1993) and Federal Rule of Evidence 702, of...
- General Acceptance (Frye Standard)
- The admissibility rule from Frye v. United States (DC Cir. 1923) requiring a technique to be generally accepted in the relevant scientific...
Explained in these topics
- Evidence, Confessions and Dying Declaration (Unit V)Independent supporting evidence courts look for when a confession or declaration is retracted, inconsistent, or otherwise doubtful.
- Interrogation Techniques: Reid, PEACE and False ConfessionsSupporting evidence whose independence and provenance need examination.
- Landmark Judgments on Expert EvidenceEvidence that confirms or supports a piece of evidence from an independent source. In Indian jurisprudence, expert opinion is treated as requiring corroboratio...
- Scoping and Confirming an Incident