{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "sourceId": "EVID-NETWORK",
  "sourceType": "DNS and network sensor",
  "coverage": {
    "start": "2026-10-12T00:00:00Z",
    "end": "2026-10-14T16:00:00Z",
    "limitations": "Selected flows only. Egress detail missing Oct 13 09:30–10:15 UTC; no decrypted content."
  },
  "events": [
    {
      "id": "EVT-006",
      "sourceId": "EVID-NETWORK",
      "originalTime": "2026-10-12T09:00:00Z",
      "normalizedUtc": "2026-10-12T09:00:00Z",
      "ingestedUtc": "2026-10-12T09:00:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-SVC"
      ],
      "sessionId": null,
      "eventType": "ScheduledHttpsFlow",
      "observation": "Routine backup-network flow; separate service context.",
      "details": {
        "destination": "backup.example.test",
        "bytesOut": 122880
      }
    },
    {
      "id": "EVT-014",
      "sourceId": "EVID-NETWORK",
      "originalTime": "2026-10-12T18:08:00Z",
      "normalizedUtc": "2026-10-12T18:08:00Z",
      "ingestedUtc": "2026-10-12T18:08:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-OPS",
        "ENT-APP"
      ],
      "sessionId": "SES-OPS",
      "eventType": "ScheduledHttpsFlow",
      "observation": "Patch repository download matches approved window.",
      "details": {
        "destination": "updates.example.test"
      }
    },
    {
      "id": "EVT-020",
      "sourceId": "EVID-NETWORK",
      "originalTime": "2026-10-13T09:07:00Z",
      "normalizedUtc": "2026-10-13T09:07:00Z",
      "ingestedUtc": "2026-10-13T09:07:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "RdpFlow",
      "observation": "10.20.0.77 connects to APP-01 RDP service.",
      "details": {
        "sourceIp": "10.20.0.77",
        "destinationIp": "10.30.0.50",
        "destinationPort": 3389
      }
    },
    {
      "id": "EVT-029",
      "sourceId": "EVID-NETWORK",
      "originalTime": "2026-10-13T09:14:30Z",
      "normalizedUtc": "2026-10-13T09:14:30Z",
      "ingestedUtc": "2026-10-13T09:15:00Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-APP"
      ],
      "sessionId": null,
      "eventType": "DnsResponse",
      "observation": "APP-01 resolves sync.example.test to documentation IP.",
      "details": {
        "query": "sync.example.test",
        "answer": "192.0.2.88"
      }
    },
    {
      "id": "EVT-030",
      "sourceId": "EVID-NETWORK",
      "originalTime": "2026-10-13T09:15:00Z",
      "normalizedUtc": "2026-10-13T09:15:00Z",
      "ingestedUtc": "2026-10-13T09:15:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-APP"
      ],
      "sessionId": null,
      "eventType": "HttpsFlow",
      "observation": "APP-01 has short TLS flow; content and process attribution absent.",
      "details": {
        "destinationIp": "192.0.2.88",
        "destinationPort": 443,
        "bytesOut": 86000,
        "durationSeconds": 40
      }
    }
  ]
}