{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "sourceId": "EVID-VPN",
  "sourceType": "VPN gateway",
  "coverage": {
    "start": "2026-10-12T00:00:00Z",
    "end": "2026-10-14T16:00:00Z",
    "limitations": "Session assignment and aggregate counters; counters do not identify files."
  },
  "events": [
    {
      "id": "EVT-002",
      "sourceId": "EVID-VPN",
      "originalTime": "2026-10-12T08:03:00Z",
      "normalizedUtc": "2026-10-12T08:03:00Z",
      "ingestedUtc": "2026-10-12T08:03:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-BASE",
      "eventType": "TunnelEstablished",
      "observation": "Known owner VPN assigned 10.20.0.14.",
      "details": {
        "vpnSession": "V-14",
        "sourceIp": "198.51.100.20",
        "assignedIp": "10.20.0.14"
      }
    },
    {
      "id": "EVT-008",
      "sourceId": "EVID-VPN",
      "originalTime": "2026-10-12T09:07:00Z",
      "normalizedUtc": "2026-10-12T09:07:00Z",
      "ingestedUtc": "2026-10-12T09:07:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-BASE",
      "eventType": "TunnelEnded",
      "observation": "Baseline V-14 tunnel ended.",
      "details": {
        "vpnSession": "V-14"
      }
    },
    {
      "id": "EVT-019",
      "sourceId": "EVID-VPN",
      "originalTime": "2026-10-13T09:05:00Z",
      "normalizedUtc": "2026-10-13T09:05:00Z",
      "ingestedUtc": "2026-10-13T09:05:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "TunnelEstablished",
      "observation": "V-77 binds ASSERT-77 to assigned 10.20.0.77.",
      "details": {
        "vpnSession": "V-77",
        "assertionId": "ASSERT-77",
        "sourceIp": "203.0.113.44",
        "assignedIp": "10.20.0.77"
      }
    },
    {
      "id": "EVT-038",
      "sourceId": "EVID-VPN",
      "originalTime": "2026-10-13T09:26:00Z",
      "normalizedUtc": "2026-10-13T09:26:00Z",
      "ingestedUtc": "2026-10-13T09:26:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "SessionCounters",
      "observation": "V-77 aggregate counters include all tunnel protocols.",
      "details": {
        "vpnSession": "V-77",
        "bytesOut": 6291456,
        "bytesIn": 18874368
      }
    },
    {
      "id": "EVT-040",
      "sourceId": "EVID-VPN",
      "originalTime": "2026-10-13T09:30:00Z",
      "normalizedUtc": "2026-10-13T09:30:00Z",
      "ingestedUtc": "2026-10-13T09:30:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "TunnelEnded",
      "observation": "V-77 tunnel ended; this alone does not revoke cloud sessions.",
      "details": {
        "vpnSession": "V-77"
      }
    }
  ]
}