# Synthetic source fixtures

All files below are deliberately small, synthetic, and free of customer or company data. They are regression inputs for the generic import pipeline, not complete vendor golden files. Source-specific recognition and semantic extraction remain part of Phase 6.

## PingCastle

- Files: `pingcastle/healthcheck.synthetic.html` and `pingcastle/healthcheck.synthetic.xml`
- Basis: the official PingCastle repository describes the healthcheck report and its score categories. The published report generator uses the categories Stale Objects, Privileged Accounts, Trusts, and Anomalies and renders matched rule details with Rule ID, Description, Technical explanation, Advised solution, and Points.
- Sources:
- The HTML and XML fixtures represent the same synthetic matched rule. Their format-native extraction must resolve to the same PingCastle Rule ID while preserving each file's original fields and source location.
  - https://github.com/netwrix/pingcastle
  - https://github.com/netwrix/pingcastle/blob/master/PingCastleCommon/Report/ReportRiskControls.cs
  - https://github.com/netwrix/pingcastle/blob/master/PingCastleCommon/Report/ReportHealthCheckSingle.cs
  - https://github.com/netwrix/pingcastle/blob/master/PingCastleCommon/Data/HealthcheckData.cs

## CIS-CAT

- Files: `cis-cat/assessment.synthetic.html` and `cis-cat/assessment.future-controls.synthetic.html`
- Basis: the official CIS-CAT guide documents the HTML sections Summary, Profiles, Assessment Results, and Assessment Details; it also documents Pass, Fail, Error, Unknown, and Manual result states and the detail areas Description, Rationale, Remediation, Impact, Assessment, References, and CIS Controls.
- `assessment.future-controls.synthetic.html` repeats the same rule structure with control mappings the application cannot know in advance: a newer revision of the same CIS series and an unrelated framework. It is the regression input for section detection that must read its headings from the report instead of a fixed list, so that hidden evidence and control tables keep reaching the results window when a later report adds a framework.
- Sources:
  - https://ciscat-assessor.docs.cisecurity.org/en/latest/ReportHTML/
  - https://ciscat-assessor.docs.cisecurity.org/en/latest/CLI/

## Maester

- File: `maester/test-results.synthetic.csv`
- Basis: the official `Convert-MtResultsToFlatObject` implementation defines the flat CSV/Excel columns used here. `Invoke-Maester` documents CSV, Excel, HTML, JSON, and Markdown output.
- Sources:
  - https://github.com/maester365/maester/blob/main/powershell/public/core/Convert-MtResultsToFlatObject.ps1
  - https://maester.dev/docs/commands/Invoke-Maester/

- File: `maester/test-results.synthetic.html`
- Models the inert JSON object embedded by the official single-file Maester HTML report generator; it contains synthetic test values only.
- Sources:
  - https://github.com/maester365/maester/blob/main/powershell/public/Get-MtHtmlReport.ps1
  - https://github.com/maester365/maester/blob/main/powershell/public/core/ConvertTo-MtMaesterResult.ps1
  - https://maester.dev/docs/commands/Get-MtHtmlReport/

- File: `purple-knight/security-assessment.synthetic.html`
- Models the script-embedded `window.reportJSON` and category indicator assignments observed in a locally supplied PurpleKnight dummy report. No source values were copied into this fixture.

When an anonymized real export can legally be added, it should supplement these structural fixtures and must be reviewed for tenant names, domains, accounts, identifiers, evidence, comments, and embedded metadata first.