{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "sourceId": "EVID-CLOUD",
  "sourceType": "Cloud document audit",
  "coverage": {
    "start": "2026-10-12T00:00:00Z",
    "end": "2026-10-14T16:00:00Z",
    "limitations": "Selected audit operations; no complete recipient device or content-delivery confirmation."
  },
  "events": [
    {
      "id": "EVT-005",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-12T08:12:00Z",
      "normalizedUtc": "2026-10-12T08:12:00Z",
      "ingestedUtc": "2026-10-12T08:12:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-BASE",
      "eventType": "DocumentRead",
      "observation": "Known-owner read of the operations guide.",
      "details": {
        "objectId": "OPS-GUIDE",
        "operationResult": "Success"
      }
    },
    {
      "id": "EVT-010",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-12T13:02:00Z",
      "normalizedUtc": "2026-10-12T13:02:00Z",
      "ingestedUtc": "2026-10-12T13:02:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-BASE",
      "eventType": "ListDocuments",
      "observation": "Ordinary operations-library listing.",
      "details": {
        "library": "Operations"
      }
    },
    {
      "id": "EVT-015",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-12T18:10:00Z",
      "normalizedUtc": "2026-10-12T18:10:00Z",
      "ingestedUtc": "2026-10-12T18:10:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-SVC",
        "ENT-CLOUD"
      ],
      "sessionId": null,
      "eventType": "BackupRead",
      "observation": "Separate service identity reads scheduled backup manifest.",
      "details": {
        "objectId": "BACKUP-MANIFEST",
        "operationResult": "Success"
      }
    },
    {
      "id": "EVT-032",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-13T09:17:00Z",
      "normalizedUtc": "2026-10-13T09:17:00Z",
      "ingestedUtc": "2026-10-13T09:17:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "CloudSessionAccepted",
      "observation": "C-88 uses Alex with correlation IC-77 from the unfamiliar source.",
      "details": {
        "cloudSession": "C-88",
        "identityCorrelation": "IC-77",
        "sourceIp": "203.0.113.44"
      }
    },
    {
      "id": "EVT-033",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-13T09:18:00Z",
      "normalizedUtc": "2026-10-13T09:18:00Z",
      "ingestedUtc": "2026-10-13T09:18:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "ListDocuments",
      "observation": "C-88 lists Finance reports.",
      "details": {
        "library": "Finance",
        "resultCount": 31
      }
    },
    {
      "id": "EVT-034",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-13T09:20:00Z",
      "normalizedUtc": "2026-10-13T09:20:00Z",
      "ingestedUtc": "2026-10-13T09:20:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "DocumentDownload",
      "observation": "Service records a successful download operation; receiving device not established.",
      "details": {
        "objectId": "FIN-001",
        "sizeBytes": 212992,
        "operationResult": "Success"
      }
    },
    {
      "id": "EVT-035",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-13T09:21:00Z",
      "normalizedUtc": "2026-10-13T09:21:00Z",
      "ingestedUtc": "2026-10-13T09:21:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "DocumentDownload",
      "observation": "Service records a successful download operation; receiving device not established.",
      "details": {
        "objectId": "FIN-002",
        "sizeBytes": 1048576,
        "operationResult": "Success"
      }
    },
    {
      "id": "EVT-036",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-13T09:22:00Z",
      "normalizedUtc": "2026-10-13T09:22:00Z",
      "ingestedUtc": "2026-10-13T09:22:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "DocumentDownload",
      "observation": "Service records a successful download operation; receiving device not established.",
      "details": {
        "objectId": "FIN-003",
        "sizeBytes": 3145728,
        "operationResult": "Success"
      }
    },
    {
      "id": "EVT-043",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-13T10:04:00Z",
      "normalizedUtc": "2026-10-13T10:04:00Z",
      "ingestedUtc": "2026-10-13T10:04:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "CloudRequestDenied",
      "observation": "C-88 receives a denial after grant revocation.",
      "details": {
        "cloudSession": "C-88",
        "result": "Grant revoked"
      }
    },
    {
      "id": "EVT-047",
      "sourceId": "EVID-CLOUD",
      "originalTime": "2026-10-14T10:00:00Z",
      "normalizedUtc": "2026-10-14T10:00:00Z",
      "ingestedUtc": "2026-10-14T10:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-CLOUD"
      ],
      "sessionId": "SES-CLOUD",
      "eventType": "AuditExportCompleted",
      "observation": "Selected C-88 audit export completes; query excludes recipient-device telemetry.",
      "details": {
        "windowStart": "2026-10-13T09:00:00Z",
        "windowEnd": "2026-10-13T10:15:00Z"
      }
    }
  ]
}