Context
In modern cloud incident response there is often nothing to detect in the old sense. Attackers increasingly log in rather than break in: a large share of recent detections are malware-free, with valid-account abuse behind a significant fraction of cloud incidents. Detection tells you that something happened, but rarely how: which account was really patient zero, which token was replayed, which consent grant opened the door, and in what order.
Responders reconstruct that story by hand from fragmented audit logs, under time pressure, and they fail in a specific, predictable way: they anchor. They find the first narrative that fits the evidence and stop looking, leaving the quieter real path unexamined one branch away.
Nimbus Vestige (NV) is an open-source tool built to attack that failure mode. It performs abductive reconstruction: given normalized identity telemetry (sign-ins, consent grants, service-principal and role changes, mailbox access), it works backward to the most likely path an intrusion took across accounts and services.
Problem
A reconstruction tool that emits a single confident story recreates the anchoring failure it is meant to prevent, and it is easy for such a tool to emit a confident number that means nothing. The hard part is producing output that resists tunnel vision and reports uncertainty honestly.
Decision
NV never hands the responder a single story. It hands back the ranked space of plausible paths, ordered by how well the evidence supports each, so the alternatives are always held up next to the leading one. Paths that rank lower but remain plausible are a second deliverable: a hardening backlog of the other doors that were standing open.
Confidence is made explicit and honest:
Every reconstructed step carries a confidence in the range [0, 1], built from a per-technique base rate, plus a bonus for each independent corroborating signal (source IP, device, successful outcome, temporal adjacency, broad-consent flags), minus a penalty for signals that should be present and are not.
Path scores compose their links by geometric mean, not average, so one weak link honestly drags the whole path down instead of being smoothed over by strong neighbors.
A trust floor governs disclosure. Below it, a step is not shown as a guess: it is withheld and marked explicitly unsupported. The floor is an adjustable slider, trading strict high-trust reconstruction against permissive high-coverage reconstruction, and it lives in the engine's output contract rather than being bolted onto the UI.
The scoring weights are treated as a calibration question. They begin as defensible priors and are refitted by a harness rather than asserted as final truth.
The engine is not cloud-specific: it reconstructs across O365 and CloudTrail using the same steps against each provider's logs.
Alternatives Considered
Emit a single best-path narrative
Rejected. This is the anchoring failure mechanized. The responder tunnels on the one story the tool endorses.
Treat this as detection (a binary happened or did not)
Rejected. Detection answers the wrong question. The task is reconstructing how, not asserting that.
Average link confidences along a path
Rejected. Averaging lets strong links mask a weak one, producing paths that look better supported than they are. The geometric mean refuses that.
Show low-confidence steps as ordinary guesses
Rejected. Presenting an unsupported step as a normal guess is the dishonesty this design exists to avoid. Below the trust floor, a step is withheld and labeled.
Consequences
Positive
The responder sees the alternatives, which counters anchoring directly.
Confidence numbers are built from evidence and mean something.
The geometric mean prevents one strong signal from hiding a weak link.
Unsupported steps are withheld honestly rather than dressed up.
Lower-ranked plausible paths double as a hardening backlog.
One engine covers more than one cloud.
Trade-offs
A ranked space of paths is more to interpret than a single answer.
Calibration of base rates and bonuses is ongoing work, not a one-time setting.
The honesty-versus-coverage tradeoff is handed to the operator via the trust floor rather than hidden.
Evidence & Related Work
Implementation Evidence
Repository:
Live demo:
Related article:
External Recognition
Featured in This Week in 4n6, Week 30 2026 (Phill Moore's DFIR weekly roundup):
Relationship to the Broader Engineering Approach
The recurring principle across these ADRs is refusing to let an unexamined state pass a boundary. Here the boundary is epistemic: a step whose evidence falls below the trust floor is not allowed to enter the reconstruction as if it were known. Honesty about what is not known is treated as a first-class output.
Decision Outcome
Reconstruction output is a ranked, confidence-annotated space with an explicit disclosure floor:
Telemetry → ranked plausible paths + per-step confidence + trust floor
rather than:
Telemetry → one confident story
This ADR should be revisited if calibration shows the scoring model cannot produce trustworthy confidences for a given telemetry source, in which case that source's steps should stay below the trust floor by default.