{
  "dataset": "awatch-rus-pilot-v1-demo",
  "generated_at_utc": "2026-06-06T09:00:00Z",
  "demo_only": true,
  "privacy": {
    "real_personal_data": false,
    "real_customer_hosts": false,
    "real_customer_networks": false,
    "real_domains": false,
    "real_logins": false,
    "personal_data": false,
    "allowed_network_examples": [
      "192.0.2.0/24",
      "198.51.100.0/24",
      "203.0.113.0/24"
    ]
  },
  "scenario_coverage": [
    {
      "scenario": "normal_work",
      "covered_by": [
        "dept-sales-demo",
        "activity event normal_activity"
      ]
    },
    {
      "scenario": "activity_drop",
      "covered_by": [
        "dept-warehouse-demo",
        "activity event low_activity"
      ]
    },
    {
      "scenario": "remote_session_growth",
      "covered_by": [
        "remote_session_summary",
        "rdp-session activity events"
      ]
    },
    {
      "scenario": "elevated_ueba",
      "covered_by": [
        "ueba_score_examples sec-demo-004"
      ]
    },
    {
      "scenario": "incident_candidate",
      "covered_by": [
        "investigation case-demo-004"
      ]
    },
    {
      "scenario": "low_agent_coverage",
      "covered_by": [
        "agent_coverage"
      ]
    }
  ],
  "departments": [
    {
      "department_id": "dept-sales-demo",
      "name": "Отдел продаж",
      "activity_index": 82,
      "load_state": "normal",
      "risk": "low"
    },
    {
      "department_id": "dept-accounting-demo",
      "name": "Бухгалтерия",
      "activity_index": 68,
      "load_state": "normal",
      "risk": "medium"
    },
    {
      "department_id": "dept-warehouse-demo",
      "name": "Склад",
      "activity_index": 41,
      "load_state": "low_activity",
      "risk": "high"
    },
    {
      "department_id": "dept-support-demo",
      "name": "Поддержка",
      "activity_index": 91,
      "load_state": "overload",
      "risk": "medium"
    },
    {
      "department_id": "dept-it-demo",
      "name": "ИТ",
      "activity_index": 74,
      "load_state": "normal",
      "risk": "critical"
    }
  ],
  "users": [
    {
      "user_ref": "demo-user-001",
      "department_id": "dept-sales-demo",
      "host": "HOST-DEMO-01",
      "responsible": "manager-demo-sales"
    },
    {
      "user_ref": "demo-user-002",
      "department_id": "dept-accounting-demo",
      "host": "HOST-DEMO-02",
      "responsible": "manager-demo-accounting"
    },
    {
      "user_ref": "demo-user-003",
      "department_id": "dept-warehouse-demo",
      "host": "HOST-DEMO-03",
      "responsible": "manager-demo-warehouse"
    },
    {
      "user_ref": "demo-user-004",
      "department_id": "dept-support-demo",
      "host": "HOST-DEMO-04",
      "responsible": "manager-demo-support"
    },
    {
      "user_ref": "demo-user-005",
      "department_id": "dept-it-demo",
      "host": "HOST-DEMO-05",
      "responsible": "manager-demo-it"
    }
  ],
  "activity_events": [
    {
      "timestamp": "2026-06-06T08:55:00Z",
      "user_ref": "demo-user-001",
      "host": "HOST-DEMO-01",
      "app": "crm-demo.exe",
      "kind": "normal_activity",
      "duration_minutes": 42
    },
    {
      "timestamp": "2026-06-06T09:10:00Z",
      "user_ref": "demo-user-002",
      "host": "HOST-DEMO-02",
      "app": "1cv8.exe",
      "kind": "business_app_activity",
      "duration_minutes": 67
    },
    {
      "timestamp": "2026-06-06T10:25:00Z",
      "user_ref": "demo-user-003",
      "host": "HOST-DEMO-03",
      "app": "rdp-session",
      "kind": "low_activity",
      "duration_minutes": 8
    },
    {
      "timestamp": "2026-06-06T18:25:00Z",
      "user_ref": "demo-user-003",
      "host": "HOST-DEMO-03",
      "app": "rdp-session",
      "kind": "remote_session_activity",
      "duration_minutes": 31
    },
    {
      "timestamp": "2026-06-06T21:40:00Z",
      "user_ref": "demo-user-005",
      "host": "HOST-DEMO-05",
      "app": "admin-tool-demo.exe",
      "kind": "night_access_anomaly",
      "duration_minutes": 24
    },
    {
      "timestamp": "2026-06-06T21:42:00Z",
      "user_ref": "demo-user-005",
      "host": "HOST-DEMO-05",
      "app": "rdp-session",
      "kind": "remote_session_activity",
      "duration_minutes": 27
    }
  ],
  "remote_session_summary": {
    "baseline_sessions_7d_avg": 2,
    "demo_period_sessions": 6,
    "growth_percent": 200,
    "risk_signal": "remote_session_growth",
    "explanation": "В демонстрационном периоде число удаленных сессий выше базового уровня."
  },
  "security_events": [
    {
      "event_id": "sec-demo-001",
      "timestamp": "2026-06-06T11:05:00Z",
      "severity": "low",
      "user_ref": "demo-user-001",
      "host": "HOST-DEMO-01",
      "reason_code": "activity_anomaly",
      "description": "Повышенная активность без сетевых признаков."
    },
    {
      "event_id": "sec-demo-002",
      "timestamp": "2026-06-06T12:20:00Z",
      "severity": "medium",
      "user_ref": "demo-user-002",
      "host": "HOST-DEMO-02",
      "reason_code": "application_anomaly",
      "description": "Редкое приложение в рабочем контексте."
