docs+portal: add pilot v1 demo pack
This commit is contained in:
igor04091968
@@ -0,0 +1,25 @@
|
||||
# Pilot v1 Demo Fixtures
|
||||
|
||||
Этот каталог содержит воспроизводимые обезличенные материалы для демонстрации
|
||||
AWatch-rus Pilot v1.
|
||||
|
||||
Состав:
|
||||
|
||||
- `demo-seed-data.json` - демонстрационный набор сигналов Workforce, Security,
|
||||
Forensics, UEBA и pfSense readiness;
|
||||
- `evidence-pack/executive-summary.md` - краткий управленческий вывод;
|
||||
- `evidence-pack/security-technical-summary.md` - техническая сводка для ИБ;
|
||||
- `evidence-pack/investigation-report.md` - Markdown-отчет расследования;
|
||||
- `evidence-pack/investigation-contract.json` - пример JSON-контракта
|
||||
investigation/evidence package.
|
||||
|
||||
Границы:
|
||||
|
||||
- это не live ingestion;
|
||||
- это не production data;
|
||||
- это не новый collector;
|
||||
- pfSense остается `contract_only/readiness`;
|
||||
- UEBA Score v1 остается rule-based без ML/LLM.
|
||||
|
||||
В demo fixtures запрещены реальные IP-адреса, hostname, логины, ФИО,
|
||||
подразделения заказчика и реальные события безопасности.
|
||||
@@ -0,0 +1,223 @@
|
||||
{
|
||||
"dataset": "awatch-rus-pilot-v1-demo",
|
||||
"generated_at_utc": "2026-06-06T09:00:00Z",
|
||||
"demo_only": true,
|
||||
"privacy": {
|
||||
"real_personal_data": false,
|
||||
"real_customer_hosts": false,
|
||||
"real_customer_networks": false,
|
||||
"allowed_network_examples": [
|
||||
"192.0.2.0/24",
|
||||
"198.51.100.0/24",
|
||||
"203.0.113.0/24"
|
||||
]
|
||||
},
|
||||
"departments": [
|
||||
{
|
||||
"department_id": "dept-sales-demo",
|
||||
"name": "Отдел продаж",
|
||||
"activity_index": 82,
|
||||
"load_state": "normal",
|
||||
"risk": "low"
|
||||
},
|
||||
{
|
||||
"department_id": "dept-accounting-demo",
|
||||
"name": "Бухгалтерия",
|
||||
"activity_index": 68,
|
||||
"load_state": "normal",
|
||||
"risk": "medium"
|
||||
},
|
||||
{
|
||||
"department_id": "dept-warehouse-demo",
|
||||
"name": "Склад",
|
||||
"activity_index": 41,
|
||||
"load_state": "low_activity",
|
||||
"risk": "high"
|
||||
},
|
||||
{
|
||||
"department_id": "dept-support-demo",
|
||||
"name": "Поддержка",
|
||||
"activity_index": 91,
|
||||
"load_state": "overload",
|
||||
"risk": "medium"
|
||||
},
|
||||
{
|
||||
"department_id": "dept-it-demo",
|
||||
"name": "ИТ",
|
||||
"activity_index": 74,
|
||||
"load_state": "normal",
|
||||
"risk": "critical"
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
{
|
||||
"user_ref": "demo-user-001",
|
||||
"department_id": "dept-sales-demo",
|
||||
"host": "HOST-DEMO-01",
|
||||
"responsible": "manager-demo-sales"
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-002",
|
||||
"department_id": "dept-accounting-demo",
|
||||
"host": "HOST-DEMO-02",
|
||||
"responsible": "manager-demo-accounting"
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-003",
|
||||
"department_id": "dept-warehouse-demo",
|
||||
"host": "HOST-DEMO-03",
|
||||
"responsible": "manager-demo-warehouse"
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-004",
|
||||
"department_id": "dept-support-demo",
|
||||
"host": "HOST-DEMO-04",
|
||||
"responsible": "manager-demo-support"
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-005",
|
||||
"department_id": "dept-it-demo",
|
||||
"host": "HOST-DEMO-05",
|
||||
"responsible": "manager-demo-it"
|
||||
}
|
||||
],
|
||||
"activity_events": [
|
||||
{
|
||||
"timestamp": "2026-06-06T08:55:00Z",
|
||||
"user_ref": "demo-user-001",
|
||||
"host": "HOST-DEMO-01",
|
||||
"app": "crm-demo.exe",
|
||||
"kind": "normal_activity",
|
||||
"duration_minutes": 42
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-06-06T09:10:00Z",
|
||||
"user_ref": "demo-user-002",
|
||||
"host": "HOST-DEMO-02",
|
||||
"app": "1cv8.exe",
|
||||
"kind": "business_app_activity",
|
||||
"duration_minutes": 67
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-06-06T10:25:00Z",
|
||||
"user_ref": "demo-user-003",
|
||||
"host": "HOST-DEMO-03",
|
||||
"app": "rdp-session",
|
||||
"kind": "low_activity",
|
||||
"duration_minutes": 8
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-06-06T21:40:00Z",
|
||||
"user_ref": "demo-user-005",
|
||||
"host": "HOST-DEMO-05",
|
||||
"app": "admin-tool-demo.exe",
|
||||
"kind": "night_access_anomaly",
|
||||
"duration_minutes": 24
|
||||
}
|
||||
],
|
||||
"security_events": [
|
||||
{
|
||||
"event_id": "sec-demo-001",
|
||||
"timestamp": "2026-06-06T11:05:00Z",
|
||||
"severity": "low",
|
||||
"user_ref": "demo-user-001",
|
||||
"host": "HOST-DEMO-01",
|
||||
"reason_code": "activity_anomaly",
|
||||
"description": "Повышенная активность без сетевых признаков."
