ZEKASTRA case pack VP-06 - export parameters - SYNTHETIC TRAINING DATA

Export 1: usn-journal.csv
Source: $Extend\$UsnJrnl:$J of volume C: of KZL-MUH07, parsed with MFTECmd (paths resolved with the $MFT of the same collection)
Window (UTC): 2026-06-16 00:00:00 to 2026-06-16 13:00:00, start inclusive, end exclusive
Rows: 2276
Column UpdateTimestamp: UTC. The USN journal records WHAT changed (UpdateReasons), not WHICH process changed it.
A rename writes two records: RenameOldName with the old name and RenameNewName with the new one, both with the same EntryNumber; MFTECmd also emits the closing record (RenameNewName|Close).
Column ParentPath: resolved at parse time; ".\" is the root of C:.

Export 2: sysmon-events.csv
Source: KZL-MUH07, log Microsoft-Windows-Sysmon/Operational (Sysmon 15, configuration "kuzey-istasyon-v2"), parsed with EvtxECmd
Window (UTC): 2026-06-16 00:00:00 to 2026-06-16 13:00:00, start inclusive, end exclusive
Rows: 232. Event types present: 1 process creation, 3 network connection (established connections only), 11 file created, 12 registry key deleted, 13 registry value set.
Column UtcTime: UTC.

Export 3: security-events.csv
Source: KZL-MUH07, log Security, parsed with EvtxECmd
Window (UTC): 2026-06-16 00:00:00 to 2026-06-16 13:00:00, start inclusive, end exclusive
Rows: 305
Column TimeCreated: UTC. Process creation auditing (4688) is not enabled on this workstation.
Column ElevatedToken: %%1842 = yes, %%1843 = no. A member of the local Administrators group receives two linked logon IDs at sign-in.

Export 4: defender-events.csv
Source: KZL-MUH07, log Microsoft-Windows-Windows Defender/Operational, parsed with EvtxECmd, filtered to event IDs 1116, 1117, 2000, 5001 and 5007
Rows: 8
Column TimeCreated: UTC.

Export 5: mail-gateway.csv
Source: the mail gateway MX-KZL01, message log, all messages to or from kuzeylojistik.example
Window (local time, UTC+3): 2026-06-16 07:30:00 to 2026-06-16 16:00:00
Rows: 264
Column time_local: local time of the gateway (UTC+3), the moment the message was accepted. It is not UTC.
Column verdict and action: the gateway's own classification at delivery time.

Export 6: OKU_BENI.txt
Copied from C:\Users\d.ercan\Desktop\OKU_BENI.txt. Content unchanged.

Not in this pack
The file server KZL-FS02 (192.0.2.20) and the share \\KZL-FS02\Muhasebe: not collected for this pack.
Memory: not collected; the workstation's network port was disabled at 10:27:00 UTC and it was shut down at 12:52 UTC before imaging.
The disk image Fatura_Haziran_2026.iso: still in Downloads (the tool did not encrypt it) but not part of this pack. Its SHA-256 is in mail-gateway.csv.