{ "description": "Actual DataCannon output from a bounded fictional four-asset water-treatment scenario. No external destination or AI provider was called.", "seed": 42, "timeline": { "start": "2026-10-18T09:00:00Z", "end": "2026-10-18T09:05:00Z", "event_density": "low" }, "assets": 4, "totalEvents": 912, "injectedAnomalyTypes": [ "plc_logic_modification" ], "sampleEvents": [ { "t": "2026-10-18T09:00:00.000Z", "event_type": "device_added", "asset_id": "sensor_field_001", "new_value": { "type": "sensor", "zone": "field", "vendor": "Yokogawa", "ip": "10.0.1.2" }, "schema_version": "1.0", "event_id": "evt_r3tinfyswjn5_000000", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:00:00.000Z", "event_type": "device_added", "asset_id": "plc_control_001", "new_value": { "type": "plc", "zone": "control", "vendor": "Siemens", "ip": "10.10.1.2" }, "schema_version": "1.0", "event_id": "evt_r3ti9euw2hmm_000001", "severity": "informational", "contexts": { "host": { "host_id": "plc_control_001", "hostname": "plc-control-001.corp.example", "zone": "control", "ip": "10.10.1.2", "mac": "00:0E:8C:32:80:AF" }, "device": { "device_id": "plc_control_001", "type": "plc" } } }, { "t": "2026-10-18T09:02:30.000Z", "event_type": "plc_mode_change", "asset_id": "sensor_field_001", "new_value": { "old_mode": "RUN", "new_mode": "PROGRAM", "unauthorized": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3szjr6mxcxjk4_0000cm", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:02:33.033Z", "event_type": "plc_logic_upload", "asset_id": "sensor_field_001", "new_value": { "block_type": "DB1", "size_bytes": 1949, "hash_changed": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3t0bbh1li7uv3_0000cw", "severity": "high", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:02:47.900Z", "event_type": "plc_mode_change", "asset_id": "sensor_field_001", "new_value": { "old_mode": "PROGRAM", "new_mode": "RUN", "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3ozizw1p5tdvn_0000e6", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:02:50.000Z", "event_type": "process_value_change", "asset_id": "sensor_field_001", "new_value": { "register": "HR0", "value": 58757, "out_of_range": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3ozj1u78pznya_0000ed", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:02:57.284Z", "event_type": "process_value_change", "asset_id": "sensor_field_001", "new_value": { "register": "HR20", "value": 4849, "out_of_range": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3p0avvdmo5dmg_0000f2", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:03:05.408Z", "event_type": "process_value_change", "asset_id": "sensor_field_001", "new_value": { "register": "HR41", "value": 10123, "out_of_range": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3ozrd5up72l7d_0000fr", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:03:05.648Z", "event_type": "process_value_change", "asset_id": "sensor_field_001", "new_value": { "register": "HR91", "value": 58780, "out_of_range": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3ozrgo4oel3c4_0000fs", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } }, { "t": "2026-10-18T09:03:08.969Z", "event_type": "process_value_change", "asset_id": "sensor_field_001", "new_value": { "register": "HR39", "value": 22102, "out_of_range": true, "anomaly": true, "mitre_attack": { "technique": "T0833", "tactic": "TA0104", "technique_name": "Modify Controller Tasking", "tactic_name": "Impair Process