{
  "dataset": "corrobore-temporal-northwind",
  "version": "1.0.0",
  "description": "Synthetic supply-chain compromise timeline. Validity is stored as day offsets so the notebook can materialize past, current and future intervals relative to the moment it runs.",
  "license": "CC0-1.0",
  "generated_by": "corrobore-website/usecases/temporal.mjs",
  "facts": {
    "closed_intervals": 4,
    "open_intervals": 9,
    "future_intervals": 1,
    "late_arriving_evidence": "obs--forensic-image"
  },
  "temporal_offsets": {
    "case--nw-supply": {
      "valid_from_days": -21,
      "valid_until_days": null
    },
    "supplier--northwind": {
      "valid_from_days": -400,
      "valid_until_days": null
    },
    "assessment--access-legitimate": {
      "valid_from_days": -21,
      "valid_until_days": -6
    },
    "assessment--access-compromised": {
      "valid_from_days": -14,
      "valid_until_days": null
    },
    "contract--renewal": {
      "valid_from_days": 20,
      "valid_until_days": null
    },
    "window--anomalous-push": {
      "valid_from_days": -14,
      "valid_until_days": -12
    },
    "window--credential-rotation": {
      "valid_from_days": -6,
      "valid_until_days": -5
    },
    "obs--pipeline-push": {
      "valid_from_days": -14,
      "valid_until_days": null,
      "observed_at_days": -14
    },
    "obs--badge-absent": {
      "valid_from_days": -14,
      "valid_until_days": null,
      "observed_at_days": -13
    },
    "obs--vpn-session": {
      "valid_from_days": -14,
      "valid_until_days": -12,
      "observed_at_days": -12
    },
    "obs--edr-quiet": {
      "valid_from_days": -14,
      "valid_until_days": null,
      "observed_at_days": -11
    },
    "obs--supplier-denial": {
      "valid_from_days": -10,
      "valid_until_days": null,
      "observed_at_days": -10
    },
    "obs--forensic-image": {
      "valid_from_days": -14,
      "valid_until_days": null,
      "observed_at_days": -4
    },
    "obs--maintenance-notice": {
      "valid_from_days": -21,
      "valid_until_days": -15,
      "observed_at_days": -21
    }
  },
  "memories": [
    {
      "identity_key": "case--nw-supply",
      "kind": "investigation.case",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Investigation into a suspected credential compromise at the Northwind Components integration.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "case--nw-supply#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "case"
      ]
    },
    {
      "identity_key": "supplier--northwind",
      "kind": "supply.party",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Northwind Components, third-party integrator holding a service account on the deployment pipeline.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "supplier--northwind#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "supplier"
      ]
    },
    {
      "identity_key": "assessment--access-legitimate",
      "kind": "supply.assessment",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Assessment: the Northwind service account activity is legitimate integration traffic.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "assessment--access-legitimate#record",
          "observed_at": null
        }
      ],
      "confidence": 0.72,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "assessment"
      ]
    },
    {
      "identity_key": "assessment--access-compromised",
      "kind": "supply.assessment",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Assessment: the Northwind service account was under attacker control, retroactively from the first anomalous push.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "assessment--access-compromised#record",
          "observed_at": null
        }
      ],
      "confidence": 0.81,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "assessment"
      ]
    },
    {
      "identity_key": "contract--renewal",
      "kind": "supply.contract",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Scheduled renewal of the Northwind integration contract, not yet in force.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "contract--renewal#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "contract"
      ]
    },
    {
      "identity_key": "window--anomalous-push",
      "kind": "supply.window",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Anomalous deployment pushes from the Northwind service account outside the agreed maintenance window.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "window--anomalous-push#record",
          "observed_at": null
        }
      ],
      "confidence": 0.9,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "window"
      ]
    },
    {
      "identity_key": "window--credential-rotation",
      "kind": "supply.window",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Emergency credential rotation window for every Northwind-held secret.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "window--credential-rotation#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "window"
      ]
    },
    {
      "identity_key": "obs--pipeline-push",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Deployment pipeline accepted a signed artifact pushed by the Northwind service account at 02:14 local time.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "pipeline-audit",
          "locator": "build#4471",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    },
    {
      "identity_key": "obs--badge-absent",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "No Northwind engineer badged into site B during the push window.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "badge-system",
          "locator": "site-b#dump",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    },
    {
