Origin-side evidence is information collected on the server that received a request, rather than at an upstream network edge such as a CDN or web application firewall. It can include web and PHP error logs, process activity, crash records, file changes, and outbound connections.
In cyber security investigations, this evidence helps distinguish scanning or attempted exploitation from code that actually ran or affected a host. A suspicious request in edge telemetry is an early warning, not proof of compromise. Defenders can correlate its timing with server logs, unexpected worker or child processes, and unusual network activity to assess impact. Missing evidence does not by itself prove that no attack occurred, so investigators should also consider log coverage and retention.