COLLECTION RECORD - Case CC-2026-031 ("The Midnight Upload")
========================================================================
Collected by:   Jannik Ohlsen, SOC analyst, NordWacht Security GmbH (managed SOC of Crumble & Co.)
Requested by:   Claudia Reimers, Head of Corporate Security, ticket SEC-2026-0412
Collected on:   Mon 2026-11-23, 09:31-09:46 CET, from soc-jump.corp.crumble.example (read-only accounts)
Reference time: soc-jump, NTP-synchronised (stratum 2, offset < 1 ms; timedatectl checked 09:30)
Window:         2026-11-09 00:00 to 2026-11-22 23:59 Europe/Berlin (agreed with legal and works council)
Legal hold:     mailboxes nvogt and tlindqvist, released items for the window (HR + works council, 2026-11-23)

1. EXPORTS (all sources exported for the full window; nothing filtered)
------------------------------------------------------------------------
09:31  pacs      badge_access.csv           542 lines   Physical access control, central export (all sites)   retention 90 d
09:32  dhcp-ham  dhcp_HAM.log               209 lines   DHCP server Hamburg   retention 90 d
09:32  dhcp-lue  dhcp_LUE.log                83 lines   DHCP server Lüneburg   retention 90 d
09:32  dhcp-bre  dhcp_BRE.log                27 lines   DHCP server Bremen   retention 90 d
09:32  wlc       wlc.log                    421 lines   WLAN controller wlc01 (all sites)   retention 90 d
09:32  wef       windows_security.jsonl     679 lines   Windows Event Forwarding collector wef01   retention 90 d
09:33  vpn       vpn.log                     50 lines   VPN gateway vpn-gw01   retention 90 d
09:33  proxy     proxy_access.log          6871 lines   Web proxy proxy01 (squid)   retention 14 d
09:34  zeek      dns.log                   3626 lines   Zeek sensor zeek-ham: dns.log (resolver), conn.log (HQ client VLAN + VPN pool)   retention 14 d
09:34  zeek      conn.log                  6220 lines   Zeek sensor zeek-ham: dns.log (resolver), conn.log (HQ client VLAN + VPN pool)   retention 14 d
09:35  netflow   netflow.csv               6357 lines   Edge router flows, collector nfcollector01   retention 14 d
09:36  exchange  mail_tracking.csv         1398 lines   Exchange message tracking (EXCH01)   retention 30 d
09:37  crm       crm_audit.jsonl            542 lines   CRM audit log (CRM01)   retention 365 d
09:37  siem      alerts.json                196 lines   SIEM alert export (siem01)   retention 365 d
09:37  cmdb      employees.csv               18 lines   HR + asset inventory (reference data)
09:37  geoip     geoip.csv                   11 lines   GeoIP enrichment table (reference data)

2. CLOCK CHECK (ntpdate -q <host>, query only, 09:39 CET; + = source clock ahead)
------------------------------------------------------------------------
server pacs-ham-ctl   stratum 16, offset +183.204551   ** NOT SYNCHRONISED (stratum 16) **
server pacs-lue-ctl   stratum  3, offset +0.412000
server pacs-bre-ctl   stratum  3, offset -0.287000
server dhcp-ham       stratum  3, offset +0.003000
server dhcp-lue       stratum  3, offset -0.011000
server dhcp-bre       stratum  3, offset +0.006000
server wlc01          stratum  3, offset +0.021000
server wef01          stratum  3, offset +0.001000
server vpn-gw01       stratum  3, offset -0.004000
server proxy01        stratum  3, offset +0.002000
server zeek-ham       stratum  2, offset +0.000412
server nfcollector01  stratum  3, offset +0.018000
server exch01         stratum  3, offset +0.002000
server crm01          stratum  3, offset -0.009000
server siem01         stratum  3, offset +0.001000
Note: pacs-ham-ctl was replaced in October 2026 and has not been added to NTP since (facility ticket FAC-2026-1187).
Log times were exported as written by each source; no corrections applied.

3. IDS CAPTURE
------------------------------------------------------------------------
09:41  cp /data/ids/triggered/DLP-VOL-01_20261119T2144.pcap ids_capture.pcap
09:41  sha256sum -c DLP-VOL-01_20261119T2144.pcap.sha256 -> ids_capture.pcap: OK (hash written by the IDS on 2026-11-19 21:44Z)
       380 packets, capture point SPAN of HQ client VLAN 20 + VPN pool (ids-ham01); ring buffer, per-flow cap: first 2 KiB in full, then 128 bytes per packet

