{
  "schema_version": 1,
  "observed_live": true,
  "curated_utc": "2026-11-06T18:32:23.2165479+00:00",
  "private_material_included": false,
  "transaction_digest": "SHA-256 of the lowercased transaction ID; original transaction IDs are omitted.",
  "source_files": [
    {
      "source": "access",
      "protected_source_basename": "access-logs.json",
      "source_sha256": "8a2243dd6b24a6d854b085fa04c9a644f27982ba77cf9b594809c17c32a888b1",
      "retained_row_count": 55
    },
    {
      "source": "firewall",
      "protected_source_basename": "firewall-logs.json",
      "source_sha256": "5ff012142109cf4e8fffdf8361c96f9f085c6c035c2f9373ca09375d2d10dcfb",
      "retained_row_count": 27
    }
  ],
  "selection_notes": [
    "All examples derive from genuine retained Azure Monitor query result tables.",
    "The labSnippet 403 is selected only from the 18:23:48Z to 18:24:30Z WAF-fault window, excluding initial calibration.",
    "Post-repair examples are selected after that fault; parameter values and full request URIs are never published.",
    "An empty correlated-firewall array means no matching row was retained, not a fabricated WAF event."
  ],
  "examples": [
    {
      "scenario": "control_200",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:26:44.0000000+00:00",
      "http_status": 200,
      "request_path": "/control/index.html",
      "parameter_names": [
        "runMarker"
      ],
      "transaction_sha256": "e466aab09b73e7c295ad2fc341184374e3fd7b92c612480a4a7861ac10ea32bd",
      "access_source": "access",
      "correlated_firewall_rows": [],
      "firewall_correlation_status": "No firewall row for this transaction in retained source"
    },
    {
      "scenario": "probe_fault_502",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:10:37.0000000+00:00",
      "http_status": 502,
      "request_path": "/probe-fault/index.html",
      "parameter_names": [
        "runMarker"
      ],
      "transaction_sha256": "82a73f90db9183dc7ce57e4c56b998ef8a75681bb6ad55dce9b95cc802ab23b1",
      "access_source": "access",
      "correlated_firewall_rows": [],
      "firewall_correlation_status": "No firewall row for this transaction in retained source"
    },
    {
      "scenario": "tls_fault_502",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:17:57.0000000+00:00",
      "http_status": 502,
      "request_path": "/tls-fault/index.html",
      "parameter_names": [
        "runMarker"
      ],
      "transaction_sha256": "4c1ce40521877aff2acb9bf6c544348bf5177d16edd8f9dc6309f965acfdae0a",
      "access_source": "access",
      "correlated_firewall_rows": [],
      "firewall_correlation_status": "No firewall row for this transaction in retained source"
    },
    {
      "scenario": "custom_marker_403",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:08:13.0000000+00:00",
      "http_status": 403,
      "request_path": "/control/index.html",
      "parameter_names": [
        "labMarker",
        "runMarker"
      ],
      "transaction_sha256": "740257ca3d36e8dd904268feb1896776243af8da325f6116c13fc98927288a23",
      "access_source": "access",
      "correlated_firewall_rows": [
        {
          "firewall_time_utc": "2026-11-06T18:08:13.0000000+00:00",
          "rule_id": "BlockWorkshopMarker",
          "rule_set_type": "Custom",
          "rule_set_version": "",
          "action": "Blocked",
          "source": "firewall"
        }
      ],
      "firewall_correlation_status": "Matching transaction rows retained"
    },
    {
      "scenario": "lab_snippet_403_during_waf_fault",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:23:52.0000000+00:00",
      "http_status": 403,
      "request_path": "/docs/index.html",
      "parameter_names": [
        "labSnippet",
        "runMarker"
      ],
      "transaction_sha256": "db08206351f6481334b816f706add3bb1f4d6c49521e78b58f78c503fb647864",
      "access_source": "access",
      "correlated_firewall_rows": [
        {
          "firewall_time_utc": "2026-11-06T18:23:52.0000000+00:00",
          "rule_id": "941100",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Matched",
          "source": "firewall"
        },
        {
          "firewall_time_utc": "2026-11-06T18:23:52.0000000+00:00",
          "rule_id": "941110",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Matched",
          "source": "firewall"
        },
        {
          "firewall_time_utc": "2026-11-06T18:23:52.0000000+00:00",
          "rule_id": "941160",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Matched",
          "source": "firewall"
        },
        {
          "firewall_time_utc": "2026-11-06T18:23:52.0000000+00:00",
          "rule_id": "949110",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Blocked",
          "source": "firewall"
        }
      ],
      "firewall_correlation_status": "Matching transaction rows retained"
    },
    {
      "scenario": "lab_snippet_200_after_waf_repair",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:24:57.0000000+00:00",
      "http_status": 200,
      "request_path": "/docs/index.html",
      "parameter_names": [
        "labSnippet",
        "runMarker"
      ],
      "transaction_sha256": "1a81ffee02ea1a636143b9144f384f55a81be3535337aade65526694f54434a7",
      "access_source": "access",
      "correlated_firewall_rows": [],
      "firewall_correlation_status": "No firewall row for this transaction in retained source"
    },
    {
      "scenario": "untrusted_snippet_403_after_waf_repair",
      "observed_live": true,
      "access_time_utc": "2026-11-06T18:24:58.0000000+00:00",
      "http_status": 403,
      "request_path": "/docs/index.html",
      "parameter_names": [
        "runMarker",
        "untrustedSnippet"
      ],
      "transaction_sha256": "2b9cd848e741c49b028c7017ccd29a744319754f2af4a2581bb7fe141ec5c0f7",
      "access_source": "access",
      "correlated_firewall_rows": [
        {
          "firewall_time_utc": "2026-11-06T18:24:58.0000000+00:00",
          "rule_id": "941100",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Matched",
          "source": "firewall"
        },
        {
          "firewall_time_utc": "2026-11-06T18:24:58.0000000+00:00",
          "rule_id": "941110",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Matched",
          "source": "firewall"
        },
        {
          "firewall_time_utc": "2026-11-06T18:24:58.0000000+00:00",
          "rule_id": "941160",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Matched",
          "source": "firewall"
        },
        {
          "firewall_time_utc": "2026-11-06T18:24:58.0000000+00:00",
          "rule_id": "949110",
          "rule_set_type": "Microsoft_DefaultRuleSet",
          "rule_set_version": "2.2",
          "action": "Blocked",
          "source": "firewall"
        }
      ],
      "firewall_correlation_status": "Matching transaction rows retained"
    }
  ]
}