{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"198.51.100.14","is_critical":true,"osint_result":{"source":"OSINT Database","verdict":"malicious","details":"IP associated with previous cyber-attacks."}},{"id":"artifact_2","type":"filename","value":"nvidia_leaked_plans.pdf","is_critical":true,"osint_result":{"source":"OSINT Database","verdict":"malicious","details":"File associated with data breaches."}},{"id":"artifact_3","type":"filename","value":"confidential_emails.txt","is_critical":true,"osint_result":{"source":"OSINT Database","verdict":"malicious","details":"File associated with unauthorized disclosures."}},{"id":"artifact_4","type":"email","value":"attacker@darkmail.com","is_critical":true,"osint_result":{"source":"OSINT Database","verdict":"malicious","details":"Email used in multiple attack campaigns."}},{"id":"artifact_5","type":"url","value":"https://hackernews.com/leaks/nvidia","is_critical":false,"osint_result":{"source":"OSINT Database","verdict":"suspicious","details":"URL used for public disclosure of sensitive information."}}],"recommended_actions":["isolate_host","block_ip","block_hash","collect_forensics","escalate"],"expected_verdict":"True Positive","expected_actions":["block_ip","collect_forensics","escalate"]}