224 lines
5.8 KiB
JSON
224 lines
5.8 KiB
JSON
{
|
|
"dataset": "awatch-rus-pilot-v1-demo",
|
|
"generated_at_utc": "2026-06-06T09:00:00Z",
|
|
"demo_only": true,
|
|
"privacy": {
|
|
"real_personal_data": false,
|
|
"real_customer_hosts": false,
|
|
"real_customer_networks": false,
|
|
"allowed_network_examples": [
|
|
"192.0.2.0/24",
|
|
"198.51.100.0/24",
|
|
"203.0.113.0/24"
|
|
]
|
|
},
|
|
"departments": [
|
|
{
|
|
"department_id": "dept-sales-demo",
|
|
"name": "Отдел продаж",
|
|
"activity_index": 82,
|
|
"load_state": "normal",
|
|
"risk": "low"
|
|
},
|
|
{
|
|
"department_id": "dept-accounting-demo",
|
|
"name": "Бухгалтерия",
|
|
"activity_index": 68,
|
|
"load_state": "normal",
|
|
"risk": "medium"
|
|
},
|
|
{
|
|
"department_id": "dept-warehouse-demo",
|
|
"name": "Склад",
|
|
"activity_index": 41,
|
|
"load_state": "low_activity",
|
|
"risk": "high"
|
|
},
|
|
{
|
|
"department_id": "dept-support-demo",
|
|
"name": "Поддержка",
|
|
"activity_index": 91,
|
|
"load_state": "overload",
|
|
"risk": "medium"
|
|
},
|
|
{
|
|
"department_id": "dept-it-demo",
|
|
"name": "ИТ",
|
|
"activity_index": 74,
|
|
"load_state": "normal",
|
|
"risk": "critical"
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"user_ref": "demo-user-001",
|
|
"department_id": "dept-sales-demo",
|
|
"host": "HOST-DEMO-01",
|
|
"responsible": "manager-demo-sales"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-002",
|
|
"department_id": "dept-accounting-demo",
|
|
"host": "HOST-DEMO-02",
|
|
"responsible": "manager-demo-accounting"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-003",
|
|
"department_id": "dept-warehouse-demo",
|
|
"host": "HOST-DEMO-03",
|
|
"responsible": "manager-demo-warehouse"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-004",
|
|
"department_id": "dept-support-demo",
|
|
"host": "HOST-DEMO-04",
|
|
"responsible": "manager-demo-support"
|
|
},
|
|
{
|
|
"user_ref": "demo-user-005",
|
|
"department_id": "dept-it-demo",
|
|
"host": "HOST-DEMO-05",
|
|
"responsible": "manager-demo-it"
|
|
}
|
|
],
|
|
"activity_events": [
|
|
{
|
|
"timestamp": "2026-06-06T08:55:00Z",
|
|
"user_ref": "demo-user-001",
|
|
"host": "HOST-DEMO-01",
|
|
"app": "crm-demo.exe",
|
|
"kind": "normal_activity",
|
|
"duration_minutes": 42
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T09:10:00Z",
|
|
"user_ref": "demo-user-002",
|
|
"host": "HOST-DEMO-02",
|
|
"app": "1cv8.exe",
|
|
"kind": "business_app_activity",
|
|
"duration_minutes": 67
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T10:25:00Z",
|
|
"user_ref": "demo-user-003",
|
|
"host": "HOST-DEMO-03",
|
|
"app": "rdp-session",
|
|
"kind": "low_activity",
|
|
"duration_minutes": 8
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:40:00Z",
|
|
"user_ref": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"app": "admin-tool-demo.exe",
|
|
"kind": "night_access_anomaly",
|
|
"duration_minutes": 24
|
|
}
|
|
],
|
|
"security_events": [
|
|
{
|
|
"event_id": "sec-demo-001",
|
|
"timestamp": "2026-06-06T11:05:00Z",
|
|
"severity": "low",
|
|
"user_ref": "demo-user-001",
|
|
"host": "HOST-DEMO-01",
|
|
"reason_code": "activity_anomaly",
|
|
"description": "Повышенная активность без сетевых признаков."
|
|
},
|
|
{
|
|
"event_id": "sec-demo-002",
|
|
"timestamp": "2026-06-06T12:20:00Z",
|
|
"severity": "medium",
|
|
"user_ref": "demo-user-002",
|
|
"host": "HOST-DEMO-02",
|
|
"reason_code": "application_anomaly",
|
|
"description": "Редкое приложение в рабочем контексте."
|
|
},
|
|
{
|
|
"event_id": "sec-demo-003",
|
|
"timestamp": "2026-06-06T18:35:00Z",
|
|
"severity": "high",
|
|
"user_ref": "demo-user-003",
|
|
"host": "HOST-DEMO-03",
|
|
"reason_code": "low_activity_with_late_rdp",
|
|
"description": "Низкая дневная активность и поздняя RDP-сессия."
|
|
},
|
|
{
|
|
"event_id": "sec-demo-004",
|
|
"timestamp": "2026-06-06T21:45:00Z",
|
|
"severity": "critical",
|
|
"user_ref": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"reason_code": "night_network_admin_activity",
|
|
"description": "Ночное администрирование и сетевой признак требуют ручной проверки."
|
|
}
|
|
],
|
|
"network_events": [
|
|
{
|
|
"timestamp": "2026-06-06T21:46:00Z",
|
|
"source_host": "HOST-DEMO-05",
|
|
"source_ip": "192.0.2.15",
|
|
"destination": "203.0.113.20:443",
|
|
"action": "pass",
|
|
"provider_status": "contract_only"
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:47:00Z",
|
|
"source_host": "HOST-DEMO-05",
|
|
"source_ip": "192.0.2.15",
|
|
"destination": "198.51.100.25:22",
|
|
"action": "block",
|
|
"provider_status": "contract_only"
|
|
}
|
|
],
|
|
"ueba_score_examples": [
|
|
{
|
|
"user_ref": "demo-user-001",
|
|
"score": 18,
|
|
"severity": "low",
|
|
"reason_codes": [
|
|
"activity_anomaly"
|
|
]
|
|
},
|
|
{
|
|
"user_ref": "demo-user-002",
|
|
"score": 42,
|
|
"severity": "medium",
|
|
"reason_codes": [
|
|
"application_anomaly",
|
|
"history_anomaly"
|
|
]
|
|
},
|
|
{
|
|
"user_ref": "demo-user-003",
|
|
"score": 63,
|
|
"severity": "high",
|
|
"reason_codes": [
|
|
"activity_anomaly",
|
|
"time_anomaly"
|
|
]
|
|
},
|
|
{
|
|
"user_ref": "demo-user-005",
|
|
"score": 82,
|
|
"severity": "critical",
|
|
"reason_codes": [
|
|
"time_anomaly",
|
|
"network_anomaly",
|
|
"history_anomaly"
|
|
]
|
|
}
|
|
],
|
|
"investigation": {
|
|
"investigation_id": "case-demo-004",
|
|
"candidate_id": "sec-demo-004",
|
|
"status": "in_review",
|
|
"entities": {
|
|
"user": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"app": "admin-tool-demo.exe",
|
|
"network_event": "203.0.113.20:443"
|
|
}
|
|
}
|
|
}
|