# Continuous controls monitoring demo (SIMULATED)

> Fictional company (Northstar Financial Technologies), synthetic data. This is a deterministic replay of a **simulated** 31-day feed (2026-10-01 to 2026-10-31). No real system is monitored, no real person or account is involved and **no alert is ever sent**.

## What it does
- Starts from the state at 2026-09-30: the Project 1 extract plus the remediation that the 2026-09-28 retest observed.
- Applies 35 seeded feed events (HR terminations, access grants, approvals, MFA changes, a post-termination login), using seed 20261201.
- Each day, 3 rules re-perform Project 1 audit tests on that day's snapshot: M-01 leaver access (T-02), M-02 administrator approval (T-08), M-03 MFA (T-07).
- Each exception is tracked from first detection to resolution, aged in business days, and raises simulated alerts: to the owner, then to the next level when the SLA is breached, then to the Chief Risk Officer.

## Files
- `monitoring-policy.csv`: rule definitions, severities, SLAs and escalation roles (fictional policy).
- `feed-events.csv`: every simulated event.
- `daily-results.csv`: open, new, resolved and past-SLA counts and a health status per rule per day.
- `exceptions-log.csv`: one row per exception with its full lifecycle.
- `alerts.csv`: every simulated alert.
- `summary.json`: totals and the reconciliation with the audit.

## How it is checked
`tests/ccm/` proves that the rules flag exactly the same records as the audit on the original 2026-07-15 extract, that the replay is identical on every run, that daily counts equal the lifecycle log, and that alerts follow the escalation policy.

## What it is not
It is not a live service and it is not connected to any identity, HR or ticketing system. A real deployment would replace the simulated feed with scheduled extracts from those systems, run the same rules daily, and send alerts through a ticketing or messaging tool. That would need approval to access the data, a privacy review and tuning of the rules to limit false alarms.

Run it: `python -m ccm.cli` (inside the project's Docker image; see the repository README).