ZEKASTRA case pack VP-04 - export metadata - SYNTHETIC TRAINING DATA

Export 1: web proxy access log (proxy-log.csv)
Window (local time, UTC+3): 2026-04-07 10:00:00 to 2026-04-07 14:00:00, start inclusive, end exclusive
Row limit per page: 40
Rows returned: 40
Next page: present (page token issued; the next page was not collected)
Order: ascending by time_local
Column time_local: local time of the proxy server (UTC+3), the moment the request started. It is not UTC.
Column client_ip: the address of the client at the moment of the request. The proxy does not record a host name or an account.
Column target: for GET, the full URL; for CONNECT, host and port only. The proxy does not decrypt HTTPS, so a CONNECT row records the destination and the volume of the tunnel, not the content.
Columns bytes_out and bytes_in: bytes sent by the client and by the server; for CONNECT they cover the whole tunnel.
Column category: the proxy's own category label; "uncategorized" means the label list had no entry for the host.

Export 2: DNS resolver query log (dns-log.csv)
Window (UTC): 2026-04-07 06:00:00 to 2026-04-07 10:00:00, start inclusive, end exclusive
Row limit per page: 5000
Rows returned: 28
Next page: none
Column time_utc: UTC, as stored by the resolver.
Scope: only queries that reached this resolver. A client that holds a valid answer in its own cache does not send a new query until the TTL has passed.

Export 3: DHCP lease export (dhcp-leases.csv)
Window (UTC): 2026-04-07 00:00:00 to 2026-04-08 00:00:00
Rows returned: 6
Next page: none
Columns lease_start_utc and lease_end_utc: UTC. A lease end is the time the server recorded the lease as ended, by expiry or by release.
Column client_id: the identifier the client presented (synthetic).
Scope: the leases of four addresses on this day. The export does not show who was signed in to a host.

Not in this pack: sign-in logs of the mail service, endpoint telemetry, the full text of the web pages, and anything the user typed.
Exported by: IT administrator (role only).