{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"192.168.1.101","is_critical":true,"osint_result":{"source":"Internal Network","verdict":"internal","details":"Internal employee workstation."}},{"id":"artifact_2","type":"ip","value":"185.199.108.153","is_critical":true,"osint_result":{"source":"OSINT","verdict":"suspicious","details":"Known to host suspicious activity related to data scraping."}},{"id":"artifact_3","type":"url","value":"https://www.linkedin.com/profile/view?id=123456789","is_critical":false,"osint_result":{"source":"LinkedIn","verdict":"clean","details":"Legitimate LinkedIn profile URL."}},{"id":"artifact_4","type":"username","value":"j.doe","is_critical":false,"osint_result":{"source":"Internal Directory","verdict":"internal","details":"John Doe, employee in sales department."}}],"recommended_actions":["isolate_host","block_ip","collect_forensics","escalate"],"expected_verdict":"True Positive","expected_actions":["isolate_host","block_ip","collect_forensics"]}