400 lines
12 KiB
JSON
400 lines
12 KiB
JSON
{
|
|
"dataset": "awatch-rus-pilot-v1-demo",
|
|
"generated_at_utc": "2026-06-06T09:00:00Z",
|
|
"demo_only": true,
|
|
"privacy": {
|
|
"real_personal_data": false,
|
|
"real_customer_hosts": false,
|
|
"real_customer_networks": false,
|
|
"real_domains": false,
|
|
"real_logins": false,
|
|
"personal_data": false,
|
|
"allowed_network_examples": [
|
|
"192.0.2.0/24",
|
|
"198.51.100.0/24",
|
|
"203.0.113.0/24"
|
|
]
|
|
},
|
|
"scenario_coverage": [
|
|
{
|
|
"scenario": "normal_work",
|
|
"covered_by": [
|
|
"dept-sales-demo",
|
|
"activity event normal_activity"
|
|
]
|
|
},
|
|
{
|
|
"scenario": "activity_drop",
|
|
"covered_by": [
|
|
"dept-warehouse-demo",
|
|
"activity event low_activity"
|
|
]
|
|
},
|
|
{
|
|
"scenario": "remote_session_growth",
|
|
"covered_by": [
|
|
"remote_session_summary",
|
|
"rdp-session activity events"
|
|
]
|
|
},
|
|
{
|
|
"scenario": "elevated_ueba",
|
|
"covered_by": [
|
|
"ueba_score_examples sec-demo-004"
|
|
]
|
|
},
|
|
{
|
|
"scenario": "incident_candidate",
|
|
"covered_by": [
|
|
"investigation case-demo-004"
|
|
]
|
|
},
|
|
{
|
|
"scenario": "low_agent_coverage",
|
|
"covered_by": [
|
|
"agent_coverage"
|
|
]
|
|
}
|
|
],
|
|
"departments": [
|
|
{
|
|
"department_id": "dept-sales-demo",
|
|
"name": "Отдел продаж",
|
|
"activity_index": 82,
|
|
"load_state": "normal",
|
|
"risk": "low"
|
|
},
|
|
{
|
|
"department_id": "dept-accounting-demo",
|
|
"name": "Бухгалтерия",
|
|
"activity_index": 68,
|
|
"load_state": "normal",
|
|
"risk": "medium"
|
|
},
|
|
{
|
|
"department_id": "dept-warehouse-demo",
|
|
"name": "Склад",
|
|
"activity_index": 41,
|
|
"load_state": "low_activity",
|
|
"risk": "high"
|
|
},
|
|
{
|
|
"department_id": "dept-support-demo",
|
|
"name": "Поддержка",
|
|
"activity_index": 91,
|
|
"load_state": "overload",
|
|
"risk": "medium"
|
|
},
|
|
{
|
|
"department_id": "dept-it-demo",
|
|
"name": "ИТ",
|
|
"activity_index": 74,
|
|
"load_state": "normal",
|
|
"risk": "critical"
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"user_ref": "demo-user-001",
|
|
"department_id": "dept-sales-demo",
|
|
"host": "HOST-DEMO-01",
|
|
"responsible": "manager-demo-sales"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-002",
|
|
"department_id": "dept-accounting-demo",
|
|
"host": "HOST-DEMO-02",
|
|
"responsible": "manager-demo-accounting"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-003",
|
|
"department_id": "dept-warehouse-demo",
|
|
"host": "HOST-DEMO-03",
|
|
"responsible": "manager-demo-warehouse"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-004",
|
|
"department_id": "dept-support-demo",
|
|
"host": "HOST-DEMO-04",
|
|
"responsible": "manager-demo-support"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-005",
|
|
"department_id": "dept-it-demo",
|
|
"host": "HOST-DEMO-05",
|
|
"responsible": "manager-demo-it"
|
|
}
|
|
],
|
|
"activity_events": [
|
|
{
|
|
"timestamp": "2026-06-06T08:55:00Z",
|
|
"user_ref": "demo-user-001",
|
|
"host": "HOST-DEMO-01",
|
|
"app": "crm-demo.exe",
|
|
"kind": "normal_activity",
|
|
"duration_minutes": 42
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T09:10:00Z",
|
|
"user_ref": "demo-user-002",
|
|
"host": "HOST-DEMO-02",
|
|
"app": "1cv8.exe",
|
|
"kind": "business_app_activity",
|
|
"duration_minutes": 67
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T10:25:00Z",
|
|
"user_ref": "demo-user-003",
|
|
"host": "HOST-DEMO-03",
|
|
"app": "rdp-session",
|
|
"kind": "low_activity",
|
|
"duration_minutes": 8
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T18:25:00Z",
|
|
"user_ref": "demo-user-003",
|
|
"host": "HOST-DEMO-03",
|
|
"app": "rdp-session",
|
|
"kind": "remote_session_activity",
|
|
"duration_minutes": 31
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:40:00Z",
|
|
"user_ref": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"app": "admin-tool-demo.exe",
|
|
"kind": "night_access_anomaly",
|
|
"duration_minutes": 24
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:42:00Z",
|
|
"user_ref": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"app": "rdp-session",
|
|
"kind": "remote_session_activity",
|
|
"duration_minutes": 27
|
|
}
|
|
],
|
|
"remote_session_summary": {
|
|
"baseline_sessions_7d_avg": 2,
|
|
"demo_period_sessions": 6,
|
|
"growth_percent": 200,
|
|
"risk_signal": "remote_session_growth",
|
|
"explanation": "В демонстрационном периоде число удаленных сессий выше базового уровня."
