ZEKASTRA case pack VP-08 - acquisition log - SYNTHETIC TRAINING DATA

Case: Lodos Lojistik A.S. - access key found in a public repository - internal reference LDS-2026-031
Collected by: incident response examiner, role arn:aws:iam::111122223333:role/ir-readonly (SecurityAudit and ReadOnlyAccess managed policies)
All times UTC unless stated.

2026-08-08 06:20  The notice gizli-anahtar-uyarisi.txt is read by the IT team (received overnight).
2026-08-08 08:15  Incident opened. Examiner assumes ir-readonly.
2026-08-08 08:40  IAM credential report generated and downloaded (iam-credential-report.csv).
2026-08-08 08:52  CloudTrail log files for the window downloaded from the trail bucket.
2026-08-08 09:00  S3 server access log objects for both buckets downloaded from lodos-erisim-gunlukleri.
2026-08-08 09:05  Containment by a.yildiz: both access keys of ci-deploy set Inactive; the bucket policy of lodos-yedek-paylasim deleted; Block Public Access re-enabled; sessions of lodos-data-ops revoked. These actions fall after the window and are not in the exports.
2026-08-08 09:30  Hashes computed for every file and written to manifest.txt.

The CI pipeline's runner uses the fixed address 192.0.2.40. Office addresses are in 192.0.2.0/24. The customer portal reaches S3 through the VPC endpoint vpce-0a1b2c3d4e5f60718 from 10.20.4.15.