# Import evidence, investigate findings, export reports

**Recorded synthetic examples; computer-generated narration.** These lessons document the implemented evaluation console, not production accreditation, vendor commands or compliance attestation.

## 1. Obtain the synthetic practice file

**Chapter:** 00:00:00.000

This lesson follows evidence into findings and reports. Step one. Open Evidence and download the synthetic fixture JSON. Native vendor exports are not supported collectors. The current import contract accepts CAS metadata JSON or CSV, and one public certificate in a private installation.

## 2. Select a file and assessment date

**Chapter:** 00:00:22.333

Step two. Select Import evidence. Choose the synthetic JSON file and set the assessment date to October ninth, twenty twenty-six for this practice fixture. Current customer reviews should use their actual assessment date. Never include private keys, credentials, card data or recovery shares.

## 3. Import and confirm provenance

**Chapter:** 00:00:45.200

Step three. Select Import. The new snapshot contains normalized inventory and versioned rule results. Uploaded verified claims are downgraded to self-reported. Missing, stale or conflicting evidence cannot silently pass. A rejected file is not retained as accepted evidence.

## 4. Trace a finding to evidence

**Chapter:** 00:01:06.600

Step four. Open Findings and click a result. Read the outcome, severity, rule identifier, rule version, source digest and evidence pointer. Unknown and manual review require attention; they are not passing assessments.

## 5. Read rule applicability and sources

**Chapter:** 00:01:24.267

Step five. Open Policies and select Load policies. Review applicability, required evidence, remediation and source publication status. These are internal assurance controls. Algorithm recognition does not establish module validation, regulatory compliance or end-to-end readiness.

## 6. Export the right report format

**Chapter:** 00:01:46.867

Step six. Return to Overview. Choose Report Markdown, JSON or CSV for the intended reviewer. Download the CBOM only as the CAS-owned schema; it is not validated CycloneDX or SPDX interoperability. Preserve the assessment date, digest and rule versions with the report.

## 7. Inspect audit and connector limitations

**Chapter:** 00:02:10.333

Step seven. In Evidence, load the audit record and declared connectors. Check event history and each connector's limitations. Local audit chaining does not prove against whole-database rollback without an external trusted anchor. No vendor connection is initiated by viewing this catalog.