|
|
},
|
|
"security_events": [
|
|
{
|
|
"event_id": "sec-demo-001",
|
|
"timestamp": "2026-06-06T11:05:00Z",
|
|
"severity": "low",
|
|
"user_ref": "demo-user-001",
|
|
"host": "HOST-DEMO-01",
|
|
"reason_code": "activity_anomaly",
|
|
"description": "Повышенная активность без сетевых признаков."
|
|
},
|
|
{
|
|
"event_id": "sec-demo-002",
|
|
"timestamp": "2026-06-06T12:20:00Z",
|
|
"severity": "medium",
|
|
"user_ref": "demo-user-002",
|
|
"host": "HOST-DEMO-02",
|
|
"reason_code": "application_anomaly",
|
|
"description": "Редкое приложение в рабочем контексте."
|
|
},
|
|
{
|
|
"event_id": "sec-demo-003",
|
|
"timestamp": "2026-06-06T18:35:00Z",
|
|
"severity": "high",
|
|
"user_ref": "demo-user-003",
|
|
"host": "HOST-DEMO-03",
|
|
"reason_code": "low_activity_with_late_rdp",
|
|
"description": "Низкая дневная активность и поздняя RDP-сессия."
|
|
},
|
|
{
|
|
"event_id": "sec-demo-004",
|
|
"timestamp": "2026-06-06T21:45:00Z",
|
|
"severity": "critical",
|
|
"user_ref": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"reason_code": "night_network_admin_activity",
|
|
"description": "Ночное администрирование и сетевой признак требуют ручной проверки."
|
|
}
|
|
],
|
|
"network_events": [
|
|
{
|
|
"timestamp": "2026-06-06T21:46:00Z",
|
|
"source_host": "HOST-DEMO-05",
|
|
"source_ip": "192.0.2.15",
|
|
"destination": "203.0.113.20:443",
|
|
"action": "pass",
|
|
"provider_status": "contract_only"
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:47:00Z",
|
|
"source_host": "HOST-DEMO-05",
|
|
"source_ip": "192.0.2.15",
|
|
"destination": "198.51.100.25:22",
|
|
"action": "block",
|
|
"provider_status": "contract_only"
|
|
}
|
|
],
|
|
"ueba_score_examples": [
|
|
{
|
|
"user_ref": "demo-user-001",
|
|
"score": 18,
|
|
"severity": "low",
|
|
"reason_codes": [
|
|
"activity_anomaly"
|
|
]
|
|
},
|
|
{
|
|
"user_ref": "demo-user-002",
|
|
"score": 42,
|
|
"severity": "medium",
|
|
"reason_codes": [
|
|
"application_anomaly",
|
|
"history_anomaly"
|
|
]
|
|
},
|
|
{
|
|
"user_ref": "demo-user-003",
|
|
"score": 63,
|
|
"severity": "high",
|
|
"reason_codes": [
|
|
"activity_anomaly",
|
|
"time_anomaly"
|
|
]
|
|
},
|
|
{
|
|
"user_ref": "demo-user-005",
|
|
"score": 82,
|
|
"severity": "critical",
|
|
"reason_codes": [
|
|
"time_anomaly",
|
|
"network_anomaly",
|
|
"history_anomaly"
|
|
]
|
|
}
|
|
],
|
|
"agent_coverage": {
|
|
"expected_agents": 6,
|
|
"active_agents": 4,
|
|
"stale_agents": 1,
|
|
"missing_agents": 1,
|
|
"coverage_percent": 67,
|
|
"sla_status": "WARNING",
|
|
"demo_impact": "KPI требует осторожной интерпретации из-за неполного покрытия."
