{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"198.51.100.2","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"IP linked to C2 infrastructure for Lazarus Group"}},{"id":"artifact_2","type":"url","value":"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz","is_critical":true,"osint_result":{"source":"URLScan","verdict":"malicious","details":"URL used for C2 communication by known APT group"}},{"id":"artifact_3","type":"domain","value":"discordapp.com","is_critical":false,"osint_result":{"source":"Pattern Analysis","verdict":"suspicious","details":"Domain frequently used in benign and malicious activity"}}],"expected_actions":["isolate_host","collect_forensics","block_url","close_alert"],"expected_verdict":"true_positive","expected_category":"data_exfiltration","analysis_notes":"The network traffic indicates data exfiltration via Discord, associated with the Lazarus Group."}