{
  "schema_version": 1,
  "kind": "signalbridge-wazuh-reviewed-records",
  "run_id": "9432c474-f48e-4b70-87a8-9fd7d33bf51c",
  "parent_receipt": "20260925-wazuh-product-backfill.json",
  "parent_receipt_sha256": "979414281e871b8f421217b4a71e30cf630f6c47913a7181510d4f44092e4ba4",
  "imported_receipt_sha256": "170afe7e41f7fb5bfd7eac2b648258750323fa54611b6cd902380906d7d649e7",
  "input_sha256": "3c9f218f013fcc7a0f4fefafacef71e0160fd532c02ce54246cf408f12e3dd86",
  "archives_sha256": "2249dc408c1ce58bbda87b7c9761cf2d628af5b09c06faf36b418cd3aa455fa6",
  "alerts_sha256": "199daba4b98e9b5e1c2ca3047df7304aa59809681563e9793b026a20084192f2",
  "counts": {
    "alerts": 31,
    "duplicates": 0,
    "inputs": 64,
    "missing": 0,
    "nonalerts": 33,
    "received": 64,
    "rule_cases": 27
  },
  "observations": [
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "0007dd48-5c1f-4292-bd17-aac0471da23d",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.280000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "083599dd-5718-409c-ae05-c85c5d82e6b8",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "09e156b9-b1d6-49da-b207-43e5709e79b5",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "0a0037f7-cd5c-475b-b2eb-f2b629c08c15",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.145000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "migration_lab",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "0d8975a0-2978-42dc-811e-6c4708318c93",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "10147ef0-b895-4e35-a338-199f23f55a0a",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "14a7af01-3efb-44e9-ae91-99247f01ef41",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "synthetic_demo",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "181ba3e8-6203-4391-9897-9ac4f2b4c5ef",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "1842110a-ab02-4a6f-8dc7-6f2c15897b17",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "19e54285-90ab-447f-a699-3e6613b2cbc0",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.282000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "1c92ffff-b00d-4fdf-ac49-c621f1a7752f",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "synthetic_demo",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "1cf3355e-31db-4688-869f-2b73290a6093",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.296000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "owner",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "221cbec0-1b8b-4725-9610-8137b10a90fa",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "2a356653-bc58-416a-a7c0-e566b3f45fde",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "2f714712-4850-4a3b-a809-364f99777804",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "2f7ae5d6-f0d9-4208-a548-195cc391c496",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "3c2a5e5a-b0fa-4bce-a338-bd8fcdb31b57",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "3d3a26fa-3175-446e-8003-9c506a167a2b",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.144000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "migration_lab",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "407fe5ed-1497-406d-b1a1-158f8ed50222",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.157000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "migration_lab",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "41e870d3-b3b3-41d8-86cb-525f6226f7eb",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "466ee734-fd65-4863-a186-b1c0bc5a6645",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.289000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "owner",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "49a5b15e-9ad3-4036-84c7-98036a3dbc6b",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "4aa3ccc2-70ba-4cdc-8d48-2afe10e55906",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "5176d4ee-8575-44b6-8d05-0a551d5290eb",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "53d9bef4-9cd4-4942-a00e-d2c5c18d1374",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.099000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "migration_lab",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "5682a54d-4c0f-4c42-9716-154878e1a23e",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.142000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "migration_lab",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "5aa7a4fd-e113-44c6-ace1-3ddb1d4d5dce",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "synthetic_demo",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "5bf24e40-0e64-4510-bb99-bac32e280b6c",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "synthetic_demo",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "64dac00e-552f-4b15-ae15-f6f336df47a9",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.292000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "6950c558-19cf-45c3-9d95-c1d0c1c3552e",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.237000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "owner",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "6b3a48f9-e323-4a9f-a70d-e78aef467210",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "membership_removed",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "6d2238b3-f468-4b90-939f-9b4d4e8fa2b5",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "synthetic_demo",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "6e4948cd-a7d4-41e1-b6e5-3fac134cd859",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "6fc57b92-8c3f-4a37-9e6a-60ac93a97aff",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.238000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "70d41830-086e-4c0e-b841-2e3f10dce81b",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.161000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "migration_lab",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "7101a38c-0a37-4007-9a1c-5dc5011d0308",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