{
  "feature_names": [
    "timestep",
    "dest_port",
    "bytes_transferred",
    "connection_duration_s",
    "auth_failure_count",
    "process_injection_flag",
    "lateral_hop_count",
    "c2_beacon_interval_s",
    "edr_blocked_flag",
    "siem_rule_triggered",
    "seg_patch_lag_days_mean",
    "seg_exposure_score_mean",
    "seg_vulnerability_count_max",
    "seg_inter_segment_trust_level_mean",
    "seg_alert_threshold_sensitivity_mean",
    "seg_mttd_baseline_hours_mean",
    "seg_mttr_baseline_hours_mean",
    "seg_siem_coverage_flag_mean",
    "seg_edr_deployed_flag_mean",
    "seg_ndr_coverage_flag_mean",
    "seg_mfa_enforced_flag_mean",
    "byte_volume_log",
    "has_c2_beacon",
    "is_brute_forcing",
    "attacker_defender_advantage",
    "is_high_volume",
    "is_privileged_port",
    "target_asset_type_backup_system",
    "target_asset_type_cloud_vm",
    "target_asset_type_container",
    "target_asset_type_database_server",
    "target_asset_type_domain_controller",
    "target_asset_type_ehr_system",
    "target_asset_type_email_server",
    "target_asset_type_firewall",
    "target_asset_type_iot_device",
    "target_asset_type_router",
    "target_asset_type_scada_plc",
    "target_asset_type_server",
    "target_asset_type_vpn_gateway",
    "target_asset_type_web_server",
    "target_asset_type_workstation",
    "source_ip_class_cloud_egress",
    "source_ip_class_external_internet",
    "source_ip_class_internal_lan",
    "source_ip_class_tor_exit",
    "source_ip_class_vpn_tunnel",
    "protocol_dns",
    "protocol_ftp",
    "protocol_http",
    "protocol_https",
    "protocol_icmp",
    "protocol_rdp",
    "protocol_smb",
    "protocol_ssh",
    "protocol_tcp",
    "protocol_udp",
    "attacker_capability_tier_apt",
    "attacker_capability_tier_nation_state",
    "attacker_capability_tier_opportunistic",
    "attacker_capability_tier_script_kiddie",
    "defender_maturity_level_advanced",
    "defender_maturity_level_baseline",
    "defender_maturity_level_managed",
    "defender_maturity_level_minimal",
    "defender_maturity_level_zero_trust",
    "alert_severity_critical",
    "alert_severity_high",
    "alert_severity_informational",
    "alert_severity_low",
    "alert_severity_medium",
    "detection_outcome_blind_spot",
    "detection_outcome_edr_blocked",
    "detection_outcome_evasion_success",
    "detection_outcome_high_confidence_alert",
    "detection_outcome_ir_escalated",
    "detection_outcome_marginal_alert",
    "detection_outcome_suppressed_alert",
    "seg_segment_type_cloud_workload",
    "seg_segment_type_corporate_lan",
    "seg_segment_type_data_exfiltration_target",
    "seg_segment_type_endpoint_fleet",
    "seg_segment_type_soc_management_plane",
    "seg_segment_type_supply_chain_interface",
    "seg_segment_type_zero_trust_segment",
    "seg_defender_maturity_level_advanced",
    "seg_defender_maturity_level_baseline",
    "seg_defender_maturity_level_managed",
    "seg_defender_maturity_level_minimal",
    "seg_defender_maturity_level_zero_trust"
  ],
  "numeric_features": [
    "timestep",
    "dest_port",
    "bytes_transferred",
    "connection_duration_s",
    "auth_failure_count",
    "process_injection_flag",
    "lateral_hop_count",
    "c2_beacon_interval_s",
    "edr_blocked_flag",
    "siem_rule_triggered",
    "seg_patch_lag_days_mean",
    "seg_exposure_score_mean",
    "seg_vulnerability_count_max",
    "seg_inter_segment_trust_level_mean",
    "seg_alert_threshold_sensitivity_mean",
    "seg_mttd_baseline_hours_mean",
    "seg_mttr_baseline_hours_mean",
    "seg_siem_coverage_flag_mean",
    "seg_edr_deployed_flag_mean",
    "seg_ndr_coverage_flag_mean",
    "seg_mfa_enforced_flag_mean",
    "byte_volume_log",
    "has_c2_beacon",
    "is_brute_forcing",
    "attacker_defender_advantage",
    "is_high_volume",
    "is_privileged_port"
  ],
  "categorical_levels": {
    "target_asset_type": [
      "backup_system",
      "cloud_vm",
      "container",
      "database_server",
      "domain_controller",
      "ehr_system",
      "email_server",
      "firewall",
      "iot_device",
      "router",
      "scada_plc",
      "server",
      "vpn_gateway",
      "web_server",
      "workstation"
    ],
    "source_ip_class": [
      "cloud_egress",
      "external_internet",
      "internal_lan",
      "tor_exit",
      "vpn_tunnel"
    ],
    "protocol": [
      "dns",
      "ftp",
      "http",
      "https",
      "icmp",
      "rdp",
      "smb",
      "ssh",
      "tcp",
      "udp"
    ],
    "attacker_capability_tier": [
      "apt",
      "nation_state",
      "opportunistic",
      "script_kiddie"
    ],
    "defender_maturity_level": [
      "advanced",
      "baseline",
      "managed",
      "minimal",
      "zero_trust"
    ],
    "alert_severity": [
      "critical",
      "high",
      "informational",
      "low",
      "medium"
    ],
    "detection_outcome": [
      "blind_spot",
      "edr_blocked",
      "evasion_success",
      "high_confidence_alert",
      "ir_escalated",
      "marginal_alert",
      "suppressed_alert"
    ],
    "seg_segment_type": [
      "cloud_workload",
      "corporate_lan",
      "data_exfiltration_target",
      "endpoint_fleet",
      "soc_management_plane",
      "supply_chain_interface",
      "zero_trust_segment"
    ],
    "seg_defender_maturity_level": [
      "advanced",
      "baseline",
      "managed",
      "minimal",
      "zero_trust"
    ]
  },
  "label_to_int": {
    "dwell_idle": 0,
    "reconnaissance": 1,
    "initial_access": 2,
    "execution": 3,
    "persistence": 4,
    "privilege_escalation": 5,
    "lateral_movement": 6,
    "collection": 7,
    "exfiltration": 8,
    "impact": 9
  },
  "int_to_label": {
    "0": "dwell_idle",
    "1": "reconnaissance",
    "2": "initial_access",
    "3": "execution",
    "4": "persistence",
    "5": "privilege_escalation",
    "6": "lateral_movement",
    "7": "collection",
    "8": "exfiltration",
    "9": "impact"
  },
  "topology_aggregation": {
    "segment_constant": [
      "segment_type",
      "defender_maturity_level"
    ],
    "segment_numeric_aggregates": {
      "patch_lag_days": "mean",
      "exposure_score": "mean",
      "vulnerability_count": "max",
      "inter_segment_trust_level": "mean",
      "alert_threshold_sensitivity": "mean",
      "mttd_baseline_hours": "mean",
      "mttr_baseline_hours": "mean",
      "siem_coverage_flag": "mean",
      "edr_deployed_flag": "mean",
      "ndr_coverage_flag": "mean",
      "mfa_enforced_flag": "mean"
    }
  }
}