|
||||
},
|
||||
{
|
||||
"event_id": "sec-demo-002",
|
||||
"timestamp": "2026-06-06T12:20:00Z",
|
||||
"severity": "medium",
|
||||
"user_ref": "demo-user-002",
|
||||
"host": "HOST-DEMO-02",
|
||||
"reason_code": "application_anomaly",
|
||||
"description": "Редкое приложение в рабочем контексте."
|
||||
},
|
||||
{
|
||||
"event_id": "sec-demo-003",
|
||||
"timestamp": "2026-06-06T18:35:00Z",
|
||||
"severity": "high",
|
||||
"user_ref": "demo-user-003",
|
||||
"host": "HOST-DEMO-03",
|
||||
"reason_code": "low_activity_with_late_rdp",
|
||||
"description": "Низкая дневная активность и поздняя RDP-сессия."
|
||||
},
|
||||
{
|
||||
"event_id": "sec-demo-004",
|
||||
"timestamp": "2026-06-06T21:45:00Z",
|
||||
"severity": "critical",
|
||||
"user_ref": "demo-user-005",
|
||||
"host": "HOST-DEMO-05",
|
||||
"reason_code": "night_network_admin_activity",
|
||||
"description": "Ночное администрирование и сетевой признак требуют ручной проверки."
|
||||
}
|
||||
],
|
||||
"network_events": [
|
||||
{
|
||||
"timestamp": "2026-06-06T21:46:00Z",
|
||||
"source_host": "HOST-DEMO-05",
|
||||
"source_ip": "192.0.2.15",
|
||||
"destination": "203.0.113.20:443",
|
||||
"action": "pass",
|
||||
"provider_status": "contract_only"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-06-06T21:47:00Z",
|
||||
"source_host": "HOST-DEMO-05",
|
||||
"source_ip": "192.0.2.15",
|
||||
"destination": "198.51.100.25:22",
|
||||
"action": "block",
|
||||
"provider_status": "contract_only"
|
||||
}
|
||||
],
|
||||
"ueba_score_examples": [
|
||||
{
|
||||
"user_ref": "demo-user-001",
|
||||
"score": 18,
|
||||
"severity": "low",
|
||||
"reason_codes": [
|
||||
"activity_anomaly"
|
||||
]
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-002",
|
||||
"score": 42,
|
||||
"severity": "medium",
|
||||
"reason_codes": [
|
||||
"application_anomaly",
|
||||
"history_anomaly"
|
||||
]
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-003",
|
||||
"score": 63,
|
||||
"severity": "high",
|
||||
"reason_codes": [
|
||||
"activity_anomaly",
|
||||
"time_anomaly"
|
||||
]
|
||||
},
|
||||
{
|
||||
"user_ref": "demo-user-005",
|
||||
"score": 82,
|
||||
"severity": "critical",
|
||||
"reason_codes": [
|
||||
"time_anomaly",
|
||||
"network_anomaly",
|
||||
"history_anomaly"
|
||||
]
|
||||
}
|
||||
],
|
||||
"investigation": {
|
||||
"investigation_id": "case-demo-004",
|
||||
"candidate_id": "sec-demo-004",
|
||||
"status": "in_review",
|
||||
"entities": {
|
||||
"user": "demo-user-005",
|
||||
"host": "HOST-DEMO-05",
|
||||
"app": "admin-tool-demo.exe",
|
||||
"network_event": "203.0.113.20:443"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
# Executive Summary
|
||||
|
||||
Demo-only evidence pack for AWatch-rus Pilot v1.
|
||||
|
||||
## Главный вывод
|
||||
|
||||
В демонстрационном периоде главный управленческий риск связан с сочетанием
|
||||
ночной административной активности, сетевого признака и отклонения от обычной
|
||||
истории работы. Риск требует ручной проверки, но не является автоматическим
|
||||
вердиктом о нарушении.
|
||||
|
||||
## Что видно руководителю
|
||||
|
||||
- общий индекс активности по подразделениям;
|
||||
- подразделение с повышенным риском;
|
||||
- причина риска в понятных управленческих терминах;
|
||||
- краткий вывод без технических логов;
|
||||
- ссылка на evidence pack для ИБ и расследований.
|
||||
|
||||
## Ограничения
|
||||
|
||||
- demo data обезличены;
|
||||
- UEBA Score v1 является rule-based моделью;
|
||||
- pfSense readiness остается `contract_only`;
|
||||
- AWatch-rus не заявляется как SIEM, классический DLP или ML-платформа.