4. MAILBOXES (legal hold)
------------------------------------------------------------------------
09:42  mail/Appointment_Nordkauf.eml
09:42  mail/Contract_documents.eml
09:42  mail/IT_Ticket_4471.eml
09:42  mail/Mailbox_almost_full.eml
09:42  mail/NDR_Key_accounts.eml
09:42  mail/Newsletter_foodnavigator.eml
09:42  mail/Order_ORD-2026-11873.eml
09:42  mail/Planned_maintenance.eml
09:42  mail/Resignation.eml
09:42  mail/Sales_meeting_agenda.eml
09:42  mail/Service_appointment.eml
09:42  mail/Travel_expenses.eml

5. HASHES (SHA-256, computed 09:44 CET on soc-jump; this record itself is listed in SHA256SUMS)
------------------------------------------------------------------------
5b51db50d11946b104a9cf20a1a957028b0aecbd91897fc403c40ce3a21b0c6c  README.txt
14179c2960abff61543cfb3576048cf46189c9a167762a51f55566720f561d05  alerts.json
818ec83b2493829e5886a25fb27761b9307693e27c436ca7021aa69ba5d234b5  badge_access.csv
dcd9b3cbd61fe0da5e29b5a50319054a215b2fd930f247f81a9f0685ba43cebd  conn.log
833cc875f5c978f2b377e7eb68e533d40dedb96a5b4b52dacc04862d6129849d  crm_audit.jsonl
5aa7bd53ac94fde3d735acd42f5208114448c71f2e28f5f718500488817c8f59  dhcp_BRE.log
3ee73d491ce6da49bc4796058b6b1f9aeb3a57e95addde947830f5009efc3761  dhcp_HAM.log
50d12c1b240e0bfdc2eee26e6636ff2ae63ca301f6ef4297d352e8c6f50409e2  dhcp_LUE.log
1c88bc881e254176d6a1f8eede4fb92d21931adc47023021ff569cb566da8e82  dns.log
fb4f53028469af8e717218d830ea615d83930e9651466cf4907765dcff9ef4bc  employees.csv
f9f7f54c3ddba57ba0df6de99b0addda09272f21a7ad2502269fcc413127e47d  geoip.csv
753c209dc1af44c06c9790a500c4bf7a842d6091b970df4b035de93c8be65bf2  ids_capture.pcap
68b80ad15b3f32130bfe7acc8b68d36850994ed4e03a528d7994d06ab544bf28  mail/Appointment_Nordkauf.eml
5b40b9ed41e1ea2055b0b63dc5e10808ee3b0e0ddc72259244964c5635554691  mail/Contract_documents.eml
d3c5ce21d8a19944c3541407ab05b46770b01f5d2ac98ef485ef2d8e26bb038c  mail/IT_Ticket_4471.eml
ba4403dfeac8ee45c83856118cfc4f9b3c53c5757b4f1d83368e841409dda906  mail/Mailbox_almost_full.eml
88efd20fe9a41284ccb7643954fda3ab8f67db95dfa9eceafdfc65b51d8aef5b  mail/NDR_Key_accounts.eml
29ee09143b6510e4fae56f498fa2528c3ade98d089edb8af8545f17cb2863c24  mail/Newsletter_foodnavigator.eml
bc329ad356bf174c2c4b5302222c8506d1e30277a56b416c3edb3f4979b77c9c  mail/Order_ORD-2026-11873.eml
d5bbe8882226e3810e685efd98471e4f253118f291f0405317689d8139274f43  mail/Planned_maintenance.eml
c3f923ce1ee350a7b6c91d14efb0d3442db963b89239c837e058340f721389b1  mail/Resignation.eml
0943a4b9468fea3ddb41ec2fb03a1abfdf4e0165931aeddf41a0ae7e9b2aea2e  mail/Sales_meeting_agenda.eml
cfd602aefd86f89ed275dde0aef6fd26ca4b5c6e939595a7566d2d6f7025c690  mail/Service_appointment.eml
2efb46bcb7b2ab62f107c76371058d81205045553e48f23e78cf1ec9b4b22ed8  mail/Travel_expenses.eml
05b243998432d8dc1105a6400b21696185a4bc9bdd0c9c4ae3e1eeac3477fb52  mail_tracking.csv
79ee466e9697504594067728ea230db48a0abafd0751059ee47d25370b635717  netflow.csv
95b9d93111b4732b9d6cbf39a6b96f6f0c93acc049db93d00c1637980e712e0a  proxy_access.log
3c827fe17aad9fdfd0e4c91e425ecf6142fc6b6dc0505bc7c8feb61e6c67c9d3  vpn.log
325ccedfa834d49c5d4d17d3ffb5e0aef430b7045c1e0578d8607d7bec52c44b  windows_security.jsonl
fb9bfbde70c6a5a7ae45e0a8b270a79d1c5028505a1fb7f2565b318f7194a588  wlc.log

Handed over: 2026-11-23 09:50 CET, J. Ohlsen (SOC) -> C. Reimers (Corporate Security), as case2_evidence.zip.
Signed: J. Ohlsen