{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0869.002","id":"T0869.002","name":"Publish/Subscribe Protocols","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0869/002","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"f48e5ea359602d0306e6857c2491988622bfbbde761a446f1461e6efa4a0a810","description":"Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and broker.\n\nProtocols such as MQTT are widely used in Internet-of-Things (IoT) and operational technology environments where devices are resource constrained and there is limited or unreliable network bandwidth. The protocol follows a publish/subscribe design, with message distribution managed by a centralized broker. Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics. An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also blending in with normal, expected traffic.\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0869/002","external_id":"T0869.002"}],"platforms":[],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":{"key":"ics/T0869","id":"T0869","name":"Standard Application Layer Protocol","domain":"ics","level":"technique","parent_id":null,"tactics":["command-and-control"],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"page":"techniques/ics/T0869/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required","ot_fixture_and_process_safety_review"],"telemetry_tags":["Network Connection Creation","Network Traffic Content","Network Traffic Flow"],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"detections":{"page":"detections/ics/T0869/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},"detection_status":"guidance_only","anomaly_tags":[],"tool_tags":[],"tool_references":[],"visibility":"source_mapped","telemetry_status":"mapped","classification":"cannot_simulate_yet","candidate_count":0,"implementation":"not_integrated","methods":[]},"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0869.002","id":"T0869.002","name":"Publish/Subscribe Protocols","domain":"ics","platforms":[],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0869/002","technique_page":"techniques/ics/T0869.002/","page":"detections/ics/T0869.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0935","name":"Behavioral Detection of Publish/Subscribe Protocol Misuse for Command and Control","url":"https://attack.mitre.org/detectionstrategies/DET0935","stix_id":"x-mitre-detection-strategy--6c7f2661-c4c3-40d6-ac41-2997bc069de9","relationship_id":"relationship--58f6af27-8f72-4630-a0d8-27753bc6a5df","description":"","analytics":[{"id":"AN2100","name":"Analytic 2100","guidance":"Real-time monitoring identifies a Windows ICS asset initiating MQTT/AMQP/DDS communications to a broker/service not approved for the asset role, from a process not associated with authorized vendor or telemetry software. Require both a communication-matrix violation and destination/process/protocol corroboration; suppress approved brokers, telemetry collectors, vendor applications, and maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2100","platforms":["Windows"],"tuning":[{"field":"ApprovedBrokers","description":"Authorized broker/service destinations"},{"field":"AuthorizedICSApplications","description":"Processes/services permitted to publish/subscribe"},{"field":"ApprovedTopics","description":"Expected topics/queues/domains where observable"},{"field":"ApprovedCommunicationMatrix","description":"Allowed source-to-broker relationships"},{"field":"ExpectedReportingInterval","description":"Expected telemetry/reporting cadence as corroboration"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3; process-to-broker connection","platforms":["Windows"],"analytic_id":"AN2100","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2100","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible","platforms":["Windows"],"analytic_id":"AN2100","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2100","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Client/broker connection metadata and periodicity","platforms":["Windows"],"analytic_id":"AN2100","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2100","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2101","name":"Analytic 2101","guidance":"Real-time monitoring identifies a Linux ICS service or process initiating MQTT/AMQP/DDS communications outside its approved broker/client relationship or from an unauthorized runtime/tool. Require communication-matrix violation plus process/destination/protocol corroboration; suppress approved telemetry, historian, gateway, vendor, and maintenance activity.","url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2101","platforms":["Linux"],"tuning":[{"field":"ApprovedBrokers","description":"Authorized brokers/services"},{"field":"AuthorizedICSApplications","description":"Approved client processes/services"},{"field":"ApprovedTopics","description":"Expected topics/queues where observable"},{"field":"ApprovedCommunicationMatrix","description":"Allowed client/broker relationships"},{"field":"ExpectedReportingInterval","description":"Expected telemetry cadence"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"linux:osquery","channel":"socket_events to broker/service, where deployed","platforms":["Linux"],"analytic_id":"AN2101","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2101","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"MQTT/AMQP/DDS protocol and message metadata when