ZEKASTRA case pack VP-08 - export metadata - SYNTHETIC TRAINING DATA
AWS account: 111122223333 (Lodos Lojistik A.S.). Home region: eu-central-1. The account number is from the AWS documentation range.
Window (UTC): 2026-08-06 00:00:00 to 2026-08-08 09:00:00, start inclusive, end exclusive. Containment began at 09:05 UTC (acquisition-log.txt).

Export 1: cloudtrail-events.jsonl
Source: trail lodos-org-trail (multi-region), delivered to s3://lodos-cloudtrail-111122223333/AWSLogs/111122223333/CloudTrail/. The .json.gz log files for every region covering the window were downloaded, decompressed, the Records arrays flattened to one JSON object per line and sorted by eventTime. Session tokens were replaced by the examiner with SYNTHETIC-REDACTED. No other change.
Rows: 1651
Field eventTime: UTC, written with Z.
Management events: read and write, all regions. Data events: Amazon S3 read and write for arn:aws:s3:::lodos-musteri-arsiv/ ONLY. No data events are recorded for any other bucket.
Field responseElements.credentials.expiration (AssumeRole) and accessKey.createDate (CreateAccessKey): UTC written as "Mon D, YYYY, h:mm:ss AM/PM", with no zone.
Global services (IAM) are recorded in us-east-1.

Export 2: s3-access-logs.log
Source: Amazon S3 server access logging for lodos-musteri-arsiv and lodos-yedek-paylasim, both delivered to s3://lodos-erisim-gunlukleri/. All log objects for the window were downloaded and concatenated; records sorted by time. Space-delimited; quoted fields keep their quotes.
Rows: 1021
Field time: [DD/Mon/YYYY:HH:MM:SS +0000], UTC.
Field requester: the IAM principal, or "-" for an unauthenticated request. Field authentication_type: AuthHeader, QueryString (presigned URL) or "-".
Server access logging is delivered on a best-effort basis; a request can be missing from it. Use CloudTrail for the bucket where both exist.

Export 3: iam-credential-report.csv
Source: IAM credential report generated at 2026-08-08T08:40:12+00:00 (before containment), downloaded as CSV.
Rows: 7
Times: ISO 8601, +00:00.

Export 4: gizli-anahtar-uyarisi.txt
The code host's notice e-mail, saved as text. Times are the code host account's local time (Europe/Istanbul, UTC+3), with no zone written next to them.

Not in this pack
The public repository and its history; the hosts at 203.0.113.50, 203.0.113.51 and the downloading addresses; VPC flow logs; the contents of any object.