CAIN-42 evidence library

Integration products — 2026-11-13

Evidence bundle: 0 claims, 0 of 0 invariants held.

Last reviewed 2026-11-14

SHA-256 manifest

The bundle's own README

Integration products — 2026-11-13#

This bundle records the customer-side integration layer between CAIN-42 and the four platforms a buyer is most likely to already own: **Splunk/Cisco, Palo Alto Prisma AIRS, Zenity, and Microsoft Sentinel/Entra**.

What is here#

• samples/ — real renders of the same signed CAIN-A75-001 record in six formats:

splunk.json (HEC), cef.txt, leef.txt, sentinel.json, prisma.json, zenity.json.

• overlay/ — a signed, chained CAIN Proof Overlay bundle built from one normalized Prisma event.

It contains record-0001.json, head.json, public_key.json, and a self-contained verify_offline.py that imports no CAIN code.

• verify_integrations.py — checks the samples and verifies the overlay bundle offline.
• MANIFEST.json and SHA256SUMS — integrity listing.

Verify#

cd overlay
python3 verify_offline.py --pinned-pub "$(python3 -c 'import json;print(json.load(open("public_key.json"))["public_key_b64"])')"

Pin the key from overlay/public_key.json only after comparing its fingerprint to a source you trust. The bundle's own key is not trusted on its own.

What this proves#

• The connector renders are produced from a real signed record, in formats a SOC ingests.
• The overlay bundle is signed and chained; a one-byte change is detectable.
• The verifier is self-contained and imports no CAIN runtime code.

What it does not prove#

• That CAIN-42 is an official partner of Splunk, Cisco, Palo Alto, Zenity or Microsoft. It is not,

unless a signed agreement says so. These are customer-side integrations; the customer supplies the endpoint and token.

• That the vendor's decision was correct, that the event is complete, or that the action was safe.
• Any certification, SOC 2, ISO 27001/42001, or EU AI Act conformity.