{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "sourceId": "EVID-WINDOWS",
  "sourceType": "Windows audit",
  "coverage": {
    "start": "2026-10-12T00:00:00Z",
    "end": "2026-10-14T16:00:00Z",
    "limitations": "Selected normalized records. APP-01 clock was 120 seconds fast from 09:09 to 09:16 UTC Oct 13."
  },
  "events": [
    {
      "id": "EVT-003",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-12T08:05:00Z",
      "normalizedUtc": "2026-10-12T08:05:00Z",
      "ingestedUtc": "2026-10-12T08:05:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-BASE",
      "eventType": "RemoteInteractiveLogon",
      "observation": "Baseline RDP to APP-01 from assigned VPN IP.",
      "details": {
        "logonId": "L-114",
        "sourceIp": "10.20.0.14"
      }
    },
    {
      "id": "EVT-007",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-12T09:05:00Z",
      "normalizedUtc": "2026-10-12T09:05:00Z",
      "ingestedUtc": "2026-10-12T09:05:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-BASE",
      "eventType": "Logoff",
      "observation": "Known owner L-114 logoff.",
      "details": {
        "logonId": "L-114"
      }
    },
    {
      "id": "EVT-012",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-12T18:00:05Z",
      "normalizedUtc": "2026-10-12T18:00:05Z",
      "ingestedUtc": "2026-10-12T18:00:35Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-OPS",
        "ENT-APP"
      ],
      "sessionId": "SES-OPS",
      "eventType": "TaskRegistration",
      "observation": "PatchWindow registration matches separate ops account.",
      "details": {
        "task": "PatchWindow"
      }
    },
    {
      "id": "EVT-021",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-13T09:07:05Z",
      "normalizedUtc": "2026-10-13T09:07:05Z",
      "ingestedUtc": "2026-10-13T09:07:35Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "RemoteInteractiveLogon",
      "observation": "APP-01 logon L-712 accepts Alex from assigned IP.",
      "details": {
        "logonId": "L-712",
        "sourceIp": "10.20.0.77"
      }
    },
    {
      "id": "EVT-024",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-13T05:12:00-04:00",
      "normalizedUtc": "2026-10-13T09:10:00Z",
      "ingestedUtc": "2026-10-13T09:10:30Z",
      "clockCorrectionSeconds": -120,
      "correctionBasis": "CTX-003: time-service review; source clock +120 seconds.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "TaskRegistration",
      "observation": "ReportCache task registered under Alex; no matching approved change.",
      "details": {
        "task": "ReportCache",
        "action": "ReportCache.ps1",
        "trigger": "User logon"
      }
    },
    {
      "id": "EVT-026",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-13T05:14:00-04:00",
      "normalizedUtc": "2026-10-13T09:12:00Z",
      "ingestedUtc": "2026-10-13T09:12:30Z",
      "clockCorrectionSeconds": -120,
      "correctionBasis": "CTX-003: time-service review; source clock +120 seconds.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "ReportFileAccess",
      "observation": "Selected report-file access under L-712; 31 distinct local paths in this record.",
      "details": {
        "directory": "D:/Reports/Finance",
        "distinctPaths": 31
      }
    },
    {
      "id": "EVT-031",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-13T09:16:00Z",
      "normalizedUtc": "2026-10-13T09:16:00Z",
      "ingestedUtc": "2026-10-13T09:16:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-APP"
      ],
      "sessionId": null,
      "eventType": "ClockSynchronized",
      "observation": "Time-service record reports correction from +120 seconds to reference time.",
      "details": {
        "previousOffsetSeconds": 120,
        "newOffsetSeconds": 0
      }
    },
    {
      "id": "EVT-039",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-13T09:29:00Z",
      "normalizedUtc": "2026-10-13T09:29:00Z",
      "ingestedUtc": "2026-10-13T09:29:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "Logoff",
      "observation": "L-712 logs off APP-01.",
      "details": {
        "logonId": "L-712"
      }
    },
    {
      "id": "EVT-045",
      "sourceId": "EVID-WINDOWS",
      "originalTime": "2026-10-13T11:05:00Z",
      "normalizedUtc": "2026-10-13T11:05:00Z",
      "ingestedUtc": "2026-10-13T11:05:30Z",
      "clockCorrectionSeconds": 0,
      "correctionBasis": "No correction applied; retain source offset.",
      "entityIds": [
        "ENT-ALEX",
        "ENT-APP"
      ],
      "sessionId": "SES-UNKNOWN",
      "eventType": "RemoteLogonDenied",
      "observation": "Alex RDP attempt denied; no claim about every alternate access path.",
      "details": {
        "result": "Account restriction"
      }
    }
  ]
}