{"playbook_version":2,"checkedArtifacts":["ip-192.168.1.100","ip-10.0.0.15","ip-203.0.113.45","artifact_1","artifact_3"],"selectedActions":["block_ip","block_hash"],"verdict":"true_positive","conclusion":"Subject identified as True Positive. Suspicious email contained malware detected by OSINT scan. Hash was identified to be malicious. Senders IP address is known to be associated with phishing organization. IP address was blocked on Firewall. Hash was also blocked on all host machines.","submitted_at":"2026-02-11T17:16:22.373Z"}