|
||||
@@ -0,0 +1,53 @@
|
||||
{
|
||||
"contract_version": "forensics-v1",
|
||||
"demo_only": true,
|
||||
"investigation": {
|
||||
"investigation_id": "case-demo-004",
|
||||
"candidate_id": "sec-demo-004",
|
||||
"status": "in_review",
|
||||
"severity": "critical",
|
||||
"summary": "Ночная административная активность и сетевой признак требуют ручной проверки.",
|
||||
"entities": {
|
||||
"user": "demo-user-005",
|
||||
"host": "HOST-DEMO-05",
|
||||
"app": "admin-tool-demo.exe",
|
||||
"network_event": "203.0.113.20:443"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"timestamp": "2026-06-06T21:40:00Z",
|
||||
"kind": "activity",
|
||||
"entity": "demo-user-005",
|
||||
"summary": "Ночная активность в административном приложении.",
|
||||
"source": "activity_rules"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-06-06T21:45:00Z",
|
||||
"kind": "risk",
|
||||
"entity": "sec-demo-004",
|
||||
"summary": "UEBA Score v1 severity critical.",
|
||||
"source": "ueba-score-v1"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-06-06T21:46:00Z",
|
||||
"kind": "network",
|
||||
"entity": "HOST-DEMO-05",
|
||||
"summary": "Сетевой признак по readiness-контракту.",
|
||||
"source": "pfsense-contract"
|
||||
}
|
||||
],
|
||||
"exports": {
|
||||
"markdown": "investigation-report.md",
|
||||
"executive_summary": "executive-summary.md",
|
||||
"security_summary": "security-technical-summary.md"
|
||||
}
|
||||
},
|
||||
"claims": {
|
||||
"siem": false,
|
||||
"classic_dlp": false,
|
||||
"ml_used": false,
|
||||
"llm_used": false,
|
||||
"pfsense_ingestion": false,
|
||||
"pfsense_status": "contract_only"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
# Investigation Report
|
||||
|
||||
Demo-only investigation report for AWatch-rus Pilot v1.
|
||||
|
||||
## Карточка расследования
|
||||
|
||||
- Investigation ID: `case-demo-004`
|
||||
- Candidate ID: `sec-demo-004`
|
||||
- Status: `in_review`
|
||||
- Severity: `critical`
|
||||
- User: `demo-user-005`
|
||||
- Host: `HOST-DEMO-05`
|
||||
- App: `admin-tool-demo.exe`
|
||||
- Network event: `203.0.113.20:443`
|
||||
|
||||
## Timeline
|
||||
|
||||
| Время UTC | Тип | Сущность | Кратко | Источник |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| 2026-06-06T21:40:00Z | activity | `demo-user-005` | Ночная активность в административном приложении | activity_rules |
|
||||
| 2026-06-06T21:45:00Z | risk | `sec-demo-004` | UEBA severity `critical` | ueba-score-v1 |
|
||||
| 2026-06-06T21:46:00Z | network | `HOST-DEMO-05` | Сетевой признак по readiness-контракту | pfsense-contract |
|
||||
| 2026-06-06T21:50:00Z | review | `case-demo-004` | Кейс требует ручной проверки | portal_contract |
|
||||
|
||||
## Вывод расследования
|
||||
|
||||
Демонстрационный кейс показывает, как AWatch-rus связывает активность,
|
||||
приложение, хост и сетевой признак в единый пакет проверки. Данные обезличены.
|
||||
Система не выносит автоматический вердикт и не заявляет production pfSense
|
||||
ingestion.
|
||||
@@ -0,0 +1,40 @@
|
||||
# Security Technical Summary
|
||||
|
||||
Demo-only security summary for AWatch-rus Pilot v1.
|
||||
|
||||
## Сигнал
|
||||
|
||||
Кандидат `sec-demo-004` получил severity `critical` из-за комбинации:
|
||||
|
||||
- `time_anomaly`;
|
||||
- `network_anomaly`;
|
||||
- `history_anomaly`.
|
||||
|
||||
## UEBA Score v1
|
||||
|
||||
```json
|
||||
{
|
||||
"score": 82,
|
||||
"severity": "critical",
|
||||
"model": "ueba-score-v1",
|
||||
"type": "rule_based",
|
||||
"ml_used": false,
|
||||
"llm_used": false
|
||||
}
|
||||
```
|
||||
|
||||
## Network Context
|
||||
|
||||
Сетевые признаки показаны на RFC 5737 адресах и относятся к readiness-контракту:
|
||||
|
||||
- source host: `HOST-DEMO-05`;
|
||||
- source IP: `192.0.2.15`;
|
||||
- destination: `203.0.113.20:443`;
|
||||
- provider status: `contract_only`.
|
||||
|
||||
## Ограничения
|
||||
|
||||
- это не production pfSense ingestion;
|
||||
- это не SIEM-correlation;
|
||||
- риск является кандидатом на ручную проверку;
|
||||
- окончательное решение принимает специалист.
|
||||
Reference in New Issue
Block a user