|
|
},
|
|
"workforce_kpi_example": {
|
|
"kpi_score": 64,
|
|
"confidence": "medium",
|
|
"coverage": {
|
|
"agent_coverage_percent": 67,
|
|
"data_freshness": "fresh",
|
|
"missing_sources": [
|
|
"HOST-DEMO-06"
|
|
]
|
|
},
|
|
"factors": [
|
|
{
|
|
"name": "productive_activity",
|
|
"label": "Полезная активность",
|
|
"impact": "+28",
|
|
"explanation": "Рабочие приложения присутствуют в дневном периоде."
|
|
},
|
|
{
|
|
"name": "idle_time",
|
|
"label": "Простой",
|
|
"impact": "-9",
|
|
"explanation": "Есть периоды низкой активности в рабочее время."
|
|
},
|
|
{
|
|
"name": "remote_session_activity",
|
|
"label": "Удаленные сессии",
|
|
"impact": "-11",
|
|
"explanation": "Удаленные сессии выросли относительно демонстрационной базы."
|
|
},
|
|
{
|
|
"name": "data_coverage",
|
|
"label": "Полнота данных",
|
|
"impact": "-7",
|
|
"explanation": "Покрытие агентами ниже целевого уровня."
|
|
}
|
|
]
|
|
},
|
|
"risk_narrative_example": {
|
|
"risk_level": "high",
|
|
"risk_score": 78,
|
|
"title": "Рост операционного риска требует ручной проверки",
|
|
"summary": "Снижение активности в одном подразделении совпало с ростом удаленных сессий, повышенным UEBA и неполным покрытием агентами.",
|
|
"why": [
|
|
"Workforce KPI ниже целевого уровня",
|
|
"Есть рост удаленных сессий",
|
|
"UEBA Score v1 повышен до critical на демонстрационном кандидате",
|
|
"Покрытие агентами ниже целевого уровня"
|
|
],
|
|
"limitations": [
|
|
"Risk Narrative является rule-based выводом",
|
|
"pfSense readiness находится в contract_only режиме",
|
|
"Данные демонстрационные и не являются production ingestion"
|
|
]
|
|
},
|
|
"recommended_actions": [
|
|
{
|
|
"priority": "high",
|
|
"title": "Проверить подразделение с низким индексом активности",
|
|
"summary": "Просадка активности требует управленческого разбора причины.",
|
|
"owner_role": "manager",
|
|
"recommended_deadline": "24h",
|
|
"reason_codes": [
|
|
"LOW_WORKFORCE_KPI",
|
|
"HIGH_REMOTE_ACTIVITY"
|
|
],
|
|
"evidence": [
|
|
"Workforce KPI demo score: 64%",
|
|
"Рост удаленных сессий: +200%"
|
|
]
|
|
},
|
|
{
|
|
"priority": "high",
|
|
"title": "Передать кандидата в контур ИБ",
|
|
"summary": "UEBA Score v1 повышен; требуется ручная проверка специалистом ИБ.",
|
|
"owner_role": "security",
|
|
"recommended_deadline": "24h",
|
|
"reason_codes": [
|
|
"HIGH_UEBA",
|
|
"INCIDENT_CANDIDATE"
|
|
],
|
|
"evidence": [
|
|
"sec-demo-004 severity critical",
|
|
"Связка activity/app/network readiness"
|
|
]
|
|
},
|
|
{
|
|
"priority": "high",
|
|
"title": "Проверить покрытие агентами",
|
|
"summary": "Неполное покрытие снижает доверие к KPI и должно быть проверено эксплуатацией.",
|
|
"owner_role": "admin",
|
|
"recommended_deadline": "24h",
|
|
"reason_codes": [
|
|
"LOW_COVERAGE"
|
|
],
|
|
"evidence": [
|
|
"Покрытие агентами: 67%",
|
|
"Один агент stale, один отсутствует"
|
|
]
|
|
}
|
|
],
|
|
"investigation": {
|
|
"investigation_id": "case-demo-004",
|
|
"candidate_id": "sec-demo-004",
|
|
"status": "in_review",
|
|
"entities": {
|
|
"user": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"app": "admin-tool-demo.exe",
|
|
"network_event": "203.0.113.20:443"
|
|
}
|
|
}
|
|
}
|