SIS CLI

Explain & Trace Guide

The explain family answers why a decision or observation exists and what the analysis did not establish. These commands leave the input unchanged but usually perform a new analysis. They are not a replay of a saved scan.

sis explain verdict

sis explain verdict sample.html --json

Shows verdict provenance, triggers/floors, chain/intent contribution and decision trace. For a trace attached to a particular scan, request sis scan sample.html --decision-trace --format json and retain that report.

sis explain finding

sis query findings sample.html --format json | jq -r '.result[].id'
sis explain finding sample.html <finding-id> --config config.toml

IDs are sis-<64 hex>; copy the full ID. The command expands evidence, metadata, object references and lineage, and reports candidates/fingerprint details if it cannot resolve the ID. Its deep posture and configuration can differ from the original scan. Matching a configuration is useful but not a promise that every surface reproduces identical conditions.

sis explain claim

sis explain claim sample.html js:runtime_network_request_attempt --trace

Shows whether the predicate was evaluated, whether authority was granted and the reason, including cases where no finding exists. --path disambiguates a claim kind with several authority paths. --config can supply the same configuration as a paired investigation. This surface requests a runtime posture, so instrumented script execution may occur; read the actual policy and resolved posture.

sis explain integrity

sis explain integrity sample.html --json

Projects recorded integrity bindings and reasons such as not evaluable, rejected or unresolved. --asset scopes to an asset ID. A parsed claim from document metadata is not a verified signer identity or online trust-chain verdict.

sis explain detection

sis explain detection sample.html --json

Shows format/routing decisions and handlers/detectors that ran or were skipped, including scope and budget reasons. It recomputes rather than consulting saved scan output.

sis explain members

sis explain members sample.html --json
sis explain members sample.html --trace

The default projects the asset tree, formats, sizes and coverage gaps. --trace projects recorded member-carry decisions; --part word/media/image1.png narrows a traced package part. --json and --trace are alternative outputs. A missing or withheld member is not a benign member.

sis explain graph

sis explain graph sample.html --json
sis explain graph sample.html --dynamic-analysis-policy sandboxed --json

Diagnostic output; its shape may change between releases. (--help does not mark explain graph as preview, but treat it as one.) Projects the persisted capability/effect graph and evidence/mapping basis, not a graph reconstructed from final findings. Mapping is bounded and diagnostic, not the authoritative malware verdict or a complete Content Trust policy decision. Empty atoms must be read alongside mapping and evidence-lane coverage.

For current JavaScript runtime atoms, established reachability requires the sandbox lane to execute and witness the behaviour. Merely requesting sandboxed does not establish it. The default structural policy does not permit that runtime evidence.

Known limitation: standalone JavaScript with sandboxed policy can fail with an internal error rather than produce a report. Retain that failure. Retrying without sandboxed execution can recover structural evidence, but does not establish runtime behaviour or equivalence to a differently wrapped file.

sis explain format

sis explain format pdf --json
sis explain format lnk --json

This static surface runs no scan. It lists format-specific and universal detector declarations, ratings and scoring wiring. A declared possible finding is not evidence that it fired on this input, and rating does not imply it contributes to the verdict.

Read the analysis posture

Scanning explanation surfaces disclose their resolved analysis posture. Compare it within the same build, together with input identity and policy; it is not a cross-version replay guarantee.

The default posture is structural for verdict, finding, integrity, detection, members and graph; claim requests runtime. Graph accepts an explicit dynamic policy. Configuration reaches finding, claim and members-with-trace, and can affect execution policy. Finding and traced members can load an ambient default configuration; other surfaces need not use it. Read the emitted policy line rather than assuming a family-wide default. A detector selected by routing may still have its runtime execution withheld.

Related guides

• sis docs investigate — choosing a finding and preserving the originating report
• sis docs verdict — confidence, authority, coverage and omissions
• sis docs scan-config — configuration and providers