ZEKASTRA case pack VP-05 - export parameters - SYNTHETIC TRAINING DATA

Export 1: security-events.csv
Source: the event collector MRD-WEC01 (Windows Event Forwarding, source-initiated subscription "Sunucu-Guvenlik"), log ForwardedEvents, filtered to Computer = MRD-FS01.meridyen.example
Window (UTC): 2026-05-08 00:00:00 to 2026-05-10 12:00:00, start inclusive, end exclusive
Rows: 2268
Column TimeCreated: UTC, the time the event was written on MRD-FS01.
Note: the Security log on MRD-FS01 itself was exported at collection too. Its first event is 1102 at 2026-05-09 01:07:44 UTC; it holds nothing older. The forwarded copy is the only source for earlier Security events.

Export 2: sysmon-events.csv
Source: MRD-FS01, log Microsoft-Windows-Sysmon/Operational (Sysmon 15, configuration "meridyen-sunucu-v3"), parsed with EvtxECmd
Window (UTC): 2026-05-08 00:00:00 to 2026-05-10 12:00:00, start inclusive, end exclusive
Rows: 174. Event types present: 1 process creation, 2 file creation time changed, 3 network connection, 11 file created. The configuration logs event 3 only for processes outside C:\Windows\ and for a short list of Windows binaries, so certutil.exe is logged and svchost.exe is not.
Column UtcTime: UTC. Columns CreationUtcTime and PreviousCreationUtcTime (event 2): UTC.

Export 3: firewall-outbound.csv
Source: edge firewall MRD-FW01, session log, rule "out-internet" (sessions from the server network to the internet). Inbound sessions are not in this export.
Window (local time, UTC+3): 2026-05-08 03:00:00 to 2026-05-10 15:00:00, start inclusive, end exclusive
Rows: 118
Column time_local: local time of the firewall (UTC+3), the moment the session ENDED. It is not UTC. A session's start is time_local minus duration_s.
Columns bytes_sent and bytes_recv: bytes, as seen by the firewall, from the internal host's point of view.

Export 4: mft-excerpt.csv
Source: $MFT of volume C: of MRD-FS01, parsed with MFTECmd, filtered to ParentPath under .\ProgramData and .\Windows\System32\Tasks
Rows: 49
Columns ending in 0x10: $STANDARD_INFORMATION timestamps. Columns ending in 0x30: $FILE_NAME timestamps. All UTC.
Column SI<FN: True when Created0x10 is earlier than Created0x30.
Column InUse: False for a record whose file was deleted and whose entry has not been reused.

Not in this pack
Prefetch: Windows Server does not enable the prefetcher by default and MRD-FS01 had it disabled (EnablePrefetcher = 0). There are no .pf files.
Volume D: (D:\Paylasim, the shares): not collected for this pack.