One threat as recorded on an AuditRecord — never the raw snippet unless includeEvidence was set.
includeEvidence
Optional
The raw evidence snippet — present only when the scan call passed includeEvidence: true.
includeEvidence: true
sha256 of the threat's evidence snippet, e.g. "sha256:ab12...".
"sha256:ab12..."
One threat as recorded on an AuditRecord — never the raw snippet unless
includeEvidencewas set.