    },
    {
      "event_id": "sec-demo-003",
      "timestamp": "2026-06-06T18:35:00Z",
      "severity": "high",
      "user_ref": "demo-user-003",
      "host": "HOST-DEMO-03",
      "reason_code": "low_activity_with_late_rdp",
      "description": "Низкая дневная активность и поздняя RDP-сессия."
    },
    {
      "event_id": "sec-demo-004",
      "timestamp": "2026-06-06T21:45:00Z",
      "severity": "critical",
      "user_ref": "demo-user-005",
      "host": "HOST-DEMO-05",
      "reason_code": "night_network_admin_activity",
      "description": "Ночное администрирование и сетевой признак требуют ручной проверки."
    }
  ],
  "network_events": [
    {
      "timestamp": "2026-06-06T21:46:00Z",
      "source_host": "HOST-DEMO-05",
      "source_ip": "192.0.2.15",
      "destination": "203.0.113.20:443",
      "action": "pass",
      "provider_status": "contract_only"
    },
    {
      "timestamp": "2026-06-06T21:47:00Z",
      "source_host": "HOST-DEMO-05",
      "source_ip": "192.0.2.15",
      "destination": "198.51.100.25:22",
      "action": "block",
      "provider_status": "contract_only"
    }
  ],
  "ueba_score_examples": [
    {
      "user_ref": "demo-user-001",
      "score": 18,
      "severity": "low",
      "reason_codes": [
        "activity_anomaly"
      ]
    },
    {
      "user_ref": "demo-user-002",
      "score": 42,
      "severity": "medium",
      "reason_codes": [
        "application_anomaly",
        "history_anomaly"
      ]
    },
    {
      "user_ref": "demo-user-003",
      "score": 63,
      "severity": "high",
      "reason_codes": [
        "activity_anomaly",
        "time_anomaly"
      ]
    },
    {
      "user_ref": "demo-user-005",
      "score": 82,
      "severity": "critical",
      "reason_codes": [
        "time_anomaly",
        "network_anomaly",
        "history_anomaly"
      ]
    }
  ],
  "agent_coverage": {
    "expected_agents": 6,
    "active_agents": 4,
    "stale_agents": 1,
    "missing_agents": 1,
    "coverage_percent": 67,
    "sla_status": "WARNING",
    "demo_impact": "KPI требует осторожной интерпретации из-за неполного покрытия."
  },
  "workforce_kpi_example": {
    "kpi_score": 64,
    "confidence": "medium",
    "coverage": {
      "agent_coverage_percent": 67,
      "data_freshness": "fresh",
      "missing_sources": [
        "HOST-DEMO-06"
      ]
    },
    "factors": [
      {
        "name": "productive_activity",
        "label": "Полезная активность",
        "impact": "+28",
        "explanation": "Рабочие приложения присутствуют в дневном периоде."
      },
      {
        "name": "idle_time",
        "label": "Простой",
        "impact": "-9",
        "explanation": "Есть периоды низкой активности в рабочее время."
      },
      {
        "name": "remote_session_activity",
        "label": "Удаленные сессии",
        "impact": "-11",
        "explanation": "Удаленные сессии выросли относительно демонстрационной базы."
      },
      {
        "name": "data_coverage",
        "label": "Полнота данных",
        "impact": "-7",
        "explanation": "Покрытие агентами ниже целевого уровня."
      }
    ]
  },
  "risk_narrative_example": {
    "risk_level": "high",
    "risk_score": 78,
    "title": "Рост операционного риска требует ручной проверки",
    "summary": "Снижение активности в одном подразделении совпало с ростом удаленных сессий, повышенным UEBA и неполным покрытием агентами.",
    "why": [
      "Workforce KPI ниже целевого уровня",
      "Есть рост удаленных сессий",
      "UEBA Score v1 повышен до critical на демонстрационном кандидате",
      "Покрытие агентами ниже целевого уровня"
    ],
    "limitations": [
      "Risk Narrative является rule-based выводом",
      "pfSense readiness находится в contract_only режиме",
      "Данные демонстрационные и не являются production ingestion"
    ]
  },
  "recommended_actions": [
    {
      "priority": "high",
      "title": "Проверить подразделение с низким индексом активности",
      "summary": "Просадка активности требует управленческого разбора причины.",
      "owner_role": "manager",
      "recommended_deadline": "24h",
      "reason_codes": [
        "LOW_WORKFORCE_KPI",
        "HIGH_REMOTE_ACTIVITY"
      ],
      "evidence": [
        "Workforce KPI demo score: 64%",
        "Рост удаленных сессий: +200%"
      ]
    },
    {
      "priority": "high",
      "title": "Передать кандидата в контур ИБ",
      "summary": "UEBA Score v1 повышен; требуется ручная проверка специалистом ИБ.",
      "owner_role": "security",
      "recommended_deadline": "24h",
      "reason_codes": [
        "HIGH_UEBA",
        "INCIDENT_CANDIDATE"
      ],
      "evidence": [
        "sec-demo-004 severity critical",
        "Связка activity/app/network readiness"
      ]
    },
    {
      "priority": "high",
      "title": "Проверить покрытие агентами",
      "summary": "Неполное покрытие снижает доверие к KPI и должно быть проверено эксплуатацией.",
      "owner_role": "admin",
      "recommended_deadline": "24h",
      "reason_codes": [
        "LOW_COVERAGE"
      ],
      "evidence": [
        "Покрытие агентами: 67%",
        "Один агент stale, один отсутствует"
      ]
    }
  ],
  "investigation": {
    "investigation_id": "case-demo-004",
    "candidate_id": "sec-demo-004",
    "status": "in_review",
    "entities": {
      "user": "demo-user-005",
      "host": "HOST-DEMO-05",
      "app": "admin-tool-demo.exe",
      "network_event": "203.0.113.20:443"
    }
  }
}