ZEKASTRA case pack VP-07 - export metadata - SYNTHETIC TRAINING DATA
Tenant: akyeltekstil.example (Microsoft 365 E5; Audit (Premium); MailItemsAccessed enabled by default for the licence).
All four cloud exports cover the same window.
Window (UTC): 2026-07-06 00:00:00 to 2026-07-10 00:00:00, start inclusive, end exclusive

Export 1: ual-export.csv
Source: Microsoft Purview portal, Audit, Search; all users; all activities; result exported to CSV.
Rows: 935
Column CreationDate: UTC. Inside AuditData, CreationTime is UTC too, written without a zone letter.
Column AuditData: the full audit record as JSON. MailItemsAccessed: MailAccessType Bind lists each message by InternetMessageId; binds within a two-minute interval are aggregated into one record (OperationCount); Sync names a folder, not the messages, and is recorded only for desktop Outlook.
Column RecordType: the record type name. Inbox rule actions (moving a message) are not audited; only the rule's creation is.

Export 2: entra-signins.csv
Source: Microsoft Entra admin center, Sign-in logs; "User sign-ins (interactive)" and "User sign-ins (non-interactive)" downloaded as CSV for all users; the two files were concatenated by the examiner, who added the column Sign-in type from the name of the source file. No other change.
Rows: 500
Column Date (UTC): UTC.
Column Autonomous system number: as reported by the service for the IP address. Location is derived from the IP address and is approximate.

Export 3: message-trace.csv
Source: Exchange Online message trace for all senders and recipients in the window, exported to CSV.
Rows: 403
Column Received: UTC.

Export 4: iban-degisikligi.eml
The message as Delta Perakende A.S. received it, forwarded to Akyel Tekstil on 2026-07-13 as an attachment and saved unchanged. The PDF attachment was removed by the customer before forwarding. Received headers added by the customer's servers are in their local time (+0300).

Export 5: odeme-dekontu.txt
Text copy of the customer's bank receipt. Times are the bank's local time (UTC+3), with no zone written.

Not in this pack
The phishing page, the proxy at 198.51.100.23 and the host at 203.0.113.77: not available. Whois and hosting records were not requested for this pack.
The mailboxes of b.aslan and m.demir: only their audit, sign-in and trace records in this window are included.
The customers' own logs other than the forwarded message and the receipt.