---
title: "Knowledge system"
description: "How DrowAI preserves evidence, assets, findings, and relationships after task activity."
section: "Knowledge"
updated: 2026-06-18
tags: ["knowledge","evidence","findings"]
source: "/user-guide/knowledge-system"
---

# Knowledge system

How DrowAI preserves evidence, assets, findings, and relationships after task activity.

The Knowledge workspace is DrowAI's durable review surface for observed
security work. It helps the operator move from task-level activity to reusable
context: findings, assets, evidence, and relationships.

## Briefing

Briefing summarizes the current knowledge state. It keeps the operator
oriented before moving into detailed Findings, Assets, Evidence, or Territory
views.

## Findings

Findings organize security-relevant observations. They may include severity,
status, confidence, affected assets, and linked evidence. Candidate or
low-confidence findings should be reviewed deliberately before being included
in report output.

## Assets

Assets represent observed hosts, DNS names, services, web surfaces, or other
entities that matter to the assessment. Asset views help operators understand
what has been seen, whether it appears vulnerable or exploited, which services
are linked, and which findings reference it.

## Evidence

Evidence preserves source material that supports later review. It gives the
operator a way to trace a finding, asset, or report statement back to task
activity and source output.

## Territory

Territory presents relationship context for a selected engagement. It can help
operators understand how observed assets, services, web surfaces, and
relationships fit together.

## Review habit

Treat the knowledge system as a structured review workspace. It preserves and
organizes context, but the operator still decides what is accurate, relevant,
in scope, and ready for reporting.