{
  "dataset_scope": "Synthetic authentication events only",
  "total_events": 600,
  "unique_users": 63,
  "failed_events": 99,
  "successful_events": 501,
  "events_without_mfa_challenge": 121,
  "unmanaged_device_events": 120,
  "scenario_tag_counts": {
    "routine": 500,
    "password_spray_simulation": 60,
    "unusual_location_simulation": 15,
    "legacy_auth_simulation": 15,
    "privileged_no_mfa_simulation": 10
  },
  "important_limit": "Scenario tags are included to make the synthetic dataset auditable. They are not independent proof that a real attack occurred."
}