feat: Adjust alert timing offsets and update RDP alert title in Apollo scenario

- Updated data exfiltration alert offset from 20 to 25 minutes with clarifying comment (after last document download at base+24:30)
- Updated RDP download alert offset from 25 to 35 minutes with clarifying comment (after RDP file download event at base+25)
- Changed RDP alert title from "Apollo Ransomware - RDP Files Downloaded" to "OneDrive RDP Files Downloaded" for consistency

Author: jmorascalyr

Backend/scenarios/apollo_ransomware_scenario.py

@@ -159,17 +159,17 @@
     },
     "📤 PHASE 4: Data Exfiltration": {
         "template": "sharepoint_data_exfil_alert",
-        "offset_minutes": 20,  # 20 min after initial compromise
+        "offset_minutes": 25,  # After last document download (base+24:30)
         "overrides": {
             "finding_info.title": "Data Exfiltration from SharePoint",
             "finding_info.desc": f"User {VICTIM_PROFILE['email']} downloaded sensitive documents including Personnel Records and Command Codes"
         }
     },
     "rdp_download": {
         "template": "o365_rdp_sharepoint_access",
-        "offset_minutes": 25,  # 25 min after initial compromise
+        "offset_minutes": 35,  # After RDP file download event (base+25)
         "overrides": {
-            "finding_info.title": "Apollo Ransomware - RDP Files Downloaded",
+            "finding_info.title": "OneDrive RDP Files Downloaded",
             "finding_info.desc": f"User {VICTIM_PROFILE['email']} downloaded RDP files from SharePoint - potential lateral movement preparation"
         }
     }