.283000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "732652ff-e625-40ff-9e98-d57ac3385308",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "7ad01e84-68ab-4bcf-9293-77022f815a0a",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "85c5650d-469d-413f-85b1-722b482e3e0e",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.276000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "owner",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "8769669b-e312-4b65-a4cf-2d7a7e9d3917",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.147000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "migration_lab",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "8c1b3d1e-c1a8-41c3-80f6-58d8e53e5498",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "synthetic_demo",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "92bfd6c7-573c-40b8-af52-7810c2022324",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "972b42bf-8776-4972-80fe-df9f6653e8a0",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "980ca376-59e5-43f3-9e55-0563474f0685",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.097000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "migration_lab",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "9f1f1ea2-2780-4d22-af7c-9875bce0d102",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.150000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "policy_regression",
      "source": "migration_lab",
      "rule_id": "100201",
      "level": 12
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "a08797ec-978c-4e75-9f38-edbe22d8aee0",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.279000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "a2d78da3-7b7a-4a52-b4a8-21f722528111",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.149000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "migration_lab",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "a6151d91-fbdc-474f-b67e-0cee3a6b066e",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.285000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "policy_regression",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "a7cbe333-c7ed-4681-89c9-1d95ee62517b",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "synthetic_demo",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "b35a765b-1283-4230-9338-c5812afdac1e",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.285000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "owner",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "b6b8d23d-ba83-4272-bdf9-801a70f72806",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "ba37a9fb-0122-4b64-960b-9cbbe895ea74",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.294000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "bc831255-279c-4ed8-b1b7-81302827e118",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.160000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "migration_lab",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "be113c63-0a02-4308-986a-dcde4030ff4c",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "membership_removed",
      "source": "synthetic_demo",
      "rule_id": "100202",
      "level": 5
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "ca963698-8261-4c0b-9a6c-ccf13d970207",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.139000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "migration_lab",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "d3c3ba3c-bbf6-457a-919c-dab7b66e1f41",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "denied",
      "reason": "membership_required",
      "source": "synthetic_demo",
      "rule_id": "100203",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "d5e027d2-0e9d-481c-8b00-022c7aa1441d",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "d8817646-7265-496b-b476-e89ff5c06485",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "da635a75-046a-4b34-858e-4b02a13a29eb",
      "export_version": 1,
      "occurred_at": "2026-09-24T05:14:57.315000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "synthetic_demo",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "db58fa8f-229e-485b-8877-4bc03682da6a",
      "export_version": 1,
      "occurred_at": "2026-09-24T01:42:45.291000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "df67ef80-d9e1-47e6-9110-8a2df06f7304",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:01:23.768000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "legacy_unclassified",
      "rule_id": null,
      "level": null
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "e9ec6fca-405e-442e-9ca7-20dc72a26675",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:10:19.763000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "membership_removed",
      "source": "synthetic_demo",
      "rule_id": "100202",
      "level": 5
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "efb73408-e131-46e4-93a9-d5f28c06a933",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.156000+00:00",
      "operation": "private_record.read",
      "outcome": "not_visible",
      "reason": "resource_unavailable",
      "source": "migration_lab",
      "rule_id": "100204",
      "level": 3
    },
    {
      "app": "bettail",
      "environment": "lab",
      "event_id": "f447bdc7-d379-41a2-85d9-c00bdcca98b0",
      "export_version": 1,
      "occurred_at": "2026-09-24T02:05:58.154000+00:00",
      "operation": "private_record.read",
      "outcome": "allowed",
      "reason": "member",
      "source": "migration_lab",
      "rule_id": null,
      "level": null
    }
  ],
  "limits": [
    "Retained local lab metadata, not production telemetry or live monitoring.",
    "26 records retain unknown legacy classification; their source is not relabelled.",
    "Record IDs and allowed metadata only; no actors, resource contents, credentials or host paths.",
    "Reconciled retained bytes, not a fresh Wazuh execution or independent attestation."
  ]
}