# Sample Data Spec

## 目标

这个文档定义 SOC Memory POC 在无真实数据阶段使用的 mock 数据格式，用于：

- 验证 ingestion pipeline
- 验证标准化脚本
- 验证 context retrieval
- 验证 case summary 与 memory commit 流程

当前只覆盖两类场景：

- 钓鱼邮件
- O365 异常登录 / 疑似账号被盗

## 目录约定

```text
evaluation/datasets/
├── mock_cases/
│   ├── phishing/
│   └── o365_suspicious_login/
└── mock_kb/
    ├── playbooks/
    ├── kb/
    └── reports/
```

## Mock Case 原始格式

每个 case 使用一个 JSON 文件，文件名建议：

```text
<case_id>.json
```

### 字段定义

| 字段 | 类型 | 必填 | 说明 |
|---|---|---:|---|
| `case_id` | string | 是 | case 唯一 ID |
| `title` | string | 是 | 简短标题 |
| `scenario` | string | 是 | `phishing` 或 `o365_suspicious_login` |
| `alert_type` | string | 是 | 告警类型 |
| `severity` | string | 是 | `low` / `medium` / `high` / `critical` |
| `status` | string | 是 | `confirmed` / `false_positive` / `pending` |
| `time_window` | object | 是 | 开始和结束时间 |
| `summary` | string | 是 | 一句话摘要 |
| `alert_source` | string | 是 | 告警来源系统 |
| `entities` | object | 是 | 关键实体 |
| `observables` | object | 否 | IOC/可观测对象 |
| `evidence` | array | 是 | 关键证据列表 |
| `investigation_steps` | array | 是 | 关键调查步骤 |
| `conclusion` | object | 是 | 研判结论 |
| `related_refs` | object | 否 | 相关 KB / playbook / case |
| `lessons_learned` | array | 否 | 复用经验 |
| `tags` | array | 否 | 标签 |

### 示例骨架

```json
{
  "case_id": "CASE-2026-0001",
  "title": "Potential phishing email targeting finance user",
  "scenario": "phishing",
  "alert_type": "mail_suspicious_attachment",
  "severity": "high",
  "status": "confirmed",
  "time_window": {
    "start": "2026-04-01T09:10:00+08:00",
    "end": "2026-04-01T11:30:00+08:00"
  },
  "summary": "Finance user received an invoice-themed phishing email with a malicious HTML attachment.",
  "alert_source": "Secure Email Gateway",
  "entities": {
    "users": ["alice@corp.example"],
    "hosts": ["FIN-LAPTOP-12"],
    "mailboxes": ["alice@corp.example"]
  },
  "observables": {
    "sender_emails": ["billing@vendor-payments.com"],
    "domains": ["vendor-payments.com"],
    "urls": ["https://vendor-payments-login.com/review"],
    "hashes": ["sha256:..."],
    "ips": ["198.51.100.20"]
  },
  "evidence": [
    "The sender domain was newly observed and failed DMARC.",
    "The attachment redirected the user to a credential harvesting page."
  ],
  "investigation_steps": [
    "Validate sender reputation and authentication results.",
    "Detonate attachment in sandbox.",
    "Check click telemetry and account sign-in logs."
  ],
  "conclusion": {
    "verdict": "true_positive",
    "reason": "Multiple aligned phishing indicators and confirmed click behavior.",
    "recommended_actions": [
      "Reset the impacted account password.",
      "Block the sender domain and landing URL."
    ]
  },
  "related_refs": {
    "playbooks": ["PB-PHISH-001"],
    "kb": ["KB-PHISH-HEADER-CHECK"],
    "cases": []
  },
  "lessons_learned": [
    "Invoice-themed phishing remains effective against finance users."
  ],
  "tags": ["phishing", "email", "credential-harvest"]
}
```

## Mock KB / Playbook 原始格式

每个知识条目使用一个 JSON 文件，文件名建议：

```text
<doc_id>.json
```

### 字段定义

| 字段 | 类型 | 必填 | 说明 |
|---|---|---:|---|
| `doc_id` | string | 是 | 文档唯一 ID |
| `doc_type` | string | 是 | `kb` / `playbook` / `report_summary` |
| `title` | string | 是 | 标题 |
| `scenario` | string | 是 | 适用场景 |
| `summary` | string | 是 | 核心摘要 |
| `applicability` | array | 否 | 适用条件 |
| `key_points` | array | 是 | 核心知识点 |
| `investigation_guidance` | array | 否 | 调查建议 |
| `decision_points` | array | 否 | 判定关键点 |
| `related_entities` | object | 否 | 相关实体/TTP/IOC |
| `related_refs` | object | 否 | 相关文档 |
| `tags` | array | 否 | 标签 |
| `updated_at` | string | 否 | 更新时间 |

## 标准化输出目标

### 标准化后的 Case 结构

标准化脚本输出建议字段：

- `id`
- `memory_type` = `case`
- `scenario`
- `title`
- `abstract`
- `verdict`
- `severity`
- `entities`
- `observables`
- `evidence`
- `patterns`
- `related_refs`
- `source_path`
- `tags`

### 标准化后的 KB 结构

标准化脚本输出建议字段：

- `id`
- `memory_type` = `knowledge`
- `doc_type`
- `scenario`
- `title`
- `abstract`
- `key_points`
- `investigation_guidance`
- `decision_points`
- `related_refs`
- `source_path`
- `tags`

## 检索测试建议

在 mock 数据阶段，优先验证：

- 钓鱼 case 是否能召回 phishing playbook 和相似 phishing case
- O365 登录异常 case 是否能召回登录异常 KB 和相似 case
- 真报与误报 case 是否能被区分并保留不同模式
- 召回结果是否包含关键 evidence / decision points