Control" } }, "schema_version": "1.0", "event_id": "evt_3p0187wp3jijx_0000g2", "severity": "informational", "contexts": { "host": { "host_id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, "device": { "device_id": "sensor_field_001", "type": "sensor" } } } ], "groundTruth": { "scenario": "website-water-plant", "generatedAt": "2026-10-18T09:05:00.000Z", "anomalies": [ { "type": "plc_logic_modification", "injectedAt": "2026-10-18T09:02:30.000Z", "assetsInvolved": [ "sensor_field_001" ], "edgesAdded": [], "expectedDetection": { "plc_reprogramming": true, "unauthorized_mode_change": true, "logic_integrity_violation": true }, "eventIds": [ "evt_3szjr6mxcxjk4_0000cm", "evt_3t0bbh1li7uv3_0000cw", "evt_3ozizw1p5tdvn_0000e6", "evt_3ozj1u78pznya_0000ed", "evt_3p0avvdmo5dmg_0000f2", "evt_3ozrd5up72l7d_0000fr", "evt_3p0187wp3jijx_0000g2", "evt_3ozrgo4oel3c4_0000fs" ], "identityIds": [], "sessionIds": [], "attackMapping": { "techniqueId": "T0833", "techniqueName": "Modify Controller Tasking", "tacticIds": [ "TA0104" ], "tacticNames": [ "Impair Process Control" ] }, "domain": "ot" } ], "stats": { "totalAnomalies": 1, "totalEventsInjected": 8, "totalAssetsAffected": 1, "totalEdgesAdded": 0, "typeBreakdown": { "plc_logic_modification": 1 }, "attackTechniquesCovered": [ "T0833" ], "attackTacticsCovered": [ "TA0104" ], "domainsCovered": [ "ot" ], "pivotsDetected": 0 }, "entityRegistry": { "assets": [ { "id": "sensor_field_001", "hostname": "sensor-field-001.corp.example", "type": "sensor", "zone": "field", "ip": "10.0.1.2", "mac": "00:A0:69:86:45:9F" }, { "id": "plc_control_001", "hostname": "plc-control-001.corp.example", "type": "plc", "zone": "control", "ip": "10.10.1.2", "mac": "00:0E:8C:32:80:AF" }, { "id": "hmi_supervisory_001", "hostname": "hmi-supervisory-001.corp.example", "type": "hmi", "zone": "supervisory", "ip": "10.20.1.2", "mac": "00:00:00:CF:51:73" }, { "id": "historian_supervisory_001", "hostname": "historian-supervisory-001.corp.example", "type": "historian", "zone": "supervisory", "ip": "10.20.1.3", "mac": "00:00:00:35:4D:BD" } ], "identities": [ { "id": "linda.gutierrez", "username": "linda.gutierrez", "display_name": "Linda Gutierrez", "identity_type": "human", "department": "Operations", "groups": [ "Domain Users", "Operations", "Domain Admins", "IT-Ops" ], "host_id": "hmi_supervisory_001", "ip": "10.20.1.2", "zone": "supervisory", "is_admin": true, "is_vpn": false }, { "id": "maintenance_team", "username": "maintenance_team", "display_name": "Maintenance Team", "identity_type": "service", "groups": [ "Service Accounts" ], "host_id": "sensor_field_001", "ip": "10.0.1.2", "zone": "field", "is_admin": false, "is_vpn": false }, { "id": "network_engineer", "username": "network_engineer", "display_name": "Network Engineering", "identity_type": "service", "groups": [ "Service Accounts" ], "host_id": "sensor_field_001", "ip": "10.0.1.2", "zone": "field", "is_admin": false, "is_vpn": false }, { "id": "operations", "username": "operations", "display_name": "Operations Service", "identity_type": "service", "groups": [ "Service Accounts" ], "host_id": "sensor_field_001", "ip": "10.0.1.2", "zone": "field", "is_admin": false, "is_vpn": false }, { "id": "control_engineer", "username": "control_engineer", "display_name": "Control Engineering", "identity_type": "service", "groups": [ "Service Accounts" ], "host_id": "sensor_field_001", "ip": "10.0.1.2", "zone": "field", "is_admin": false, "is_vpn": false }, { "id": "security_team", "username": "security_team", "display_name": "Security Operations", "identity_type": "service", "groups": [ "Service Accounts" ], "host_id": "sensor_field_001", "ip": "10.0.1.2", "zone": "field", "is_admin": false, "is_vpn": false } ], "sessions": [] } } }