Social Media — Detection Telemetry

Collection and providers

Use platform-permitted collection; retain permalink, publication/retrieval times and provenance without collecting private accounts or credentials.

• Platform-permitted public-content exports: Public profiles/posts with provenance; availability depends on platform terms and access.
• Analyst-curated STIX repositories: Structured contextual observations with source and confidence, not privileged platform audit logs.

Configuration

• Define an approved public-content scope and the platform-permitted retrieval method. Do not access private accounts or bypass access controls.
• Retain publication time, collection time, source URL, account identifier and exact evidence provenance; redact unnecessary personal information.
• Record analyst confidence and alternative explanations. Keep acquired-account claims separate from evidence that the account was used in a specific intrusion.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0052",
  "collector": "illustrative-lab-collector",
  "observation": {
    "post_url": "https://example.test/posts/lab-1",
    "observed_at": "2026-09-27T12:00:00Z",
    "content_summary": "Fictional lab hiring notice",
    "confidence": "context_only"
  }
}

Visibility and validation

A public profile or post is context, not proof of operator identity, account compromise or victim access. The STIX reference describes representation, not a platform API entitlement.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• OASIS STIX 2.1 specification