ZEKASTRA case pack VP-09 - export metadata - SYNTHETIC TRAINING DATA
Organisation: Poyraz Muhendislik A.S. (domain poyraz.example, NetBIOS POYRAZ). Workstation ARGE-WS14 (10.40.8.14), user POYRAZ\e.demir.
Window (UTC): 2026-08-17 00:00:00 to 2026-09-16 12:00:00, start inclusive, end exclusive. The workstation's Windows time zone is Turkey Standard Time (UTC+3).

Export 1: security-events.csv
Source: Security.evtx from ARGE-WS14, parsed with an EVTX parser; logon, logoff, lock and unlock events kept. Rows: 241. TimeCreated: UTC.
Export 2: partition-diagnostic.csv
Source: Microsoft-Windows-Partition/Diagnostic.evtx from ARGE-WS14, event 1006. Rows: 8. TimeCreated: UTC. Capacity 0 marks removal.
Export 3: lnk-files.csv
Source: the user's Recent folder, parsed with a shortcut (LNK) parser. Rows: 27. All times UTC. VolumeSerialNumber and VolumeLabel are those of the volume the target was on when the shortcut was last written.
Export 4: shellbags.csv
Source: the user's UsrClass.dat, parsed with a ShellBags parser. Rows: 26. All times UTC. FirstInteracted and LastInteracted come from the BagMRU key's last write time and MRU order; they record folder browsing in Explorer, not file copies. A drive letter is recorded, not the device behind it.
Export 5: proxy-log.csv
Source: the web proxy (TLS inspection on), filtered on client 10.40.8.14. Rows: 1539. time_utc: UTC. bytes_out is client to server.
Export 6: print-log.csv
Source: Microsoft-Windows-PrintService/Operational.evtx from PRN01.poyraz.example, event 307 (document printed), all users. Rows: 240. TimeCreated: UTC. The event records the document name, owner, client, printer, size and page count; it does not keep the document's content.
Export 7: vpn-sessions.csv
Source: the VPN appliance's session report, exported as CSV from its administration console, all users. Rows: 397.
start_local and end_local: the appliance's LOCAL time (Europe/Istanbul, UTC+3), written DD.MM.YYYY HH:MM:SS with no zone. Convert before comparing with any other export.
bytes_from_client and bytes_to_client: bytes sent by and to the remote computer through the tunnel. assigned_ip: the tunnel address inside the company network (pool 10.99.0.0/16).
Export 8: ik-kaydi.txt
The HR exit record, as text. Local time (UTC+3), no zone written.

Not in this pack
The file server's own access logs; the contents of the USB stick, the personal cloud account or the printed pages; the user's home computer; e-mail.