This reference names the evidence and provenance Fendix actually exposes. Internal observation fields are not automatically public report fields, and imported evidence keeps its external producer identity.
Semantic layers
| Layer | Meaning | Representative fields |
|---|---|---|
| Observation / evidence | What an analyzer observed and where. | evidence · endpoint · line · references |
| Correlated finding | An interpreted security condition with normalized identity and combined signals. | rule_id · fingerprint · corroborating_tools |
| Finding disposition | Policy outcome for one finding. | status · decision_reason |
| Coverage | Whether required evidence sources delivered. | scanner_status · coverage |
| Release decision | Separate release-level verdict combining findings and coverage. | release_decision · coverage_state |
Native and imported provenance
Native findings identify their Fendix source family and, where available, source_tier, rule_id, route, taint chain, and analyzer coverage. Imported SARIF findings use source: imported; the normalized external ToolID, source rule identity, source partial fingerprints, and normalized Weakness/CWE are preserved in structured normalization and report references.
Cross-tool corroboration
cross_tool_corroborated means an independent external tool reported the same normalized CWE at the same normalized location as a native finding. corroborating_tools carries the proof identities. This signal may affect confidence and policy.
It does not by itself prove exploitability, reachability, production impact, or successful exploitation. Imported codeFlows never become a native proven path in the stable importer.
Related reference
Evidence and correlation concept · SARIF import · Finding fields