{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"198.51.100.23","is_critical":true,"osint_result":{"source":"AbuseIPDB","verdict":"malicious","details":"IP reported 112 times for phishing activities"}},{"id":"artifact_2","type":"email","value":"hr-support@external.com","is_critical":true,"osint_result":{"source":"VirusTotal","verdict":"suspicious","details":"Domain associated with previous phishing campaigns"}},{"id":"artifact_3","type":"command","value":"powershell.exe -enc W3Bhc3N3b3JkID0gJ1Bhc3N3b3JkMTIzJyA7IFtzeXN0ZW0uTmV0LlNlcnZpY2VzLkRucENsaWVudF0uR2V0SG9zdEJ5TmFtZSgnY21kLmRvbWFpbi5jb20nKS5BZGRyZXNz","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"Encoded command leading to potential C2 communication"}}],"expected_actions":["isolate_host","block_ip","reset_credentials"],"expected_verdict":"true_positive","expected_category":"phishing","analysis_notes":"The email was identified as a spear-phishing attempt due to the encoded PowerShell command targeting internal HR systems."}