{"playbook_version":2,"checkedArtifacts":["artifact_1","artifact_2","artifact_3"],"selectedActions":["block_hash","block_ip","reset_credentials","collect_forensics"],"verdict":"true_positive","conclusion":"An email from abc123@example.com which is detected for unusual activity sent to employee@corporate.com which had an malware attachment named urgent_document and the subject was urgent warning , when an email is sent as urgently it has higher chances to be phishing \nemail was sent from external IP - 203.0.113.45 which is known for phishing campaigns.","submitted_at":"2026-01-20T21:20:08.170Z"}