      "identity_key": "obs--vpn-session",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Northwind service account VPN session originating from an autonomous system the supplier does not use.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "vpn-concentrator",
          "locator": "session#88213",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    },
    {
      "identity_key": "obs--edr-quiet",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Endpoint telemetry on the build host shows no operator process during the push.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "edr",
          "locator": "host#build-03",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    },
    {
      "identity_key": "obs--supplier-denial",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Northwind states no engineer performed a deployment during the window.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "supplier-statement",
          "locator": "email#2291",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    },
    {
      "identity_key": "obs--forensic-image",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Disk image of the build host, acquired ten days after the push, confirms an unattended credential replay.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "image#build-03",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    },
    {
      "identity_key": "obs--maintenance-notice",
      "kind": "supply.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Northwind maintenance notice covering an earlier, unrelated window.",
          "properties": {
            "subject": "Northwind Components"
          }
        }
      },
      "provenance": [
        {
          "source_id": "supplier-portal",
          "locator": "notice#77",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "northwind",
        "observation"
      ]
    }
  ],
  "relationships": [
    {
      "identity_key": "rel--obs--pipeline-push",
      "source_key": "obs--pipeline-push",
      "target_key": "assessment--access-compromised",
      "kind": "supports",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "pipeline-audit",
          "locator": "build#4471",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--obs--badge-absent",
      "source_key": "obs--badge-absent",
      "target_key": "assessment--access-compromised",
      "kind": "supports",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "badge-system",
          "locator": "site-b#dump",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--obs--vpn-session",
      "source_key": "obs--vpn-session",
      "target_key": "assessment--access-compromised",
      "kind": "supports",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "vpn-concentrator",
          "locator": "session#88213",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--obs--edr-quiet",
      "source_key": "obs--edr-quiet",
      "target_key": "assessment--access-compromised",
      "kind": "supports",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "edr",
          "locator": "host#build-03",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--obs--supplier-denial",
      "source_key": "obs--supplier-denial",
      "target_key": "assessment--access-legitimate",
      "kind": "challenges",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "supplier-statement",
          "locator": "email#2291",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--obs--forensic-image",
      "source_key": "obs--forensic-image",
      "target_key": "assessment--access-compromised",
      "kind": "supports",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "image#build-03",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--obs--maintenance-notice",
      "source_key": "obs--maintenance-notice",
      "target_key": "assessment--access-legitimate",
      "kind": "supports",
      "properties": {
        "weight": "primary"
      },
      "provenance": [
        {
          "source_id": "supplier-portal",
          "locator": "notice#77",
          "observed_at": null
        }
      ],
      "confidence": 0.8,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-assessment--access-legitimate",
      "source_key": "case--nw-supply",
      "target_key": "assessment--access-legitimate",
      "kind": "covers",
      "properties": {},
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "scope#assessment--access-legitimate",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-assessment--access-compromised",
      "source_key": "case--nw-supply",
      "target_key": "assessment--access-compromised",
      "kind": "covers",
      "properties": {},
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "scope#assessment--access-compromised",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-contract--renewal",
      "source_key": "case--nw-supply",
      "target_key": "contract--renewal",
      "kind": "covers",
      "properties": {},
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "scope#contract--renewal",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-window--anomalous-push",
      "source_key": "case--nw-supply",
      "target_key": "window--anomalous-push",
      "kind": "covers",
      "properties": {},
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "scope#window--anomalous-push",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-window--credential-rotation",
      "source_key": "case--nw-supply",
      "target_key": "window--credential-rotation",
      "kind": "covers",
      "properties": {},
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "scope#window--credential-rotation",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-supplier",
      "source_key": "case--nw-supply",
      "target_key": "supplier--northwind",
      "kind": "concerns",
      "properties": {},
      "provenance": [
        {
          "source_id": "case-file--nw",
          "locator": "scope#supplier",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    }
  ]
}