visible","platforms":["Linux"],"analytic_id":"AN2101","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2101","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Client/broker flow metadata","platforms":["Linux"],"analytic_id":"AN2101","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2101","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2102","name":"Analytic 2102","guidance":"Real-time monitoring identifies MQTT/AMQP/DDS sessions crossing an unexpected zone boundary, connecting an ICS client to an unapproved broker/service, or using client/topic/message behavior inconsistent with the documented pub/sub architecture. Require topology/identity/topic/destination violation; periodicity alone is not sufficient.","url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2102","platforms":["Network Devices"],"tuning":[{"field":"ApprovedBrokers","description":"Broker IP/FQDN/service inventory"},{"field":"ApprovedClientIDs","description":"Expected MQTT/AMQP client identities where observable"},{"field":"ApprovedTopics","description":"Expected publish/subscribe topic namespaces"},{"field":"ApprovedCommunicationMatrix","description":"Allowed zone/client/broker relationships"},{"field":"TLSProfile","description":"Expected encrypted/unencrypted protocol use and certificate identities"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable","platforms":["Network Devices"],"analytic_id":"AN2102","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2102","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Source/destination/port/session metadata","platforms":["Network Devices"],"analytic_id":"AN2102","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2102","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NetworkDevice:Syslog","channel":"Permitted/denied connection creation where network devices record it","platforms":["Network Devices"],"analytic_id":"AN2102","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2102","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN2103","name":"Analytic 2103","guidance":"Real-time monitoring identifies an embedded OT/IoT device establishing MQTT/AMQP/DDS communication with a broker/service outside its device-specific profile, using an unexpected client identity/topic, or crossing an unauthorized zone boundary. Fixed-function device behavior should be compared to the documented broker/topic/destination profile rather than a generic anomaly threshold.","url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2103","platforms":["Embedded"],"tuning":[{"field":"DeviceBrokerProfile","description":"Expected broker(s) for each device/model/site"},{"field":"ApprovedClientIDs","description":"Expected client identity/certificate where observable"},{"field":"ApprovedTopics","description":"Expected publish/subscribe topic namespace"},{"field":"ApprovedCommunicationMatrix","description":"Expected telemetry cadence used only as corroboration"},{"field":"ExpectedReportingInterval","description":"Expected telemetry cadence used only as corroboration"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"Pub/sub protocol, client ID, topic/queue and message metadata when observable","platforms":["Embedded"],"analytic_id":"AN2103","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2103","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Device-to-broker flow metadata","platforms":["Embedded"],"analytic_id":"AN2103","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2103","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Connections","channel":"New device-to-broker relationship outside documented profile","platforms":["Embedded"],"analytic_id":"AN2103","source_url":"https://attack.mitre.org/detectionstrategies/DET0935#AN2103","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL connects to C2 servers using the MQTT protocol over port 1883 and 8883 (encrypted via SSL/TLS). The command-and-control servers are resolved using DNS-over-HTTPS (DoH).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)","relationship_id":"relationship--eb7f4859-4173-42e5-811c-b3df217b7d72","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Dragos 2025 Year in Review","description":"Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.","url":"https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"},{"source_name":"Armis-IOCONTROL","description":"Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.","url":"https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"}]}],"actors":[],"mitigations":[{"id":"M0931","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M0931","kind":"course-of-action","description":"Use protocol-aware network controls to detect and, where operationally safe, prevent connections to unapproved brokers or malicious infrastructure and misuse of publish/subscribe protocol features for command-and-control.","relationship_id":"relationship--e359049e-0a1f-4877-8114-ac40b8c8d4fd","references":[]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Restrict MQTT, AMQP, DDS, and other publish/subscribe traffic to approved brokers, peers, ports, topics, namespaces, and security zones. Block unauthorized external broker access while preserving documented IIoT/OT messaging paths.","relationship_id":"relationship--2b2871ae-e8e6-429e-b9e3-91852d1c5cb8","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0869.002":"/ttp-simulation/techniques/ics/T0869.002/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0869.002","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}