{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1207","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0084","collector":"illustrative-lab-collector","observation":{"account":"lab-user","service_principal":"cifs/lab-server.example.test","request_type":"service_ticket","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0087","collector":"illustrative-lab-collector","observation":{"object_guid":"lab-object-2","object_class":"group","object_dn":"CN=LabReaders,OU=Lab,DC=example,DC=test","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}}]}