Evidence Bags

Evidence Bags are per-session containers that group the proof behind your findings — uploaded files (screenshots, output, exports), executed commands, and written notes — into a single, organized package. They give you a tidy place to collect everything that supports a vulnerability so it is ready to reference in a finding, an attack narrative, or a report.

Overview

Each evidence bag belongs to one session and holds three kinds of items:

  • Files — screenshots, tool output, exfiltrated data, or any uploaded artifact
  • Commands — commands already logged to the session, attached as reproduction steps
  • Notes — free-form text (with an optional title) describing what the evidence shows

A session can have as many evidence bags as you need — for example, one bag per finding or one per attack phase.

Viewing Evidence Bags

  1. Open a session and go to Evidence Bags.
  2. The index lists every bag in the session with its name, description, and item counts.
  3. Click a bag to open its Details page, where all files, commands, and notes are shown together.

Creating and Editing a Bag

  1. From the Evidence Bags list, click Create.
  2. Give the bag a name and an optional description, then save.
  3. Use Edit at any time to rename a bag or update its description.
  4. Delete removes a bag (its referenced files remain in the session's Uploaded Files).

Adding Evidence

From a bag's Details page you can:

  • Upload a file — the file is stored in the session's Uploaded Files and attached to the bag in one step.
  • Add from session files — attach a file that was already uploaded to the session.
  • Add a command — attach a command that has already been logged to the session.
  • Add a note — write a titled note describing the evidence; edit or remove it later.
  • Remove — detach any file, command, or note from the bag without deleting the underlying record.

Using Evidence in Deliverables

Because evidence bags reference the session's real files and commands, the material you collect here flows naturally into the rest of the engagement:

  • Reference a bag's contents when writing a Finding.
  • Pull commands and files into the Narrative Builder to tell the attack story.
  • Keep supporting proof organized for the final report.