Chain of custody
Chain of custody is the record of who handled a piece of evidence and when, so it can be shown to be unaltered. In incident response it matters when evidence may be used in a legal or regulatory process. Few response platforms say how they preserve it.
Definition
Automated actions can alter evidence: isolation, file quarantine and live response commands all change a host. A platform should record the state before and after.
Hashes, timestamps and immutable storage are the usual means. Ask whether the platform provides them or leaves it to your forensic tooling.
Chain of custody in Cyware's documentation
Cyware's Orchestrate page says complete audit trails cover playbook changes, and it does not say whether evidence artifacts are hashed or custody is recorded. vendor claim cyware.com, read
The example names a vendor and its own page. A vendor's use of Chain of custody may differ from the definition above; the rubric uses the definition on this page.