# Fictional SOC evidence packet

Teaching data only. All times are UTC on one fictional exercise day. These editorial columns are not vendor fields. Scope: dedicated account, one permitted authentication attempt and an employee report; no access or containment test.

Review window: 14:00–14:30 UTC.

Acceptance criteria:
- Source event available within 2 minutes of its source time.
- Alert delivered to security within 3 minutes of the source event time.
- Human report acknowledged within 5 minutes of submission.

Calculations:
- C-1 minus S-1 = 3 minutes: misses the collection target by 1 minute.
- A-1 minus C-1 = 15 seconds.
- Q-1 minus A-1 = 10 seconds, but the destination is the wrong queue.
- H-3 minus H-1 = 3 minutes: meets the human-report target.
- Alert delivery to security is not established in the review window. Do not invent a latency value. T-1 correlation does not repair routing.

Before reuse, replace invented records, preserve source times and timezones, document clock uncertainty, and verify actual identifier relationships. Record the expected source, collection owner, rule version, intended queue, acknowledgment criterion, permissions and retention, test exceptions, and staffing. Keep sensitive evidence in approved storage and retain references only.

Positive control: approved event meeting the selected rule condition.
Ordinary control: approved event outside that condition.
Human-route control: ordinary support request, assessed through its appropriate triage path.
These are planned checks, not outcomes supplied in the CSV.

Finding: Route ___; stage ___; result ___; evidence ___; unresolved question ___; owner ___; comparable retest ___ .