{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"10.20.30.40","is_critical":true,"osint_result":{"source":"internal logs","verdict":"internal","details":"Internal IP address associated with compromised POS system."}},{"id":"artifact_2","type":"ip","value":"203.0.113.42","is_critical":true,"osint_result":{"source":"threat intelligence feed","verdict":"malicious","details":"Known C2 server used by FIN7 for data exfiltration."}},{"id":"artifact_3","type":"hash","value":"3d2e479b8b6f2c593b0e6e5b8f8a7d4a","is_critical":true,"osint_result":{"source":"malware database","verdict":"malicious","details":"Hash matches known malware associated with FIN7 operations."}},{"id":"artifact_4","type":"username","value":"john_doe","is_critical":false,"osint_result":{"source":"internal audit","verdict":"suspicious","details":"User account involved in unauthorized data transfer."}},{"id":"artifact_5","type":"filename","value":"credit_card_data.zip","is_critical":true,"osint_result":{"source":"file integrity monitoring","verdict":"malicious","details":"Sensitive data archive intended for exfiltration."}}],"recommended_actions":["isolate_host","block_ip","block_hash","collect_forensics","escalate"],"expected_verdict":"True Positive","expected_actions":["isolate_host","block_ip","block_hash","collect_forensics","escalate"]}