Skip to main content

Evidence campaigns

Collecting evidence from many clients is the same set of questions asked many times. The Evidence area lets you write the questions once as a template, send them to a set of clients as a batch, review what comes back in one inbox, and notice when several clients hand you the same file.

Templates​

An evidence request template is a reusable list of prompts: each prompt has a title, a description of what you need and why, an optional control reference, an evidence type (document, screenshot, attestation or report) and a priority. Prompts typed as log export, configuration or policy export cannot be dispatched. The template carries a code, a default priority, a default due period (14 days unless changed) and a default evidence type, and is a draft, active or archived. Only active templates can be batched. A template holds up to 100 prompts.

Administrators and compliance managers author templates. Built-in templates are locked; Clone to edit copies one into a draft you own. The page is at /msp/evidence/templates. No page in the portal links to it, so open it by that address.

Batches​

A batch is one template sent to an audience with a due date and a reminder schedule. New batch walks three steps:

  1. Pick a template: name the batch and pick an active template.
  2. Choose the audience: every client on a service package, or an explicit list of clients. Either way, a batch reaches at most 50 clients. Set an optional due date and the reminders, as offsets in days: positive before the due date, negative after, zero on the day (seven, three and zero by default; up to ten).
  3. Review and dispatch, then Create & dispatch.

Dispatch creates one real evidence request per prompt per client, inside that client's audit in Planning, and records the reminders. Two things make a client skip: the client has no audit in Planning (a client whose audit is past Planning is skipped), or you are not an administrator and have no active delegated session in that client at the moment of dispatch. There is no retry for skipped clients. Auditors cannot dispatch.

The batch list shows each batch with its template, target count, how many items were dispatched, how many are Pending (every item not yet triaged) and how many are overdue, and its status (queued, dispatching, dispatched, partially failed, cancelled). The counters above total the active batches, pending triage and overdue items. Each night, a batch still queued a week after it was created is cancelled.

Opening a batch lists one row per client per prompt, with the client shown as an ID, its dispatch state, fulfilment, triage state and, for skipped or failed items, the reason. On an outstanding item the bell records a reminder. Reminders are not shown to clients, and no email is sent. Administrators can cancel a batch that has not fully dispatched: pending items are skipped and future reminders cancelled, while requests already delivered to clients stay live on their side.

Reminders from the schedule are recorded the same way and also do not reach the client. A client's upload reaches the batch through a scheduled update, so it may not show at once.

On the client's side, a request is answered from Audits > Engagements. The client opens the audit, finds the request in its request table and clicks Manage evidence, which opens a panel titled "Evidence for" and the reference. Browse uploads a file or picks items from the client's Evidence Library, and Attach N items attaches them. An upload is sealed into the client's Evidence Library and the request is set to Submitted.

Triage​

Evidence Triage is one inbox for everything clients have uploaded against your batches. Each row shows the request, the client, batch and template, and how long the upload has waited (marked in amber after a week). Filter by client or template. Only uploads appear here. A request answered by attaching an existing Evidence Library item is set to Submitted but does not appear in Evidence Triage.

Three decisions, each with a note: Accept, Revise (ask for changes so they can resubmit) or Reject. The decision is written back to the client's own request. The note appears only in My Assignments and in the notification sent on Reject. Revise notifies nobody. Auditors can read the inbox and see the buttons, but the server refuses their decisions. The dashboard's Evidence Triage card shows the count waiting and the top three.

Patterns​

Evidence Patterns (/msp/evidence/patterns) lists cases where two or more of your clients uploaded byte-identical evidence in the last 30 days, found by a nightly comparison of content hashes. Like the templates page, it has no link in the portal. Each signal shows the number of clients, a confidence, the hash and when it was first seen. Sometimes that is fine (a shared vendor template) and sometimes it is not (a policy copied from another client); either way Acknowledge records what you found and dismisses it, and the same match will not resurface until seven days after the signal was raised.