54 lines
1.6 KiB
JSON
54 lines
1.6 KiB
JSON
{
|
|
"contract_version": "forensics-v1",
|
|
"demo_only": true,
|
|
"investigation": {
|
|
"investigation_id": "case-demo-004",
|
|
"candidate_id": "sec-demo-004",
|
|
"status": "in_review",
|
|
"severity": "critical",
|
|
"summary": "Ночная административная активность и сетевой признак требуют ручной проверки.",
|
|
"entities": {
|
|
"user": "demo-user-005",
|
|
"host": "HOST-DEMO-05",
|
|
"app": "admin-tool-demo.exe",
|
|
"network_event": "203.0.113.20:443"
|
|
},
|
|
"timeline": [
|
|
{
|
|
"timestamp": "2026-06-06T21:40:00Z",
|
|
"kind": "activity",
|
|
"entity": "demo-user-005",
|
|
"summary": "Ночная активность в административном приложении.",
|
|
"source": "activity_rules"
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:45:00Z",
|
|
"kind": "risk",
|
|
"entity": "sec-demo-004",
|
|
"summary": "UEBA Score v1 severity critical.",
|
|
"source": "ueba-score-v1"
|
|
},
|
|
{
|
|
"timestamp": "2026-06-06T21:46:00Z",
|
|
"kind": "network",
|
|
"entity": "HOST-DEMO-05",
|
|
"summary": "Сетевой признак по readiness-контракту.",
|
|
"source": "pfsense-contract"
|
|
}
|
|
],
|
|
"exports": {
|
|
"markdown": "investigation-report.md",
|
|
"executive_summary": "executive-summary.md",
|
|
"security_summary": "security-technical-summary.md"
|
|
}
|
|
},
|
|
"claims": {
|
|
"siem": false,
|
|
"classic_dlp": false,
|
|
"ml_used": false,
|
|
"llm_used": false,
|
|
"pfsense_ingestion": false,
|
|
"pfsense_status": "contract_only"
|
|
}
|
|
}
|