{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "sourceId": "EVID-ENDPOINT",
  "sourceType": "Endpoint sensor",
  "coverage": {
    "start": "2026-10-12T00:00:00Z",
    "end": "2026-10-14T16:00:00Z",
    "limitations": "Selected process/file/task observations on APP-01; memory and WS-014 absent."
  },
  "events": [
    {
      "id": "EVT-004",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-12T08:08:00Z",
      "normalizedUtc": "2026-10-12T08:08:00Z",
      "ingestedUtc": "2026-10-12T08:08:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-BASE",
      "eventType": "ProcessStart",
      "observation": "Approved report-health diagnostic run.",
      "details": {
        "processId": "P-114",
        "parent": "explorer.exe",
        "image": "report-health.exe"
      }
    },
    {
      "id": "EVT-011",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-12T18:00:00Z",
      "normalizedUtc": "2026-10-12T18:00:00Z",
      "ingestedUtc": "2026-10-12T18:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-OPS",
        "ENT-APP"
      ],
      "sessionId": "SES-OPS",
      "eventType": "ScheduledTaskCreated",
      "observation": "PatchWindow task created by approved operator.",
      "details": {
        "task": "PatchWindow",
        "changeId": "CHG-SIM-104"
      }
    },
    {
      "id": "EVT-013",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-12T18:05:00Z",
      "normalizedUtc": "2026-10-12T18:05:00Z",
      "ingestedUtc": "2026-10-12T18:05:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-OPS",
        "ENT-APP"
      ],
      "sessionId": "SES-OPS",
      "eventType": "TaskExecution",
      "observation": "Approved patch task executes signed maintenance image.",
      "details": {
        "task": "PatchWindow",
        "image": "maintenance-agent.exe"
      }
    },
    {
      "id": "EVT-022",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-13T09:08:00Z",
      "normalizedUtc": "2026-10-13T09:08:00Z",
      "ingestedUtc": "2026-10-13T09:08:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "ProcessStart",
      "observation": "Identity-check utility executes in L-712.",
      "details": {
        "image": "whoami.exe",
        "parent": "cmd.exe",
        "logonId": "L-712",
        "processId": "P-712"
      }
    },
    {
      "id": "EVT-023",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-13T09:09:00Z",
      "normalizedUtc": "2026-10-13T09:09:00Z",
      "ingestedUtc": "2026-10-13T09:09:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "ScriptExecution",
      "observation": "PowerShell executes ReportCache.ps1 in L-712; content not supplied.",
      "details": {
        "image": "powershell.exe",
        "script": "ReportCache.ps1",
        "processId": "P-713",
        "logonId": "L-712"
      }
    },
    {
      "id": "EVT-025",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-13T09:11:00Z",
      "normalizedUtc": "2026-10-13T09:11:00Z",
      "ingestedUtc": "2026-10-13T09:11:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "TaskExecution",
      "observation": "ReportCache task invokes script in Alex context.",
      "details": {
        "task": "ReportCache",
        "script": "ReportCache.ps1"
      }
    },
    {
      "id": "EVT-027",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-13T09:13:00Z",
      "normalizedUtc": "2026-10-13T09:13:00Z",
      "ingestedUtc": "2026-10-13T09:13:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "ArchiveUtility",
      "observation": "Archive utility runs over local finance exports.",
      "details": {
        "image": "archive-utility.exe",
        "input": "D:/Reports/Finance",
        "output": "C:/Users/alex/AppData/Local/Temp/reports.zip"
      }
    },
    {
      "id": "EVT-028",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-13T09:14:00Z",
      "normalizedUtc": "2026-10-13T09:14:00Z",
      "ingestedUtc": "2026-10-13T09:14:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "ArchiveCreated",
      "observation": "reports.zip is created locally; presence does not prove external transfer.",
      "details": {
        "path": "C:/Users/alex/AppData/Local/Temp/reports.zip",
        "sizeBytes": 4401392
      }
    },
    {
      "id": "EVT-044",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-13T11:00:00Z",
      "normalizedUtc": "2026-10-13T11:00:00Z",
      "ingestedUtc": "2026-10-13T11:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-APP"
      ],
      "sessionId": null,
      "eventType": "ContainmentRecorded",
      "observation": "APP-01 isolated, ReportCache task disabled and script quarantined; later recovery remains open.",
      "details": {
        "taskState": "Disabled",
        "sensorIsolation": "Enabled",
        "scope": "One sensor observation, not a full persistence sweep"
      }
    },
    {
      "id": "EVT-046",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-14T09:00:00Z",
      "normalizedUtc": "2026-10-14T09:00:00Z",
      "ingestedUtc": "2026-10-14T09:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-APP"
      ],
      "sessionId": null,
      "eventType": "BoundedReview",
      "observation": "No additional ReportCache execution in selected sensor window after isolation.",
      "details": {
        "windowStart": "2026-10-13T11:00:00Z",
        "windowEnd": "2026-10-14T09:00:00Z",
        "limitation": "Selected APP-01 sensor data only"
      }
    },
    {
      "id": "EVT-048",
      "sourceId": "EVID-ENDPOINT",
      "originalTime": "2026-10-14T12:00:00Z",
      "normalizedUtc": "2026-10-14T12:00:00Z",
      "ingestedUtc": "2026-10-14T12:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-APP"
      ],
      "sessionId": null,
      "eventType": "ServiceHealthReview",
      "observation": "Business service responds in isolated recovery environment; security closure not established.",
      "details": {
        "health": "Responding",
        "recoveryState": "Validation pending"
      }
    }
  ]
}