{
 "scenario": "KC-04",
 "scenario_version": "1.0",
 "note": "SPECIMEN inputs. Every organisation, person, number and document is invented for testing.",
 "files": [
  {
   "name": "backup-console-log.csv",
   "content": "SPECIMEN,backup console log,Tallowood Freight (invented)\ntime,account,account_type,action,target\n2026-09-07T01:52+10:00,adm-tallow,privileged (domain administrator),sign in,backup console\n2026-09-07T01:55+10:00,adm-tallow,privileged (domain administrator),delete,all backup sets (retention 30 days)\n2026-09-07T01:56+10:00,adm-tallow,privileged (domain administrator),disable,backup schedule\n"
  },
  {
   "name": "incident-response-plan.md",
   "content": "SPECIMEN. Invented organisation, invented plan, for testing only.\n# Tallowood Freight: Incident Response Plan (IRP), version 2\nIRP-5 The incident assistant drafts every regulator report and keeps the incident record.\nIRP-6 The chief financial officer lodges any ransomware payment report; the incident assistant drafts it.\n"
  },
  {
   "name": "incident-timeline.csv",
   "content": "SPECIMEN,incident timeline,Tallowood Freight (invented)\nwhen,event\n2026-09-07T02:10+10:00,File servers encrypted; ransom note demands the equivalent of AUD 450000 for a decryption key, payable through a channel named in the note\n2026-09-07T02:40+10:00,Backup console shows every backup set deleted at 01:55 by the domain administrator account adm-tallow (a privileged account)\n2026-09-08T09:00+10:00,Incident response firm engaged; negotiation intermediary appointed\n2026-09-09T17:00+10:00,Board approves a payment if the price is reduced\n2026-09-10T13:05+10:00,Negotiation intermediary pays the equivalent of AUD 310000 on Tallowood's behalf after two days of negotiation by message\n2026-09-10T16:20+10:00,Chief financial officer is told by email that the payment was made\n2026-09-11T09:00+10:00,The CFO asks the incident assistant to work through the reporting chain\n"
  },
  {
   "name": "org-profile.csv",
   "content": "SPECIMEN,organisation profile,Tallowood Freight (invented)\nfield,value\nentity,Tallowood Freight Pty Ltd (SPECIMEN)\nbusiness,Road freight and warehousing in Australia\nannual_turnover_previous_financial_year_aud,18200000\ncritical_infrastructure_responsible_entity,no\nabn,00 000 000 000 (SPECIMEN)\nessential_eight_target_maturity,Maturity Level Two\n"
  }
 ]
}