{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "sourceId": "EVID-IDENTITY",
  "sourceType": "Identity provider",
  "coverage": {
    "start": "2026-10-12T00:00:00Z",
    "end": "2026-10-14T16:00:00Z",
    "limitations": "Full selected sign-in/admin events; authentication acquisition history absent."
  },
  "events": [
    {
      "id": "EVT-001",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-12T08:00:00Z",
      "normalizedUtc": "2026-10-12T08:00:00Z",
      "ingestedUtc": "2026-10-12T08:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-BASE",
      "eventType": "SignInSuccess",
      "observation": "Known owner sign-in from usual documentation IP.",
      "details": {
        "sourceIp": "198.51.100.20",
        "correlationId": "IC-BASE",
        "authClaim": "MFA reported satisfied"
      }
    },
    {
      "id": "EVT-009",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-12T13:00:00Z",
      "normalizedUtc": "2026-10-12T13:00:00Z",
      "ingestedUtc": "2026-10-12T13:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-BASE",
      "eventType": "SessionRefresh",
      "observation": "Routine owner refresh; no inference of all-day device possession.",
      "details": {}
    },
    {
      "id": "EVT-016",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-13T09:01:00Z",
      "normalizedUtc": "2026-10-13T09:01:00Z",
      "ingestedUtc": "2026-10-13T09:01:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": null,
      "eventType": "SignInFailure",
      "observation": "Alex account rejected from unfamiliar documentation IP.",
      "details": {
        "sourceIp": "203.0.113.44",
        "result": "Invalid credential",
        "correlationId": "IC-76"
      }
    },
    {
      "id": "EVT-017",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-13T09:03:00Z",
      "normalizedUtc": "2026-10-13T09:03:00Z",
      "ingestedUtc": "2026-10-13T09:03:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "SignInSuccess",
      "observation": "Alex sign-in accepted from unfamiliar source; owner later denies it.",
      "details": {
        "sourceIp": "203.0.113.44",
        "correlationId": "IC-77",
        "authClaim": "Provider reports MFA satisfied; acquisition/authentication chain unavailable"
      }
    },
    {
      "id": "EVT-018",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-13T09:04:00Z",
      "normalizedUtc": "2026-10-13T09:04:00Z",
      "ingestedUtc": "2026-10-13T09:04:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "ApplicationAssertion",
      "observation": "VPN assertion issued for IC-77.",
      "details": {
        "correlationId": "IC-77",
        "application": "Example VPN",
        "assertionId": "ASSERT-77"
      }
    },
    {
      "id": "EVT-037",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-13T09:25:00Z",
      "normalizedUtc": "2026-10-13T09:25:00Z",
      "ingestedUtc": "2026-10-13T09:25:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "RiskAlert",
      "observation": "Unfamiliar-context alert reaches analysts; alert itself is not attribution.",
      "details": {
        "correlationId": "IC-77",
        "alert": "SIM-ALERT-77"
      }
    },
    {
      "id": "EVT-041",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-13T10:00:00Z",
      "normalizedUtc": "2026-10-13T10:00:00Z",
      "ingestedUtc": "2026-10-13T10:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": null,
      "eventType": "AccountRestricted",
      "observation": "Simulated IAM responder disables Alex and revokes active session grants.",
      "details": {
        "actor": "Simulated IAM lead",
        "approvedBy": "CTX-004"
      }
    },
    {
      "id": "EVT-042",
      "sourceId": "EVID-IDENTITY",
      "originalTime": "2026-10-13T10:03:00Z",
      "normalizedUtc": "2026-10-13T10:03:00Z",
      "ingestedUtc": "2026-10-13T10:03:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "SessionRefreshDenied",
      "observation": "A later IC-77 refresh is denied after restriction.",
      "details": {
        "correlationId": "IC-77",
        "result": "Account disabled"
      }
    }
  ]
}